kernel/linux.git/drivers/crypto/allwinner, branch v7.2-rc2

crypto: sun4i-ss - Remove insecure and unused rng_alg

2026-06-12T01:56:45+00:00

Remove sun4i_ss_rng, as it is insecure and unused: - It has multiple vulnerabilities. sun4i_ss_prng_seed() is missing locking and has a buffer overflow. sun4i_ss_prng_generate() fails to fill the entire buffer with cryptographic random bytes, because it rounds the destination length down and also doesn't actually wait for the hardware to be ready before pulling bytes from it. - No user of this code is known. It's usable only theoretically via the "rng" algorithm type of AF_ALG. But userspace actually just uses the actual Linux RNG (/dev/random etc) instead. And rng_algs don't contribute entropy to the actual Linux RNG either. (This may have been confused with hwrng, which does contribute entropy.) The sun4i_ss_prng_seed() buffer overflow was reported by Tianchu Chen and discovered by Atuin - Automated Vulnerability Discovery Engine There's no point in fixing all these vulnerabilities individually when this is unused code, so let's just remove it. Fixes: b8ae5c7387ad ("crypto: sun4i-ss - support the Security System PRNG") Cc: stable@vger.kernel.org Reported-by: Tianchu Chen Closes: https://lore.kernel.org/r/af749a8447bd7f0e9dd26ca6c87e9c6afecb09d9@linux.dev/ Acked-by: Corentin LABBE Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu

crypto: sun8i-ss - avoid hash and rng references

2026-05-07T08:10:02+00:00

While the sun4i-ss and sun8i-ce drivers started selecting CRYPTO_RNG, the sun8i-ss variant does not, and causes a link failure: aarch64-linux-ld: drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.o: in function `sun8i_ss_unregister_algs': sun8i-ss-core.c:(.text.sun8i_ss_unregister_algs+0x94): undefined reference to `crypto_unregister_rng' aarch64-linux-ld: drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.o: in function `sun8i_ss_probe': sun8i-ss-core.c:(.text.sun8i_ss_probe+0x40c): undefined reference to `crypto_register_rng' Looking more closely, I see that all of the allwinner crypto drivers have the same logic where the rng and hash parts of the driver are optional, but then the generic code is still selected, which is a bit inconsistent, aside from the missing CRYPTO_RNG select on sun8i-ss. Change the approach so only the bits that are actually used are built, using ifdef checks around the optional portions that match the optional references to the sub-drivers. Ideally the drivers would get reworked in a way that keeps all the bits related to the skcipher/ahash/rng codecs in the respective sub-drivers, rather than having a common driver that knows about all of these. Fixes: cdadc1435937 ("crypto: cryptomgr - Select algorithm types only when CRYPTO_SELFTESTS") Signed-off-by: Arnd Bergmann Signed-off-by: Herbert Xu

crypto: cryptomgr - Select algorithm types only when CRYPTO_SELFTESTS

2026-04-03T00:56:13+00:00

Enabling any template selects CRYPTO_MANAGER, which causes CRYPTO_MANAGER2 to enable itself, which selects every algorithm type option. However, pulling in all algorithm types is needed only when the self-tests are enabled. So condition the selections accordingly. To make this possible, also add the missing selections to various symbols that were relying on transitive selections via CRYPTO_MANAGER. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu

crypto: sun8i-ss - Avoid -Wflex-array-member-not-at-end warning

2025-12-19T06:47:47+00:00

-Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Move the conflicting declaration to the end of the corresponding structure. Notice that `struct ahash_request` is a flexible structure, this is a structure that contains a flexible-array member. With these changes fix the following warning: drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h:251:30: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Signed-off-by: Herbert Xu

crypto: sun8i-ss - Move j init earlier in sun8i_ss_hash_run

2025-10-23T04:55:43+00:00

With gcc-14 I get ../drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c: In function ‘sun8i_ss_hash_run’: ../drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c:631:21: warning: ‘j’ may be used uninitialized [-Wmaybe-uninitialized] 631 | j = hash_pad(bf, 4096, j, byte_count, true, bs); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ../drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c:493:13: note: ‘j’ was declared here 493 | int j, i, k, todo; | ^ Fix this false positive by moving the initialisation of j earlier. Signed-off-by: Herbert Xu

crytpo: sun8i-ce - factor out prepare/unprepare from sun8i_ce_hash_run()

2025-09-13T04:11:05+00:00

In order to make the ahash code more clear and modular, split the monolithic sun8i_ce_hash_run() callback into two parts, prepare and unprepare (therefore aligning it with the sun8i-ce skcipher code). Signed-off-by: Ovidiu Panait Signed-off-by: Herbert Xu

crypto: sun8i-ce - save hash buffers and dma info to request context

2025-09-13T04:11:05+00:00

Similar to sun8i-ce skcipher code, move all request-specific data to request context. This simplifies sun8i_ce_hash_run() and it eliminates the remaining kmalloc() calls from the digest path. Since the 'result' buffer in the request ctx struct is used for from-device DMA, it needs to be properly aligned to CRYPTO_DMA_ALIGN. Therefore: - increase reqsize by CRYPTO_DMA_PADDING - add __aligned(CRYPTO_DMA_ALIGN) attribute for the 'result' buffer - convert all ahash_request_ctx_dma() calls to ahash_request_ctx_dma() Signed-off-by: Ovidiu Panait Signed-off-by: Herbert Xu

crypto: sun8i-ce - pass task descriptor to cipher prepare/unprepare

2025-09-13T04:11:05+00:00

To remove some duplicated code, directly pass 'struct skcipher_request' and 'struct ce_task' pointers to sun8i_ce_cipher_{prepare,unprepare}. Signed-off-by: Ovidiu Panait Signed-off-by: Herbert Xu

crypto: sun8i-ce - fold sun8i_ce_cipher_run() into sun8i_ce_cipher_do_one()

2025-09-13T04:11:05+00:00

Fold sun8i_ce_cipher_run() into it's only caller, sun8i_ce_cipher_do_one(), to eliminate a bit of boilerplate. Signed-off-by: Ovidiu Panait Signed-off-by: Herbert Xu

crypto: sun8i-ce - move bounce_iv and backup_iv to request context

2025-09-13T04:11:05+00:00

Currently, the iv buffers are allocated per flow during driver probe, which means that the buffers are shared by all requests. This works because the driver is not yet truly asynchronous, since it waits inside do_one_request() for the completion irq. However, the iv data is request-specific, so it should be part of the request context. Move iv buffers to request context. The bounce_iv buffer is aligned to sizeof(u32) to match the 'word address' requirement for the task descriptor's iv field. Signed-off-by: Ovidiu Panait Signed-off-by: Herbert Xu