evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
android_kernel_oneplus_msm8998/crypto
History
Eric Biggers 7977328f42 crypto: x86/poly1305 - fix overflow during partial reduction 
commit 678cce4019d746da6c680c48ba9e6d417803e127 upstream.

The x86_64 implementation of Poly1305 produces the wrong result on some
inputs because poly1305_4block_avx2() incorrectly assumes that when
partially reducing the accumulator, the bits carried from limb 'd4' to
limb 'h0' fit in a 32-bit integer.  This is true for poly1305-generic
which processes only one block at a time.  However, it's not true for
the AVX2 implementation, which processes 4 blocks at a time and
therefore can produce intermediate limbs about 4x larger.

Fix it by making the relevant calculations use 64-bit arithmetic rather
than 32-bit.  Note that most of the carries already used 64-bit
arithmetic, but the d4 -> h0 carry was different for some reason.

To be safe I also made the same change to the corresponding SSE2 code,
though that only operates on 1 or 2 blocks at a time.  I don't think
it's really needed for poly1305_block_sse2(), but it doesn't hurt
because it's already x86_64 code.  It *might* be needed for
poly1305_2block_sse2(), but overflows aren't easy to reproduce there.

This bug was originally detected by my patches that improve testmgr to
fuzz algorithms against their generic implementation.  But also add a
test vector which reproduces it directly (in the AVX2 case).

