Previously, the ChaCha constants for the primary pool were only
initialized in crng_initialize_primary(), called by rand_initialize().
However, some randomness is actually extracted from the primary pool
beforehand, e.g. by kmem_cache_create(). Therefore, statically
initialize the ChaCha constants for the primary pool.

Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: <linux-crypto@vger.kernel.org>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
---
 drivers/char/random.c   |  5 ++++-
 include/crypto/chacha.h | 15 +++++++++++----
 2 files changed, 15 insertions(+), 5 deletions(-)
 
v1->v2: do not simplify crng_initialize_primary() calling convention, add CCs
v1 at https://lore.kernel.org/lkml/20211229211009.108091-6-linux@dominikbrodowski.net/

diff --git a/drivers/char/random.c b/drivers/char/random.c
index 9b5eb6cf82ce..acb908715b62 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -457,6 +457,10 @@ struct crng_state {
 
 static struct crng_state primary_crng = {
 	.lock = __SPIN_LOCK_UNLOCKED(primary_crng.lock),
+	.state[0] = CHACHA_CONSTANT_EXPA,
+	.state[1] = CHACHA_CONSTANT_ND_3,
+	.state[2] = CHACHA_CONSTANT_2_BY,
+	.state[3] = CHACHA_CONSTANT_TE_K,
 };
 
 /*
@@ -825,7 +829,6 @@ static void __maybe_unused crng_initialize_secondary(struct crng_state *crng)
 
 static void __init crng_initialize_primary(struct crng_state *crng)
 {
-	chacha_init_consts(crng->state);
 	_extract_entropy(&input_pool, &crng->state[4], sizeof(__u32) * 12, 0);
 	if (crng_init_try_arch_early(crng) && trust_cpu && crng_init < 2) {
 		invalidate_batched_entropy();
diff --git a/include/crypto/chacha.h b/include/crypto/chacha.h
index dabaee698718..b3ea73b81944 100644
--- a/include/crypto/chacha.h
+++ b/include/crypto/chacha.h
@@ -47,12 +47,19 @@ static inline void hchacha_block(const u32 *state, u32 *out, int nrounds)
 		hchacha_block_generic(state, out, nrounds);
 }
 
+enum chacha_constants { /* expand 32-byte k */
+	CHACHA_CONSTANT_EXPA = 0x61707865U,
+	CHACHA_CONSTANT_ND_3 = 0x3320646eU,
+	CHACHA_CONSTANT_2_BY = 0x79622d32U,
+	CHACHA_CONSTANT_TE_K = 0x6b206574U
+};
+
 static inline void chacha_init_consts(u32 *state)
 {
-	state[0]  = 0x61707865; /* "expa" */
-	state[1]  = 0x3320646e; /* "nd 3" */
-	state[2]  = 0x79622d32; /* "2-by" */
-	state[3]  = 0x6b206574; /* "te k" */
+	state[0]  = CHACHA_CONSTANT_EXPA;
+	state[1]  = CHACHA_CONSTANT_ND_3;
+	state[2]  = CHACHA_CONSTANT_2_BY;
+	state[3]  = CHACHA_CONSTANT_TE_K;
 }
 
 void chacha_init_arch(u32 *state, const u32 *key, const u8 *iv);
-- 
2.34.1

Thanks, looks good. I tried briefly to break it with the following
assertion thing, but didn't come up with any hits, so it looks like
we're all set. Prior to applying this patch, I found the easiest way
of triggering the below crash was by enabling
CONFIG_SLAB_FREELIST_RANDOM.

diff --git a/drivers/char/random.c b/drivers/char/random.c
index 4de0feb69781..0d9ac045943f 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1035,6 +1035,10 @@ static void _extract_crng(struct crng_state *crng,
  spin_lock_irqsave(&crng->lock, flags);
  if (arch_get_random_long(&v))
  crng->state[14] ^= v;
+ BUG_ON(crng->state[0] != CHACHA_CONSTANT_EXPA);
+ BUG_ON(crng->state[1] != CHACHA_CONSTANT_ND_3);
+ BUG_ON(crng->state[2] != CHACHA_CONSTANT_2_BY);
+ BUG_ON(crng->state[3] != CHACHA_CONSTANT_TE_K);
  chacha20_block(&crng->state[0], out);
  if (crng->state[12] == 0)
  crng->state[13]++;