From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, Eric Biggers <ebiggers@kernel.org>,
Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>,
Herbert Xu <herbert@gondor.apana.org.au>
Subject: [PATCH 7.1 58/76] crypto: qcom-rng - Remove crypto_rng interface
Date: Mon, 31 Aug 2026 15:34:30 +0200 [thread overview]
Message-ID: <20260831133402.450619795@linuxfoundation.org> (raw)
In-Reply-To: <20260831133359.185608553@linuxfoundation.org>
7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit 2ecdf5c9910e20f73639bc322f0518a3439d17c0 upstream.
qcom-rng.c exposes the same hardware through two completely separate
interfaces, crypto_rng and hwrng. However, the implementation of this
is buggy because it permits generation operations from these interfaces
to run concurrently with each other, accessing the same registers. That
is, qcom_rng_generate() synchronizes with itself but not with
qcom_hwrng_read(). This results in potential repetition of output from
the RNG, output of non-random values, etc.
Fortunately, there's actually no point in hardware RNG drivers
implementing the crypto_rng interface. It's not actually used by
anything besides the "rng" algorithm type of AF_ALG, which in turn is
not actually used in practice. Other crypto_rng hardware drivers are
likewise being phased out, leaving just the hwrng support.
Thus, remove it to simplify the code and avoid conflict (and confusion)
with the hwrng interface which is the one that actually matters.
Fixes: f29cd5bb64c2 ("crypto: qcom-rng - Add hw_random interface support")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/Kconfig | 1
drivers/crypto/qcom-rng.c | 158 +++++-----------------------------------------
2 files changed, 19 insertions(+), 140 deletions(-)
--- a/drivers/crypto/Kconfig
+++ b/drivers/crypto/Kconfig
@@ -659,7 +659,6 @@ config CRYPTO_DEV_QCOM_RNG
tristate "Qualcomm Random Number Generator Driver"
depends on ARCH_QCOM || COMPILE_TEST
depends on HW_RANDOM
- select CRYPTO_RNG
help
This driver provides support for the Random Number
Generator hardware found on Qualcomm SoCs.
--- a/drivers/crypto/qcom-rng.c
+++ b/drivers/crypto/qcom-rng.c
@@ -3,10 +3,8 @@
//
// Based on msm-rng.c and downstream driver
-#include <crypto/internal/rng.h>
#include <linux/acpi.h>
#include <linux/clk.h>
-#include <linux/crypto.h>
#include <linux/hw_random.h>
#include <linux/io.h>
#include <linux/iopoll.h>
@@ -32,24 +30,15 @@
#define QCOM_TRNG_QUALITY 1024
struct qcom_rng {
- struct mutex lock;
void __iomem *base;
struct clk *clk;
struct hwrng hwrng;
- struct qcom_rng_match_data *match_data;
-};
-
-struct qcom_rng_ctx {
- struct qcom_rng *rng;
};
struct qcom_rng_match_data {
- bool skip_init;
bool hwrng_support;
};
-static struct qcom_rng *qcom_rng_dev;
-
static int qcom_rng_read(struct qcom_rng *rng, u8 *data, unsigned int max)
{
unsigned int currsize = 0;
@@ -82,37 +71,6 @@ static int qcom_rng_read(struct qcom_rng
return currsize;
}
-static int qcom_rng_generate(struct crypto_rng *tfm,
- const u8 *src, unsigned int slen,
- u8 *dstn, unsigned int dlen)
-{
- struct qcom_rng_ctx *ctx = crypto_rng_ctx(tfm);
- struct qcom_rng *rng = ctx->rng;
- int ret;
-
- ret = clk_prepare_enable(rng->clk);
- if (ret)
- return ret;
-
- mutex_lock(&rng->lock);
-
- ret = qcom_rng_read(rng, dstn, dlen);
-
- mutex_unlock(&rng->lock);
- clk_disable_unprepare(rng->clk);
-
- if (ret >= 0)
- ret = 0;
-
- return ret;
-}
-
-static int qcom_rng_seed(struct crypto_rng *tfm, const u8 *seed,
- unsigned int slen)
-{
- return 0;
-}
-
static int qcom_hwrng_init(struct hwrng *hwrng)
{
struct qcom_rng *qrng = container_of(hwrng, struct qcom_rng, hwrng);
@@ -134,74 +92,26 @@ static void qcom_hwrng_cleanup(struct hw
clk_disable_unprepare(qrng->clk);
}
-static int qcom_rng_enable(struct qcom_rng *rng)
-{
- u32 val;
- int ret;
-
- ret = clk_prepare_enable(rng->clk);
- if (ret)
- return ret;
-
- /* Enable PRNG only if it is not already enabled */
- val = readl_relaxed(rng->base + PRNG_CONFIG);
- if (val & PRNG_CONFIG_HW_ENABLE)
- goto already_enabled;
-
- val = readl_relaxed(rng->base + PRNG_LFSR_CFG);
- val &= ~PRNG_LFSR_CFG_MASK;
- val |= PRNG_LFSR_CFG_CLOCKS;
- writel(val, rng->base + PRNG_LFSR_CFG);
-
