linux-kernel - [v4.9 PATCH 6/6] random: move rand

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220731182635.1910069-7-hegtvedt@cisco.com>
Date:   Sun, 31 Jul 2022 20:26:36 +0200
From:   Hans-Christian Noren Egtvedt <hegtvedt@...co.com>
To:     linux-kernel@...r.kernel.org
Cc:     gregkh@...uxfoundation.org, Kees Cook <keescook@...omium.org>,
        "Theodore Ts'o" <tytso@....edu>
Subject: [v4.9 PATCH 6/6] random: move rand_initialize() earlier

From: Kees Cook <keescook@...omium.org>

Right now rand_initialize() is run as an early_initcall(), but it only
depends on timekeeping_init() (for mixing ktime_get_real() into the
pools). However, the call to boot_init_stack_canary() for stack canary
initialization runs earlier, which triggers a warning at boot:

random: get_random_bytes called from start_kernel+0x357/0x548 with crng_init=0

Instead, this moves rand_initialize() to after timekeeping_init(), and moves
canary initialization here as well.

Note that this warning may still remain for machines that do not have
UEFI RNG support (which initializes the RNG pools during setup_arch()),
or for x86 machines without RDRAND (or booting without "random.trust=on"
or CONFIG_RANDOM_TRUST_CPU=y).

Signed-off-by: Kees Cook <keescook@...omium.org>
Signed-off-by: Theodore Ts'o <tytso@....edu>
(cherry picked from commit d55535232c3dbde9a523a9d10d68670f5fe5dec3)

Adjusted to fit on top of linux-4.9.y branch, suspecting a wrongly
solved conflict when cherry picked earlier.
---
 init/main.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/init/main.c b/init/main.c
index 6bc1a3fa152..6537f51a0ba 100644
--- a/init/main.c
+++ b/init/main.c
@@ -500,13 +500,6 @@ asmlinkage __visible void __init start_kernel(void)
 	page_address_init();
 	pr_notice("%s", linux_banner);
 	setup_arch(&command_line);
-	/*
-	 * Set up the the initial canary and entropy after arch
-	 * and after adding latent and command line entropy.
-	 */
-	add_latent_entropy();
-	add_device_randomness(command_line, strlen(command_line));
-	boot_init_stack_canary();
 	mm_init_cpumask(&init_mm);
 	setup_command_line(command_line);
 	setup_nr_cpu_ids();
-- 
2.34.1