Fixes: b1ccc8f4b6 ("crypto: poly1305 - Add a four block AVX2 variant for x86_64")
Fixes: c70f4abef0 ("crypto: poly1305 - Add a SSE2 SIMD variant for x86_64")
Cc: <stable@vger.kernel.org> # v4.3+
Cc: Martin Willi <martin@strongswan.org>
Cc: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Martin Willi <martin@strongswan.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-04-27 09:34:01 +02:00
..
asymmetric_keys X.509: reject invalid BIT STRING for subjectPublicKey 2017-12-16 10:33:48 +01:00
async_tx async_tx: Fix DMA_PREP_FENCE usage in do_async_gen_syndrome() 2018-04-13 19:50:06 +02:00
.gitignore crypto: rsa - add .gitignore for crypto/*.-asn1.[ch] files 2015-06-25 23:29:24 +08:00
842.c crypto: 842 - change 842 alg to use software 2015-05-11 15:06:43 +08:00
ablk_helper.c crypto: cryptd - process CRYPTO_ALG_INTERNAL 2015-03-31 21:21:04 +08:00
ablkcipher.c crypto: skcipher - Fix -Wstringop-truncation warnings 2018-10-10 08:52:03 +02:00
aead.c crypto: aead - Remove CRYPTO_ALG_AEAD_NEW flag 2015-08-17 16:53:53 +08:00
aes_generic.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
af_alg.c crypto: af_alg - fix possible uninit-value in alg_bind() 2018-05-16 10:06:49 +02:00
ahash.c crypto: ahash - fix another early termination in hash walk 2019-03-23 08:44:32 +01:00
akcipher.c crypto: akcipher - Don't #include crypto/public_key.h as the contents aren't used 2015-10-20 22:14:01 +08:00
algapi.c crypto: algapi - fix NULL dereference in crypto_remove_spawns() 2018-01-17 09:35:30 +01:00
algboss.c crypto: algboss - Remove reference to nivaead 2015-08-17 16:53:41 +08:00
algif_aead.c crypto: algif_aead - Require setkey before accept(2) 2017-05-20 14:27:00 +02:00
algif_hash.c crypto: algif_hash - avoid zero-sized array 2017-03-30 09:35:20 +02:00
algif_rng.c crypto: algif_rng - Remove obsolete const-removal cast 2015-04-22 09:30:21 +08:00
algif_skcipher.c crypto: AF_ALG - remove SGL terminator indicator when chaining 2017-09-27 11:00:14 +02:00
ansi_cprng.c crypto: ansi_cprng - Convert to new rng interface 2015-04-22 09:30:18 +08:00
anubis.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
api.c crypto: api - Only abort operations on fatal signal 2015-10-20 21:59:25 +08:00
arc4.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
authenc.c crypto: authenc - fix parsing key with misaligned rta_len 2019-01-26 09:42:50 +01:00
authencesn.c crypto: authencesn - Avoid twice completion call in decrypt path 2019-01-26 09:42:49 +01:00
blkcipher.c crypto: skcipher - Fix -Wstringop-truncation warnings 2018-10-10 08:52:03 +02:00
blowfish_common.c crypto: blowfish - split generic and common c code 2011-09-22 21:25:25 +10:00
blowfish_generic.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
camellia_generic.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
cast5_generic.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
cast6_generic.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
cast_common.c crypto: make tables used from assembler __visible 2013-08-14 20:42:03 +10:00
cbc.c crypto: include crypto- module prefix in template 2014-11-26 20:06:30 +08:00
ccm.c crypto: replace scatterwalk_sg_chain with sg_chain 2015-08-17 08:12:54 -06:00
chacha20_generic.c crypto: chacha20 - Export common ChaCha20 helpers 2015-07-17 21:20:21 +08:00
chacha20poly1305.c crypto: chacha20poly1305 - validate the digest size 2018-01-10 09:27:09 +01:00
chainiv.c crypto: chainiv - Offer normal cipher functionality without RNG 2015-06-22 15:49:28 +08:00
cipher.c crypto: cipher - Fix checkpatch errors 2010-02-16 20:31:37 +08:00
cmac.c crypto: include crypto- module prefix in template 2014-11-26 20:06:30 +08:00
compress.c crypto: compress - Fix checkpatch errors 2010-02-16 20:31:04 +08:00
crc32.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
crc32c_generic.c crypto: crc32c - Fix crc32c soft dependency 2016-02-17 12:31:04 -08:00
crct10dif_common.c crypto: crct10dif - Add fallback for broken initrds 2013-09-12 15:31:34 +10:00
crct10dif_generic.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
cryptd.c crypto: cryptd - pass through absence of ->setkey() 2018-02-16 20:09:43 +01:00
crypto_null.c crypto: null - Add default null skcipher 2015-05-22 11:25:55 +08:00
crypto_user.c crypto: user - re-add size check for CRYPTO_MSG_GETALG 2016-07-11 09:31:12 -07:00
crypto_wq.c crypto: crypto_wq - Fix late crypto work queue initialization 2014-03-21 21:54:28 +08:00
ctr.c crypto: include crypto- module prefix in template 2014-11-26 20:06:30 +08:00
cts.c crypto: cts - fix crash on short inputs 2019-01-16 22:16:12 +01:00
deflate.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
des_generic.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
drbg.c crypto: drbg - report backend_cra_name when allocation fails 2015-06-11 21:55:28 +08:00
ecb.c crypto: include crypto- module prefix in template 2014-11-26 20:06:30 +08:00
echainiv.c crypto: echainiv - Replace chaining with multiplication 2016-09-30 10:18:34 +02:00
eseqiv.c crypto: eseqiv - Offer normal cipher functionality without RNG 2015-06-22 15:49:28 +08:00
fcrypt.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