- val = readl_relaxed(rng->base + PRNG_CONFIG);
- val |= PRNG_CONFIG_HW_ENABLE;
- writel(val, rng->base + PRNG_CONFIG);
-
-already_enabled:
- clk_disable_unprepare(rng->clk);
-
- return 0;
-}
-
-static int qcom_rng_init(struct crypto_tfm *tfm)
-{
- struct qcom_rng_ctx *ctx = crypto_tfm_ctx(tfm);
-
- ctx->rng = qcom_rng_dev;
-
- if (!ctx->rng->match_data->skip_init)
- return qcom_rng_enable(ctx->rng);
-
- return 0;
-}
-
-static struct rng_alg qcom_rng_alg = {
- .generate = qcom_rng_generate,
- .seed = qcom_rng_seed,
- .seedsize = 0,
- .base = {
- .cra_name = "stdrng",
- .cra_driver_name = "qcom-rng",
- .cra_flags = CRYPTO_ALG_TYPE_RNG,
- .cra_priority = 300,
- .cra_ctxsize = sizeof(struct qcom_rng_ctx),
- .cra_module = THIS_MODULE,
- .cra_init = qcom_rng_init,
- }
-};
-
static int qcom_rng_probe(struct platform_device *pdev)
{
+ const struct qcom_rng_match_data *match_data;
struct qcom_rng *rng;
int ret;
+ match_data = device_get_match_data(&pdev->dev);
+ if (match_data == NULL || !match_data->hwrng_support) {
+ dev_info(&pdev->dev, "TRNG support not detected\n");
+ /*
+ * In this case the driver does nothing except the dev_info(),
+ * but bind the device anyway to avoid effects on GCC state.
+ */
+ return 0;
+ }
+
rng = devm_kzalloc(&pdev->dev, sizeof(*rng), GFP_KERNEL);
if (!rng)
return -ENOMEM;
- platform_set_drvdata(pdev, rng);
- mutex_init(&rng->lock);
-
rng->base = devm_platform_ioremap_resource(pdev, 0);
if (IS_ERR(rng->base))
return PTR_ERR(rng->base);
@@ -210,55 +120,26 @@ static int qcom_rng_probe(struct platfor
if (IS_ERR(rng->clk))
return PTR_ERR(rng->clk);
- rng->match_data = (struct qcom_rng_match_data *)device_get_match_data(&pdev->dev);
-
- qcom_rng_dev = rng;
- ret = crypto_register_rng(&qcom_rng_alg);
- if (ret) {
- dev_err(&pdev->dev, "Register crypto rng failed: %d\n", ret);
- qcom_rng_dev = NULL;
- return ret;
- }
-
- if (rng->match_data->hwrng_support) {
- rng->hwrng.name = "qcom_hwrng";
- rng->hwrng.init = qcom_hwrng_init;
- rng->hwrng.read = qcom_hwrng_read;
- rng->hwrng.cleanup = qcom_hwrng_cleanup;
- rng->hwrng.quality = QCOM_TRNG_QUALITY;
- ret = devm_hwrng_register(&pdev->dev, &rng->hwrng);
- if (ret) {
- dev_err(&pdev->dev, "Register hwrng failed: %d\n", ret);
- qcom_rng_dev = NULL;
- goto fail;
- }
- }
-
- return ret;
-fail:
- crypto_unregister_rng(&qcom_rng_alg);
+ rng->hwrng.name = "qcom_hwrng";
+ rng->hwrng.init = qcom_hwrng_init;
+ rng->hwrng.read = qcom_hwrng_read;
+ rng->hwrng.cleanup = qcom_hwrng_cleanup;
+ rng->hwrng.quality = QCOM_TRNG_QUALITY;
+ ret = devm_hwrng_register(&pdev->dev, &rng->hwrng);
+ if (ret)
+ dev_err(&pdev->dev, "Register hwrng failed: %d\n", ret);
return ret;
}
-static void qcom_rng_remove(struct platform_device *pdev)
-{
- crypto_unregister_rng(&qcom_rng_alg);
-
- qcom_rng_dev = NULL;
-}
-
static struct qcom_rng_match_data qcom_prng_match_data = {
- .skip_init = false,
.hwrng_support = false,
};
static struct qcom_rng_match_data qcom_prng_ee_match_data = {
- .skip_init = true,
.hwrng_support = false,
};
static struct qcom_rng_match_data qcom_trng_match_data = {
- .skip_init = true,
.hwrng_support = true,
};
@@ -278,7 +159,6 @@ MODULE_DEVICE_TABLE(of, qcom_rng_of_matc
static struct platform_driver qcom_rng_driver = {
.probe = qcom_rng_probe,
- .remove = qcom_rng_remove,
.driver = {
.name = KBUILD_MODNAME,
.of_match_table = of_match_ptr(qcom_rng_of_match),
next prev parent reply other threads:[~2026-08-31 13:43 UTC|newest]
Thread overview: 85+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-31 13:33 [PATCH 7.1 00/76] 7.1.13-rc1 review Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 01/76] bpf: reject overlarge global subprog argument sizes Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 02/76] RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 03/76] RDMA/rxe: Fix OOB in free_rd_atomic_resources() Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 04/76] KVM: x86/mmu: Check write tracking in all address spaces Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 05/76] nvme-tcp: fix usage of page_frag_cache Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 06/76] Revert "selinux: reject a permission value exceeding the class permission count" Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 