[PATCH v2] crypto: stdrng - Mitigate FIPS RNG failures

[PATCH v2] crypto: stdrng - Mitigate FIPS RNG failures

[Eric Biggers]

If the kernel is booted with fips=1 and jitterentropy fails its health
check, crypto_stdrng_get_bytes() can return an error and leave its
output buffer uninitialized.

While the fallibility of the FIPS RNG is by design, leaving the output
buffer uninitialized lacks practical defense-in-depth, as callers can
forget to check the error code.  For example, the TPM2 driver didn't
check the error code from ECDH private key generation
(https://lore.kernel.org/r/20261025211119.138277-1-ebiggers@kernel.org/).
Thus, fips=1 mode (ironically) caused a vulnerability.

Mitigate such bugs by filling the buffer with get_random_bytes_wait() in
case of failure.  This helps in practice.  (For FIPS certifiability it
makes no difference, as no "approved" entropy is claimed on failure.)

Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---

v2: Resending this because Sashiko failed to apply it earlier, despite
    my use of prerequisite-patch-id.  Its prerequisites are merged now,
    so Sashiko should review it now.  I also added Jarkko's Reviewed-by.
    This applies to cryptodev/master 82e91fe19fb8

 crypto/drbg.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/crypto/drbg.c b/crypto/drbg.c
index faa39045bdc6b..f3fed6ded5b5f 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -561,10 +561,20 @@ int __crypto_stdrng_get_bytes(void *buf, size_t len)
 
 	err = crypto_get_default_rng();
 	if (err)
-		return err;
+		goto out;
 
 	err = crypto_drbg_get_bytes(crypto_default_rng, buf, len, NULL, 0);
 	crypto_put_default_rng();
+
+out:
+	/*
+	 * On failure, fill the buffer using the normal Linux RNG rather than
+	 * leave it uninitialized.  This provides practical defense-in-depth for
+	 * callers that forget to check the error code.  (It makes no difference
+	 * for FIPS certifications; no entropy is claimed on failure anyway.)
+	 */
+	if (err)
+		get_random_bytes_wait(buf, len);
 	return err;
 }
 EXPORT_SYMBOL_GPL(__crypto_stdrng_get_bytes);

base-commit: 82e91fe19fb838f235f7c8829afc1eb389c93bdf
-- 
2.56.0.455.g6c5a503b38-goog