Re: [PATCH v2] crypto: stdrng - Mitigate FIPS RNG failures

[Herbert Xu <herbert@gondor.apana.org.au>]

On Fri, Nov 06, 2026 at 07:37:11PM +0000, Eric Biggers wrote:
> If the kernel is booted with fips=1 and jitterentropy fails its health
> check, crypto_stdrng_get_bytes() can return an error and leave its
> output buffer uninitialized.
> 
> While the fallibility of the FIPS RNG is by design, leaving the output
> buffer uninitialized lacks practical defense-in-depth, as callers can
> forget to check the error code.  For example, the TPM2 driver didn't
> check the error code from ECDH private key generation
> (https://lore.kernel.org/r/20261025211119.138277-1-ebiggers@kernel.org/).
> Thus, fips=1 mode (ironically) caused a vulnerability.
> 
> Mitigate such bugs by filling the buffer with get_random_bytes_wait() in
> case of failure.  This helps in practice.  (For FIPS certifiability it
> makes no difference, as no "approved" entropy is claimed on failure.)
> 
> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
> Signed-off-by: Eric Biggers <ebiggers@kernel.org>
> ---
> 
> v2: Resending this because Sashiko failed to apply it earlier, despite
>     my use of prerequisite-patch-id.  Its prerequisites are merged now,
>     so Sashiko should review it now.  I also added Jarkko's Reviewed-by.
>     This applies to cryptodev/master 82e91fe19fb8
> 
>  crypto/drbg.c | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt