p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
linux_old1/arch/x86/crypto
History
Eric Biggers 678cce4019 crypto: x86/poly1305 - fix overflow during partial reduction 
The x86_64 implementation of Poly1305 produces the wrong result on some
inputs because poly1305_4block_avx2() incorrectly assumes that when
partially reducing the accumulator, the bits carried from limb 'd4' to
limb 'h0' fit in a 32-bit integer.  This is true for poly1305-generic
which processes only one block at a time.  However, it's not true for
the AVX2 implementation, which processes 4 blocks at a time and
therefore can produce intermediate limbs about 4x larger.

Fix it by making the relevant calculations use 64-bit arithmetic rather
than 32-bit.  Note that most of the carries already used 64-bit
arithmetic, but the d4 -> h0 carry was different for some reason.

To be safe I also made the same change to the corresponding SSE2 code,
though that only operates on 1 or 2 blocks at a time.  I don't think
it's really needed for poly1305_block_sse2(), but it doesn't hurt
because it's already x86_64 code.  It *might* be needed for
poly1305_2block_sse2(), but overflows aren't easy to reproduce there.

This bug was originally detected by my patches that improve testmgr to
fuzz algorithms against their generic implementation.  But also add a
test vector which reproduces it directly (in the AVX2 case).

Fixes: b1ccc8f4b6 ("crypto: poly1305 - Add a four block AVX2 variant for x86_64")
Fixes: c70f4abef0 ("crypto: poly1305 - Add a SSE2 SIMD variant for x86_64")
Cc: <stable@vger.kernel.org> # v4.3+
Cc: Martin Willi <martin@strongswan.org>
Cc: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Martin Willi <martin@strongswan.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
 		2019-04-08 14:43:06 +08:00
..
Makefile crypto: x86/chacha20 - refactor to allow varying number of rounds 2018-12-13 18:24:58 +08:00
aegis128-aesni-asm.S Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-08-13 13:35:26 -07:00
aegis128-aesni-glue.c crypto: x86/aegis - fix handling chunked inputs and MAY_SLEEP 2019-02-08 15:30:08 +08:00
aegis128l-aesni-asm.S Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-08-13 13:35:26 -07:00
aegis128l-aesni-glue.c crypto: x86/aegis - fix handling chunked inputs and MAY_SLEEP 2019-02-08 15:30:08 +08:00
aegis256-aesni-asm.S Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-08-13 13:35:26 -07:00
aegis256-aesni-glue.c crypto: x86/aegis - fix handling chunked inputs and MAY_SLEEP 2019-02-08 15:30:08 +08:00
aes-i586-asm_32.S crypto: x86/aes - assembler clean-ups: use ENTRY/ENDPROC, localize jump targets 2013-01-20 10:16:47 +11:00
aes-x86_64-asm_64.S crypto: x86/aes - Don't use %rbp as temporary register 2017-05-23 12:52:05 +08:00
aes_ctrby8_avx-x86_64.S crypto, x86: aesni - fix token pasting for clang 2017-03-24 22:02:55 +08:00
aes_glue.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
aesni-intel_asm.S Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2018-08-29 13:38:39 -07:00
aesni-intel_avx-x86_64.S crypto: aesni - Add scatter/gather avx stubs, and use them in C 2018-12-23 11:52:43 +08:00
aesni-intel_glue.c crypto: x86/aesni-gcm - fix crash on empty plaintext 2019-02-08 15:30:08 +08:00
blowfish-x86_64-asm_64.S crypto: x86/blowfish - Fix RBP usage 2017-09-20 17:42:31 +08:00
blowfish_glue.c crypto: x86/blowfish: convert to skcipher interface 2018-03-03 00:03:29 +08:00
camellia-aesni-avx-asm_64.S x86/retpoline/crypto: Convert crypto assembler indirect jumps 2018-01-12 00:14:29 +01:00