fips.c crypto: fips - Move fips_enabled sysctl into fips.c 2015-04-23 14:18:09 +08:00
gcm.c crypto: gcm - wait for crypto op not signal safe 2017-06-14 13:16:21 +02:00
gf128mul.c crypto: gf128mul - fix call to memset() 2011-07-08 17:21:21 +08:00
ghash-generic.c crypto: ghash-generic - move common definitions to a new header file 2016-10-22 12:26:56 +02:00
hash_info.c crypto: provide single place for hash algo information 2013-10-25 17:14:03 -04:00
hmac.c crypto: hmac - require that the underlying hash algorithm is unkeyed 2017-12-20 10:04:51 +01:00
internal.h crypto: api - Remove linux/fips.h from internal.h 2015-04-23 14:18:10 +08:00
jitterentropy-kcapi.c crypto: jitterentropy - remove unnecessary information from a comment 2015-10-14 22:23:16 +08:00
jitterentropy.c crypto: jitterentropy - Delete unnecessary checks before the function call "kzfree" 2015-06-25 23:18:33 +08:00
Kconfig Revert "crypto: xts - Add ECB dependency" 2017-11-21 09:21:22 +01:00
keywrap.c crypto: keywrap - memzero the correct memory 2016-04-12 09:08:45 -07:00
khazad.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
lrw.c crypto: lrw - Fix out-of bounds access on counter overflow 2018-11-21 09:27:34 +01:00
lz4.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
lz4hc.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
lzo.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
Makefile crypto: improve gcc optimization flags for serpent and wp512 2017-03-18 19:09:56 +08:00
mcryptd.c crypto: mcryptd - protect the per-CPU queue with a lock 2018-01-02 20:33:19 +01:00
md4.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
md5.c crypto: md5 - use md5 IV MD5_HX instead of their raw value 2015-05-18 12:20:18 +08:00
memneq.c crypto: memneq - fix for archs without efficient unaligned access 2013-12-09 20:09:12 +08:00
michael_mic.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
pcbc.c crypto: pcbc - remove bogus memcpy()s with src == dest 2019-03-23 08:44:36 +01:00
pcompress.c crypto: pcomp - Use crypto_alg_extsize helper 2015-04-21 10:19:55 +08:00
pcrypt.c crypto: pcrypt - fix freeing pcrypt instances 2018-01-10 09:27:09 +01:00
poly1305_generic.c crypto: poly1305 - remove ->setkey() method 2018-02-16 20:09:43 +01:00
proc.c crypto: fips - Move fips_enabled sysctl into fips.c 2015-04-23 14:18:09 +08:00
ripemd.h [CRYPTO] ripemd: Put all common RIPEMD values in header file 2008-07-10 20:35:12 +08:00
rmd128.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
rmd160.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
rmd256.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
rmd320.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
rng.c crypto: rng - Do not free default RNG when it becomes unused 2015-06-22 15:49:18 +08:00
rsa.c crypto: akcipher - Changes to asymmetric key API 2015-10-14 22:23:16 +08:00
rsa_helper.c crypto: akcipher - Changes to asymmetric key API 2015-10-14 22:23:16 +08:00
rsaprivkey.asn1 crypto: akcipher - Changes to asymmetric key API 2015-10-14 22:23:16 +08:00
rsapubkey.asn1 crypto: akcipher - Changes to asymmetric key API 2015-10-14 22:23:16 +08:00
salsa20_generic.c crypto: salsa20 - fix blkcipher_walk API usage 2017-12-20 10:04:51 +01:00
scatterwalk.c crypto: scatterwalk - Fix test in scatterwalk_done 2016-08-16 09:30:50 +02:00
seed.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
seqiv.c crypto: seqiv - Use generic geniv init/exit helpers 2015-08-17 16:53:46 +08:00
serpent_generic.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
sha1_generic.c crypto: sha1-generic - move to generic glue implementation 2015-04-10 21:39:40 +08:00
sha256_generic.c crypto: sha256-generic - move to generic glue implementation 2015-04-10 21:39:41 +08:00
sha512_generic.c crypto: sha512-generic - move to generic glue implementation 2015-04-10 21:39:41 +08:00
shash.c crypto: shash - Fix a sleep-in-atomic bug in shash_setkey_unaligned 2018-11-10 07:41:42 -08:00
skcipher.c crypto: skcipher - Add crypto_skcipher_has_setkey 2016-02-17 12:31:03 -08:00
tcrypt.c crypto: tcrypt - fix S/G table for test_aead_speed() 2018-02-16 20:09:38 +01:00
tcrypt.h crypto: tcrypt - Add ChaCha20/Poly1305 speed tests 2015-07-17 21:20:20 +08:00
tea.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
testmgr.c crypto: testmgr - fix out of bound read in __test_aead() 2017-05-02 21:19:48 -07:00
testmgr.h crypto: x86/poly1305 - fix overflow during partial reduction 2019-04-27 09:34:01 +02:00
tgr192.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
twofish_common.c crypto: twofish-x86_64-3way - add lrw support 2011-11-09 11:53:32 +08:00
twofish_generic.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
vmac.c crypto: vmac - separate tfm and request context 2018-08-17 20:56:45 +02:00
wp512.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
xcbc.c crypto: include crypto- module prefix in template 2014-11-26 20:06:30 +08:00
xor.c add further __init annotations to crypto/xor.c 2012-10-11 13:42:32 +11:00
xts.c crypto: include crypto- module prefix in template 2014-11-26 20:06:30 +08:00
zlib.c crypto: pcomp - Constify (de)compression parameters 2015-05-01 11:16:37 +08:00