07/76] selinux: use u16 for security classes Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 08/76] selinux: more strict policy parsing Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 09/76] selinux: reject a permission value exceeding the class permission count Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 10/76] selinux: require a classs permission values to cover its " Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 11/76] selinux: switch two allocations to use kzalloc_objs() Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 12/76] ext4: export converted block count from ext4_convert_unwritten_extents() Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 13/76] ext4: protect WRITE_ZEROES written extents with orphan list Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 14/76] ext4: move partial block zeroing earlier in ext4_zero_range() Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 15/76] ext4: write back partial-zeroed edges in WRITE_ZEROES Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 16/76] ext4: track partial-zero outcome per edge in ext4_zero_partial_blocks() Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 17/76] ext4: zero out whole block for clean edges in WRITE_ZEROES Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 18/76] fpga: dfl: fme: add error handling Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 19/76] accessibility: speakup: unregister tty ldisc on later init failures Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 20/76] usb: xhci: Handle bogus TRB pointers in Missed Service Error events Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 21/76] usb: xhci: Handle USB3 port events when there is one roothub Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 22/76] usb: xhci: bail out of setup if the controller is inaccessible Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 23/76] xhci: dbgtty: Fix unregister on tty_register_driver() failure Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 24/76] xhci: dbgtty: Fix unregister on tty_alloc_driver() failure Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 25/76] fuse: fix invalidate lock leak on setattr writeback failure Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 26/76] fuse: fix invalidate lock leak on open O_TRUNC DAX failure Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 27/76] usb: usbtest: disable dynamic ID support Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 28/76] usb: gadget: f_tcm: keep port count until LUN teardown completes Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 29/76] KVM: SEV: Drop FOLL_WRITE for encrypted region registration Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 30/76] KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 31/76] KVM: SEV: Extract loading of guest-provided VMSA to a separate helper Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 32/76] KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 33/76] KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 34/76] tls: device: fix out-of-bounds write in tls_append_frag() Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 35/76] gtp: serialize PDP context updates Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 36/76] net/tcp: fix TCP-AO key deletion in VRFs Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 37/76] tcp: fix AO info use-after-free in tcp_ao_connect_init() Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 38/76] net/tcp-ao: fix use-after-free of current_key on reconnect to another peer Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 39/76] net: advertise TCP MSS from the configured MTU, not the learned PMTU Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 40/76] xfrm: espintcp: fix UAF during close Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 41/76] tcp: clamp route advmss to TCP_MIN_MSS Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 42/76] xfrm: drop ESP-in-TCP packets with no ingress device Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 43/76] xfrm: avoid lock inversion in nat keepalive work Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 44/76] xfrm: ah6: validate