camellia-aesni-avx2-asm_64.S x86/retpoline/crypto: Convert crypto assembler indirect jumps 2018-01-12 00:14:29 +01:00
camellia-x86_64-asm_64.S crypto: x86/camellia - Fix RBP usage 2017-09-20 17:42:31 +08:00
camellia_aesni_avx2_glue.c crypto: x86/camellia-aesni-avx, avx2 - convert to skcipher interface 2018-03-03 00:03:32 +08:00
camellia_aesni_avx_glue.c crypto: x86/camellia-aesni-avx, avx2 - convert to skcipher interface 2018-03-03 00:03:32 +08:00
camellia_glue.c crypto: x86/camellia - convert to skcipher interface 2018-03-03 00:03:32 +08:00
cast5-avx-x86_64-asm_64.S crypto: x86/cast5 - Fix RBP usage 2017-09-20 17:42:32 +08:00
cast5_avx_glue.c x86: Fix various typos in comments 2018-12-03 10:49:13 +01:00
cast6-avx-x86_64-asm_64.S crypto: x86/cast6 - Fix RBP usage 2017-09-20 17:42:33 +08:00
cast6_avx_glue.c x86: Fix various typos in comments 2018-12-03 10:49:13 +01:00
chacha-avx2-x86_64.S crypto: x86/chacha20 - refactor to allow varying number of rounds 2018-12-13 18:24:58 +08:00
chacha-avx512vl-x86_64.S crypto: x86/chacha20 - refactor to allow varying number of rounds 2018-12-13 18:24:58 +08:00
chacha-ssse3-x86_64.S crypto: x86/chacha20 - refactor to allow varying number of rounds 2018-12-13 18:24:58 +08:00
chacha_glue.c crypto: x86/chacha - avoid sleeping under kernel_fpu_begin() 2018-12-23 11:52:44 +08:00
crc32-pclmul_asm.S crypto: crc32-pclmul - remove useless relative addressing 2017-10-07 12:10:30 +08:00
crc32-pclmul_glue.c crypto: hash - annotate algorithms taking optional key 2018-01-12 23:03:35 +11:00
crc32c-intel_glue.c crypto: hash - annotate algorithms taking optional key 2018-01-12 23:03:35 +11:00
crc32c-pcl-intel-asm_64.S x86/retpoline/crypto: Convert crypto assembler indirect jumps 2018-01-12 00:14:29 +01:00
crct10dif-pcl-asm_64.S crypto: x86/crct10dif-pcl - cleanup and optimizations 2019-02-08 15:29:48 +08:00
crct10dif-pclmul_glue.c crypto: x86/crct10dif-pcl - cleanup and optimizations 2019-02-08 15:29:48 +08:00
des3_ede-asm_64.S crypto: x86/des3_ede - Fix RBP usage 2017-09-20 17:42:34 +08:00
des3_ede_glue.c crypto: x86/des3_ede - des3_ede_skciphers[] can be static 2018-03-09 22:45:53 +08:00
ghash-clmulni-intel_asm.S crypto: x86 - make constants readonly, allow linker to merge them 2017-01-23 22:50:29 +08:00
ghash-clmulni-intel_glue.c crypto: ahash - remove useless setting of cra_type 2018-07-09 00:30:26 +08:00
glue_helper-asm-avx.S crypto: x86 - add more optimized XTS-mode for serpent-avx 2013-04-25 21:01:51 +08:00
glue_helper-asm-avx2.S crypto: twofish - add AVX2/x86_64 assembler implementation of twofish cipher 2013-04-25 21:09:05 +08:00
glue_helper.c crypto: x86/glue_helper - rename glue_skwalk_fpu_begin() 2018-03-03 00:03:35 +08:00
morus640-sse2-asm.S Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-08-13 13:35:26 -07:00
morus640-sse2-glue.c crypto: x86/aegis,morus - Do not require OSXSAVE for SSE2 2018-09-14 14:08:27 +08:00
morus640_glue.c crypto: x86/morus - fix handling chunked inputs and MAY_SLEEP 2019-02-08 15:30:08 +08:00
morus1280-avx2-asm.S Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-08-13 13:35:26 -07:00
morus1280-avx2-glue.c crypto: x86/aegis,morus - Fix and simplify CPUID checks 2018-08-07 17:51:15 +08:00
morus1280-sse2-asm.S Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-08-13 13:35:26 -07:00
morus1280-sse2-glue.c crypto: x86/aegis,morus - Do not require OSXSAVE for SSE2 2018-09-14 14:08:27 +08:00
morus1280_glue.c crypto: x86/morus - fix handling chunked inputs and MAY_SLEEP 2019-02-08 15:30:08 +08:00
