random: initialize ChaCha20 constants with correct endianness

BugLink: https://bugs.launchpad.net/bugs/1928857
[ Upstream commit a181e0fdb2164268274453b5b291589edbb9b22d ]

On big endian CPUs, the ChaCha20-based CRNG is using the wrong
endianness for the ChaCha20 constants.

This doesn't matter cryptographically, but technically it means it's not
ChaCha20 anymore.  Fix it to always use the standard constants.

Cc: linux-crypto@vger.kernel.org
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Theodore Ts'o <tytso@mit.edu>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

diff --git a/drivers/char/random.c b/drivers/char/random.c
index 34320df90c0cd1992cc0ab3a16e795af0a8296ec..2e83deb5e19e5a32ef3cbadd793f24d95b7a76dd 100644 (file)
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -819,7 +819,7 @@ static bool __init crng_init_try_arch_early(struct crng_state *crng)
 
 static void __maybe_unused crng_initialize_secondary(struct crng_state *crng)
 {
-       memcpy(&crng->state[0], "expand 32-byte k", 16);
+       chacha_init_consts(crng->state);
        _get_random_bytes(&crng->state[4], sizeof(__u32) * 12);
        crng_init_try_arch(crng);
        crng->init_time = jiffies - CRNG_RESEED_INTERVAL - 1;
@@ -827,7 +827,7 @@ static void __maybe_unused crng_initialize_secondary(struct crng_state *crng)
 
 static void __init crng_initialize_primary(struct crng_state *crng)
 {
-       memcpy(&crng->state[0], "expand 32-byte k", 16);
+       chacha_init_consts(crng->state);
        _extract_entropy(&input_pool, &crng->state[4], sizeof(__u32) * 12, 0);
        if (crng_init_try_arch_early(crng) && trust_cpu) {
                invalidate_batched_entropy();

diff --git a/include/crypto/chacha.h b/include/crypto/chacha.h
index 3a1c72fdb7cf5b468c881a1c2149c0afcdf282e2..dabaee6987186b9890deb81c721cecbc171708a3 100644 (file)
--- a/include/crypto/chacha.h
+++ b/include/crypto/chacha.h
@@ -47,13 +47,18 @@ static inline void hchacha_block(const u32 *state, u32 *out, int nrounds)
                hchacha_block_generic(state, out, nrounds);
 }
 
-void chacha_init_arch(u32 *state, const u32 *key, const u8 *iv);
-static inline void chacha_init_generic(u32 *state, const u32 *key, const u8 *iv)
+static inline void chacha_init_consts(u32 *state)
 {
        state[0]  = 0x61707865; /* "expa" */
        state[1]  = 0x3320646e; /* "nd 3" */
        state[2]  = 0x79622d32; /* "2-by" */
        state[3]  = 0x6b206574; /* "te k" */
+}
+
+void chacha_init_arch(u32 *state, const u32 *key, const u8 *iv);
+static inline void chacha_init_generic(u32 *state, const u32 *key, const u8 *iv)
+{
+       chacha_init_consts(state);
        state[4]  = key[0];
        state[5]  = key[1];
        state[6]  = key[2];