@@ -904,7 +904,7 @@ static void extract_buf(struct entropy_store *r, __u8 *out)
|
904 | 904 | int i; |
905 | 905 | union { |
906 | 906 | __u32 w[5]; |
907 | | -unsigned long l[LONGS(EXTRACT_SIZE)]; |
| 907 | +unsigned long l[LONGS(20)]; |
908 | 908 | } hash; |
909 | 909 | __u32 workspace[SHA_WORKSPACE_WORDS]; |
910 | 910 | __u8 extract[64]; |
@@ -916,6 +916,17 @@ static void extract_buf(struct entropy_store *r, __u8 *out)
|
916 | 916 | for (i = 0; i < r->poolinfo->poolwords; i += 16) |
917 | 917 | sha_transform(hash.w, (__u8 *)(r->pool + i), workspace); |
918 | 918 | |
| 919 | +/* |
| 920 | + * If we have a architectural hardware random number |
| 921 | + * generator, mix that in, too. |
| 922 | + */ |
| 923 | +for (i = 0; i < LONGS(20); i++) { |
| 924 | +unsigned long v; |
| 925 | +if (!arch_get_random_long(&v)) |
| 926 | +break; |
| 927 | +hash.l[i] ^= v; |
| 928 | + } |
| 929 | + |
919 | 930 | /* |
920 | 931 | * We mix the hash back into the pool to prevent backtracking |
921 | 932 | * attacks (where the attacker knows the state of the pool |
@@ -945,17 +956,6 @@ static void extract_buf(struct entropy_store *r, __u8 *out)
|
945 | 956 | hash.w[1] ^= hash.w[4]; |
946 | 957 | hash.w[2] ^= rol32(hash.w[2], 16); |
947 | 958 | |
948 | | -/* |
949 | | - * If we have a architectural hardware random number |
950 | | - * generator, mix that in, too. |
951 | | - */ |
952 | | -for (i = 0; i < LONGS(EXTRACT_SIZE); i++) { |
953 | | -unsigned long v; |
954 | | -if (!arch_get_random_long(&v)) |
955 | | -break; |
956 | | -hash.l[i] ^= v; |
957 | | - } |
958 | | - |
959 | 959 | memcpy(out, &hash, EXTRACT_SIZE); |
960 | 960 | memset(&hash, 0, sizeof(hash)); |
961 | 961 | } |
|