nh-avx2-x86_64.S crypto: x86/nhpoly1305 - add AVX2 accelerated NHPoly1305 2018-12-13 18:24:57 +08:00
nh-sse2-x86_64.S crypto: x86/nhpoly1305 - add SSE2 accelerated NHPoly1305 2018-12-13 18:24:57 +08:00
nhpoly1305-avx2-glue.c crypto: x86/nhpoly1305 - add AVX2 accelerated NHPoly1305 2018-12-13 18:24:57 +08:00
nhpoly1305-sse2-glue.c crypto: x86/nhpoly1305 - add SSE2 accelerated NHPoly1305 2018-12-13 18:24:57 +08:00
poly1305-avx2-x86_64.S crypto: x86/poly1305 - fix overflow during partial reduction 2019-04-08 14:43:06 +08:00
poly1305-sse2-x86_64.S crypto: x86/poly1305 - fix overflow during partial reduction 2019-04-08 14:43:06 +08:00
poly1305_glue.c crypto: poly1305 - use structures for key and accumulator 2018-11-20 14:26:56 +08:00
serpent-avx-x86_64-asm_64.S crypto: x86 - make constants readonly, allow linker to merge them 2017-01-23 22:50:29 +08:00
serpent-avx2-asm_64.S crypto: x86 - make constants readonly, allow linker to merge them 2017-01-23 22:50:29 +08:00
serpent-sse2-i586-asm_32.S crypto: x86/serpent - use ENTRY/ENDPROC for assember functions and localize jump targets 2013-01-20 10:16:50 +11:00
serpent-sse2-x86_64-asm_64.S crypto: x86/serpent - use ENTRY/ENDPROC for assember functions and localize jump targets 2013-01-20 10:16:50 +11:00
serpent_avx2_glue.c crypto: x86/serpent-avx,avx2 - convert to skcipher interface 2018-03-03 00:03:22 +08:00
serpent_avx_glue.c crypto: x86/serpent-avx,avx2 - convert to skcipher interface 2018-03-03 00:03:22 +08:00
serpent_sse2_glue.c crypto: x86/serpent-sse2 - convert to skcipher interface 2018-03-03 00:03:20 +08:00
sha1_avx2_x86_64_asm.S crypto: x86/sha1-avx2 - Fix RBP usage 2017-09-20 17:42:34 +08:00
sha1_ni_asm.S crypto: x86 - make constants readonly, allow linker to merge them 2017-01-23 22:50:29 +08:00
sha1_ssse3_asm.S x86/asm/64: Use 32-bit XOR to zero registers 2018-07-03 09:59:29 +02:00
sha1_ssse3_glue.c crypto: shash - remove useless setting of type flags 2018-07-09 00:30:24 +08:00
sha256-avx-asm.S crypto: x86/sha256-avx - Fix RBP usage 2017-09-20 17:42:36 +08:00
sha256-avx2-asm.S crypto: x86/sha256-avx2 - Fix RBP usage 2017-09-20 17:42:36 +08:00
sha256-ssse3-asm.S crypto: x86/sha256-ssse3 - Fix RBP usage 2017-09-20 17:42:37 +08:00
sha256_ni_asm.S crypto: x86 - make constants readonly, allow linker to merge them 2017-01-23 22:50:29 +08:00
sha256_ssse3_glue.c crypto: shash - remove useless setting of type flags 2018-07-09 00:30:24 +08:00
sha512-avx-asm.S crypto: x86 - make constants readonly, allow linker to merge them 2017-01-23 22:50:29 +08:00
sha512-avx2-asm.S crypto: sha512-avx2 - Fix RBP usage 2017-09-20 17:42:37 +08:00
sha512-ssse3-asm.S crypto: x86 - make constants readonly, allow linker to merge them 2017-01-23 22:50:29 +08:00
sha512_ssse3_glue.c crypto: shash - remove useless setting of type flags 2018-07-09 00:30:24 +08:00
twofish-avx-x86_64-asm_64.S crypto: x86/twofish - Fix RBP usage 2017-09-20 17:42:38 +08:00
twofish-i586-asm_32.S crypto: x86/twofish - assembler clean-ups: use ENTRY/ENDPROC, localize jump labels 2013-01-20 10:16:51 +11:00
twofish-x86_64-asm_64-3way.S crypto: x86/twofish-3way - Fix %rbp usage 2017-12-28 17:56:44 +11:00
twofish-x86_64-asm_64.S x86/asm: Replace "MOVQ $imm, %reg" with MOVL 2015-04-01 13:17:39 +02:00
twofish_avx_glue.c crypto: x86/twofish-avx - convert to skcipher interface 2018-03-03 00:03:25 +08:00
twofish_glue.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
twofish_glue_3way.c crypto: x86/twofish-3way - convert to skcipher interface 2018-03-03 00:03:24 +08:00