This is a note to let you know that I've just added the patch titled random: initialize ChaCha20 constants with correct endianness to the 4.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: random-initialize-chacha20-constants-with-correct-endianness.patch and it can be found in the queue-4.14 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Thu Jun 16 07:08:33 PM CEST 2022 From: Eric Biggers <ebiggers@xxxxxxxxxx> Date: Sun, 21 Mar 2021 22:13:47 -0700 Subject: random: initialize ChaCha20 constants with correct endianness From: Eric Biggers <ebiggers@xxxxxxxxxx> commit a181e0fdb2164268274453b5b291589edbb9b22d upstream. On big endian CPUs, the ChaCha20-based CRNG is using the wrong endianness for the ChaCha20 constants. This doesn't matter cryptographically, but technically it means it's not ChaCha20 anymore. Fix it to always use the standard constants. Cc: linux-crypto@xxxxxxxxxxxxxxx Cc: Andy Lutomirski <luto@xxxxxxxxxx> Cc: Jann Horn <jannh@xxxxxxxxxx> Cc: Theodore Ts'o <tytso@xxxxxxx> Acked-by: Ard Biesheuvel <ardb@xxxxxxxxxx> Signed-off-by: Eric Biggers <ebiggers@xxxxxxxxxx> Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx> Signed-off-by: Jason A. Donenfeld <Jason@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/char/random.c | 4 ++-- include/crypto/chacha20.h | 8 ++++++++ 2 files changed, 10 insertions(+), 2 deletions(-) --- a/drivers/char/random.c +++ b/drivers/char/random.c @@ -816,7 +816,7 @@ static bool __init crng_init_try_arch_ea static void crng_initialize_secondary(struct crng_state *crng) { - memcpy(&crng->state[0], "expand 32-byte k", 16); + chacha_init_consts(crng->state); _get_random_bytes(&crng->state[4], sizeof(__u32) * 12); crng_init_try_arch(crng); crng->init_time = jiffies - CRNG_RESEED_INTERVAL - 1; @@ -824,7 +824,7 @@ static void crng_initialize_secondary(st static void __init crng_initialize_primary(struct crng_state *crng) { - memcpy(&crng->state[0], "expand 32-byte k", 16); + chacha_init_consts(crng->state); _extract_entropy(&input_pool, &crng->state[4], sizeof(__u32) * 12, 0); if (crng_init_try_arch_early(crng) && trust_cpu && crng_init < 2) { invalidate_batched_entropy(); --- a/include/crypto/chacha20.h +++ b/include/crypto/chacha20.h @@ -25,4 +25,12 @@ int crypto_chacha20_setkey(struct crypto unsigned int keysize); int crypto_chacha20_crypt(struct skcipher_request *req); +static inline void chacha_init_consts(u32 *state) +{ + state[0] = 0x61707865; /* "expa" */ + state[1] = 0x3320646e; /* "nd 3" */ + state[2] = 0x79622d32; /* "2-by" */ + state[3] = 0x6b206574; /* "te k" */ +} + #endif Patches currently in stable-queue which might be from ebiggers@xxxxxxxxxx are queue-4.14/random-do-not-take-pool-spinlock-at-boot.patch queue-4.14/random-introduce-drain_entropy-helper-to-declutter-crng_reseed.patch queue-4.14/random-fix-locking-in-crng_fast_load.patch queue-4.14/random-group-userspace-read-write-functions.patch queue-4.14/random-make-credit_entropy_bits-always-safe.patch queue-4.14/crypto-chacha20-fix-chacha20_block-keystream-alignment-again.patch queue-4.14/random-pull-add_hwgenerator_randomness-declaration-into-random.h.patch queue-4.14/random-unify-early-init-crng-load-accounting.patch queue-4.14/random-use-blake2s-instead-of-sha1-in-extraction.patch queue-4.14/random-initialize-chacha20-constants-with-correct-endianness.patch queue-4.14/random-group-entropy-extraction-functions.patch queue-4.14/random-rewrite-header-introductory-comment.patch queue-4.14/random-remove-ifdef-d-out-interrupt-bench.patch queue-4.14/random-tie-batched-entropy-generation-to-base_crng-generation.patch queue-4.14/random-use-linear-min-entropy-accumulation-crediting.patch queue-4.14/random-remove-batched-entropy-locking.patch queue-4.14/random-inline-leaves-of-rand_initialize.patch queue-4.14/random-remove-use_input_pool-parameter-from-crng_reseed.patch queue-4.14/random-zero-buffer-after-reading-entropy-from-userspace.patch queue-4.14/random-remove-whitespace-and-reorder-includes.patch queue-4.14/random-simplify-entropy-debiting.patch queue-4.14/random-document-crng_fast_key_erasure-destination-possibility.patch queue-4.14/random-absorb-fast-pool-into-input-pool-after-fast-load.patch queue-4.14/random-use-rdseed-instead-of-rdrand-in-entropy-extraction.patch queue-4.14/random-remove-dead-code-left-over-from-blocking-pool.patch queue-4.14/random-use-computational-hash-for-entropy-extraction.patch queue-4.14/random-always-wake-up-entropy-writers-after-extraction.patch queue-4.14/random-do-not-xor-rdrand-when-writing-into-dev-random.patch queue-4.14/random-group-initialization-wait-functions.patch queue-4.14/random-remove-unused-tracepoints.patch queue-4.14/crypto-chacha20-fix-keystream-alignment-for-chacha20_block.patch queue-4.14/random-check-for-crng_init-0-in-add_device_randomness.patch queue-4.14/crypto-blake2s-include-linux-bug.h-instead-of-asm-bug.h.patch queue-4.14/random-group-entropy-collection-functions.patch queue-4.14/random-remove-useless-header-comment.patch queue-4.14/random-remove-outdated-int_max-6-check-in-urandom_read.patch queue-4.14/random-do-not-pretend-to-handle-premature-next-security-model.patch queue-4.14/random-avoid-arch_get_random_seed_long-when-collecting-irq-randomness.patch queue-4.14/random-reseed-more-often-immediately-after-booting.patch queue-4.14/random-ensure-early-rdseed-goes-through-mixer-on-init.patch queue-4.14/crypto-blake2s-adjust-include-guard-naming.patch queue-4.14/random-use-hash-function-for-crng_slow_load.patch