random: initialize ChaCha20 constants with correct endianness

commit a181e0fdb2164268274453b5b291589edbb9b22d upstream.

On big endian CPUs, the ChaCha20-based CRNG is using the wrong
endianness for the ChaCha20 constants.

This doesn't matter cryptographically, but technically it means it's not
ChaCha20 anymore.  Fix it to always use the standard constants.

Cc: linux-crypto@vger.kernel.org
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Theodore Ts'o <tytso@mit.edu>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/char/random.c b/drivers/char/random.c
index c2b53320466c049367de5c9643b07dff671d2c83..f947c39572f29e933c995dbb73bb691e7252a659 100644 (file)
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -816,7 +816,7 @@ static bool __init crng_init_try_arch_early(struct crng_state *crng)
 
 static void crng_initialize_secondary(struct crng_state *crng)
 {
-       memcpy(&crng->state[0], "expand 32-byte k", 16);
+       chacha_init_consts(crng->state);
        _get_random_bytes(&crng->state[4], sizeof(__u32) * 12);
        crng_init_try_arch(crng);
        crng->init_time = jiffies - CRNG_RESEED_INTERVAL - 1;
@@ -824,7 +824,7 @@ static void crng_initialize_secondary(struct crng_state *crng)
 
 static void __init crng_initialize_primary(struct crng_state *crng)
 {
-       memcpy(&crng->state[0], "expand 32-byte k", 16);
+       chacha_init_consts(crng->state);
        _extract_entropy(&input_pool, &crng->state[4], sizeof(__u32) * 12, 0);
        if (crng_init_try_arch_early(crng) && trust_cpu && crng_init < 2) {
                invalidate_batched_entropy();

diff --git a/include/crypto/chacha20.h b/include/crypto/chacha20.h
index b83d66073db0390d59d98f1ac12d9adbddc1afc3..0d8cc82df48b6a90a00ecf3c5ec89eb270709497 100644 (file)
--- a/include/crypto/chacha20.h
+++ b/include/crypto/chacha20.h
@@ -25,4 +25,12 @@ int crypto_chacha20_setkey(struct crypto_skcipher *tfm, const u8 *key,
                           unsigned int keysize);
 int crypto_chacha20_crypt(struct skcipher_request *req);
 
+static inline void chacha_init_consts(u32 *state)
+{
+       state[0]  = 0x61707865; /* "expa" */
+       state[1]  = 0x3320646e; /* "nd 3" */
+       state[2]  = 0x79622d32; /* "2-by" */
+       state[3]  = 0x6b206574; /* "te k" */
+}
+
 #endif