All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Jason A. Donenfeld" <Jason@zx2c4.com>
To: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: tytso@mit.edu, linux@dominikbrodowski.net, ebiggers@kernel.org,
	"Jason A. Donenfeld" <Jason@zx2c4.com>,
	Eric Biggers <ebiggers@google.com>
Subject: [PATCH v2 6/9] random: absorb fast pool into input pool after fast load
Date: Wed,  9 Feb 2022 02:19:16 +0100	[thread overview]
Message-ID: <20220209011919.493762-7-Jason@zx2c4.com> (raw)
In-Reply-To: <20220209011919.493762-1-Jason@zx2c4.com>

During crng_init == 0, we never credit entropy in add_interrupt_
randomness(), but instead dump it directly into the base_crng. That's
fine, except for the fact that we then wind up throwing away that
entropy later when we switch to extracting from the input pool and
overwriting the base_crng key. The two other early init sites --
add_hwgenerator_randomness()'s use crng_fast_load() and add_device_
randomness()'s use of crng_slow_load() -- always additionally give their
inputs to the input pool. But not add_interrupt_randomness().

This commit fixes that shortcoming by calling mix_pool_bytes() after
crng_fast_load() in add_interrupt_randomness(). That's partially
verboten on PREEMPT_RT, where it implies taking spinlock_t from an IRQ
handler. But this also only happens during early boot and then never
again after that. Should this turn into a larger problem later for some
esoteric reason, we can always use `if (IS_ENABLED(PREEMPT_RT))` or
something similar to that. But for now, this should do.

Cc: Theodore Ts'o <tytso@mit.edu>
Cc: Dominik Brodowski <linux@dominikbrodowski.net>
Suggested-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
---
 drivers/char/random.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/char/random.c b/drivers/char/random.c
index 785a4545c9d7..20374bce9a07 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -864,6 +864,13 @@ void add_interrupt_randomness(int irq)
 		    crng_fast_load((u8 *)fast_pool->pool, sizeof(fast_pool->pool)) > 0) {
 			fast_pool->count = 0;
 			fast_pool->last = now;
+
+			/* Technically this call means that we're using a spinlock_t
+			 * in the IRQ handler, which isn't terrific for PREEMPT_RT.
+			 * However, this only happens during very early boot, and then
+			 * never again, so we live with it.
+			 */
+			mix_pool_bytes(&fast_pool->pool, sizeof(fast_pool->pool));
 		}
 		return;
 	}
-- 
2.35.0


  parent reply	other threads:[~2022-02-09  2:40 UTC|newest]

Thread overview: 36+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-02-09  1:19 [PATCH v2 0/9] random: cleanups around per-cpu crng & rdrand Jason A. Donenfeld
2022-02-09  1:19 ` [PATCH v2 1/9] random: use RDSEED instead of RDRAND in entropy extraction Jason A. Donenfeld
2022-02-09  6:18   ` Dominik Brodowski
2022-02-09  1:19 ` [PATCH v2 2/9] random: get rid of secondary crngs Jason A. Donenfeld
2022-02-09  8:22   ` Dominik Brodowski
2022-02-09 10:26     ` Jason A. Donenfeld
2022-02-21  2:38   ` Eric Biggers
2022-02-09  1:19 ` [PATCH v2 3/9] random: inline leaves of rand_initialize() Jason A. Donenfeld
2022-02-09  8:22   ` Dominik Brodowski
2022-02-09 10:27     ` Jason A. Donenfeld
2022-02-09  1:19 ` [PATCH v2 4/9] random: ensure early RDSEED goes through mixer on init Jason A. Donenfeld
2022-02-09  8:23   ` Dominik Brodowski
2022-02-09 10:37     ` Jason A. Donenfeld
2022-02-09  1:19 ` [PATCH v2 5/9] random: do not xor RDRAND when writing into /dev/random Jason A. Donenfeld
2022-02-09  8:28   ` Dominik Brodowski
2022-02-09 10:40     ` Jason A. Donenfeld
2022-02-09  1:19 ` Jason A. Donenfeld [this message]
2022-02-09  8:29   ` [PATCH v2 6/9] random: absorb fast pool into input pool after fast load Dominik Brodowski
2022-02-09 10:45     ` Jason A. Donenfeld
2022-02-15 21:13       ` [PATCH v3] " Jason A. Donenfeld
2022-02-21  2:47         ` Eric Biggers
2022-02-21 14:57           ` Jason A. Donenfeld
2022-02-21 14:58             ` [PATCH v4] " Jason A. Donenfeld
2022-02-21 19:08               ` Eric Biggers
2022-02-09  1:19 ` [PATCH v2 7/9] random: use simpler fast key erasure flow on per-cpu keys Jason A. Donenfeld
2022-02-09  8:30   ` Dominik Brodowski
2022-02-09 10:54     ` Jason A. Donenfeld
2022-02-14 18:46   ` [PATCH v3] " Jason A. Donenfeld
2022-02-16 23:21     ` [PATCH v4] " Jason A. Donenfeld
2022-02-21  3:37       ` Eric Biggers
2022-02-21 14:42         ` Jason A. Donenfeld
2022-02-09  1:19 ` [PATCH v2 8/9] random: use hash function for crng_slow_load() Jason A. Donenfeld
2022-02-09  8:30   ` Dominik Brodowski
2022-02-21  3:40   ` Eric Biggers
2022-02-09  1:19 ` [PATCH v2 9/9] random: remove outdated INT_MAX >> 6 check in urandom_read() Jason A. Donenfeld
2022-02-21  3:56   ` Eric Biggers

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220209011919.493762-7-Jason@zx2c4.com \
    --to=jason@zx2c4.com \
    --cc=ebiggers@google.com \
    --cc=ebiggers@kernel.org \
    --cc=linux-crypto@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux@dominikbrodowski.net \
    --cc=tytso@mit.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.