On Thu, Mar 23, 2023 at 08:17:14AM +0100, Stephan Müller wrote:
>
> @@ -138,29 +139,35 @@ static int jent_kcapi_random(struct crypto_rng *tfm,
>
> spin_lock(&rng->jent_lock);
>
> - /* Return a permanent error in case we had too many resets in a row. */
> - if (rng->reset_cnt > (1<<10)) {
> + /* Enforce a disabled entropy source. */
> + if (rng->disabled) {
> ret = -EFAULT;
> goto out;
> }
Can we please get rid of this completely when we're not in FIPS
mode? Remember that jent is now used by all kernel users through
drbg. Having it fail permanently in this fashion is unacceptable.
If we're not in FIPS mode it should simply carry on or at least
seek another source of entropy, perhaps from the kernel RNG.
Thanks,
--
Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
