From 65b3c2f6278516397bebcdbf4698bd3102120ca5 Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Wed, 25 Mar 2026 17:15:05 -0700 Subject: crypto: rng - Make crypto_stdrng_get_bytes() use normal RNG in non-FIPS mode "stdrng" is needed only in "FIPS mode". Therefore, make crypto_stdrng_get_bytes() delegate to either the normal Linux RNG or to "stdrng", depending on the current mode. This will eliminate the need to built the SP800-90A DRBG and its dependencies into CRYPTO_FIPS=n kernels. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu --- include/crypto/rng.h | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/crypto/rng.h b/include/crypto/rng.h index f61e037afed9..07f494b2c881 100644 --- a/include/crypto/rng.h +++ b/include/crypto/rng.h @@ -12,6 +12,8 @@ #include #include #include +#include +#include struct crypto_rng; @@ -57,18 +59,27 @@ struct crypto_rng { struct crypto_tfm base; }; +int __crypto_stdrng_get_bytes(void *buf, unsigned int len); + /** * crypto_stdrng_get_bytes() - get cryptographically secure random bytes * @buf: output buffer holding the random numbers * @len: length of the output buffer * * This function fills the caller-allocated buffer with random numbers using the - * highest-priority "stdrng" algorithm in the crypto_rng subsystem. + * normal Linux RNG if fips_enabled=0, or the highest-priority "stdrng" + * algorithm in the crypto_rng subsystem if fips_enabled=1. * * Context: May sleep * Return: 0 function was successful; < 0 if an error occurred */ -int crypto_stdrng_get_bytes(void *buf, unsigned int len); +static inline int crypto_stdrng_get_bytes(void *buf, unsigned int len) +{ + might_sleep(); + if (fips_enabled) + return __crypto_stdrng_get_bytes(buf, len); + return get_random_bytes_wait(buf, len); +} /** * DOC: Random number generator API -- cgit v1.3