routing header segments_left Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 45/76] xfrm: fix xfrm_state_construct() auth-trunc leak Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 46/76] xfrm: bound nat keepalive state collection Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 47/76] net: bridge: mcast: fix use-after-free of a master VLANs multicast context Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 48/76] net/packet: defer vmalloc TX_RING free until skbs finish Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 49/76] ipv6: seg6: clear IPv4 control block on IPIP decapsulation Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 50/76] batman-adv: reject unrepresentable multicast TVLV offsets Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 51/76] vxlan: keep the last remote linked during FDB flush Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 52/76] netfilter: nft_set_pipapo_avx2: add missing vzeroupper Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 53/76] netfilter: nf_tables: dont queue packet path object notifications Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 54/76] mm/swap: reject swapon() on filesystem-level encrypted files Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 55/76] kunit: irq: Continue increasing hrtimer interval for longer Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 56/76] crypto: virtio - bound the akcipher result length Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 57/76] crypto: qcom-rng - Enable clock in hwrng case Greg Kroah-Hartman
2026-08-31 13:34 ` Greg Kroah-Hartman [this message]
2026-08-31 13:34 ` [PATCH 7.1 59/76] crypto: qcom-rng - Allow zero as a random number Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 60/76] crypto: atmel-tdes - use scatterlist length before DMA mapping Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 61/76] crypto: krb5 - use kfree_sensitive() for derived key buffers Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 62/76] crypto: qce - fix CCM AAD buffer underallocation Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 63/76] crypto: iaa - fall back to software for multi-entry scatterlists Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 64/76] crypto: mxs-dcp - fix source scatterlist length access Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 65/76] crypto: qce - Remove unsafe/deprecated algorithms Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 66/76] KVM: s390: vsie: zero stale crypto bits Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 67/76] usb: core: Add lock to usb_wakeup_notification() Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 68/76] usb: core: Strengthen error handling in hub_hub_status() Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 69/76] ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USB Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 70/76] ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 71/76] ALSA: usb-audio: Complete cleanup after system-resume errors Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 72/76] USB: serial: option: fix slab OOB read in interrupt URB callback Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 73/76] USB: serial: spcp8x5: drop broken carrier detect support Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 74/76] USB: c67x00: fix use-after-free in c67x00_add_iso_urb() Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 75/76] wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 76/76] usb: usbfs: fix use-after-free of usb_device in usbdev_release() Greg Kroah-Hartman
2026-08-31 19:12 ` [PATCH 7.1 00/76] 7.1.13-rc1 review Brett A C Sheffield
2026-09-01 0:45 ` Florian Fainelli
2026-09-01 7:44 ` Barry K. Nathan
2026-09-01 8:42 ` Pavel Machek
2026-09-01 12:06 ` Peter Schneider
2026-09-01 16:44 ` Shuah Khan
2026-09-01 22:59 ` Ron Economos
2026-09-02 1:55 ` Justin Forbes
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260831133402.450619795@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=dmitry.baryshkov@oss.qualcomm.com \
--cc=ebiggers@kernel.org \
--cc=herbert@gondor.apana.org.au \
--cc=patches@lists.linux.dev \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox