Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-15 08:31:55 +00:00
Code Issues Packages Projects Releases Wiki Activity
f6e20967d8
linux/crypto
History
Eric Biggers 678cce4019 crypto: x86/poly1305 - fix overflow during partial reduction 
The x86_64 implementation of Poly1305 produces the wrong result on some
inputs because poly1305_4block_avx2() incorrectly assumes that when
partially reducing the accumulator, the bits carried from limb 'd4' to
limb 'h0' fit in a 32-bit integer.  This is true for poly1305-generic
which processes only one block at a time.  However, it's not true for
the AVX2 implementation, which processes 4 blocks at a time and
therefore can produce intermediate limbs about 4x larger.

Fix it by making the relevant calculations use 64-bit arithmetic rather
than 32-bit.  Note that most of the carries already used 64-bit
arithmetic, but the d4 -> h0 carry was different for some reason.

To be safe I also made the same change to the corresponding SSE2 code,
though that only operates on 1 or 2 blocks at a time.  I don't think
it's really needed for poly1305_block_sse2(), but it doesn't hurt
because it's already x86_64 code.  It *might* be needed for
poly1305_2block_sse2(), but overflows aren't easy to reproduce there.

This bug was originally detected by my patches that improve testmgr to
fuzz algorithms against their generic implementation.  But also add a
test vector which reproduces it directly (in the AVX2 case).

Fixes: b1ccc8f4b6 ("crypto: poly1305 - Add a four block AVX2 variant for x86_64")
Fixes: c70f4abef0 ("crypto: poly1305 - Add a SSE2 SIMD variant for x86_64")
Cc: <stable@vger.kernel.org> # v4.3+
Cc: Martin Willi <martin@strongswan.org>
Cc: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Martin Willi <martin@strongswan.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2019-04-08 14:43:06 +08:00
..
asymmetric_keys KEYS: asym_tpm: Add support for the sign operation [ver #2] 2018-10-26 09:30:47 +01:00
async_tx async_pq: Remove VLA usage 2018-06-18 20:17:38 +05:30
842.c
ablkcipher.c crypto: skcipher - remove remnants of internal IV generators 2018-12-23 11:52:45 +08:00
acompress.c crypto: user - clean up report structure copying 2018-11-09 17:41:39 +08:00
adiantum.c crypto: adiantum - initialize crypto_spawn::inst 2019-01-10 21:37:31 +08:00
aead.c crypto: aead - set CRYPTO_TFM_NEED_KEY if ->setkey() fails 2019-01-18 18:40:24 +08:00
aegis128.c crypto: aegis - fix handling chunked inputs 2019-02-08 15:30:08 +08:00
aegis128l.c crypto: aegis - fix handling chunked inputs 2019-02-08 15:30:08 +08:00
aegis256.c crypto: aegis - fix handling chunked inputs 2019-02-08 15:30:08 +08:00
aegis.h crypto: aegis - Cleanup license mess 2019-01-25 18:41:51 +08:00
aes_generic.c crypto: arm/aes - add some hardening against cache-timing attacks 2018-11-09 17:36:48 +08:00
aes_ti.c crypto: aes_ti - disable interrupts while accessing S-box 2018-11-09 17:36:48 +08:00
af_alg.c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-03-05 09:09:55 -08:00
ahash.c crypto: ahash - fix another early termination in hash walk 2019-02-08 15:30:08 +08:00
akcipher.c crypto: user - clean up report structure copying 2018-11-09 17:41:39 +08:00
algapi.c crypto: api - add a helper to (un)register a array of templates 2019-01-25 18:41:52 +08:00
algboss.c crypto: api - Introduce notifier for new crypto algorithms 2018-09-04 11:37:04 +08:00
algif_aead.c crypto: null - Remove VLA usage of skcipher 2018-09-28 12:46:08 +08:00
algif_hash.c crypto: hash - Remove VLA usage 2018-09-04 11:35:03 +08:00
algif_rng.c net: remove sock_no_poll 2018-05-26 09:16:44 +02:00
algif_skcipher.c Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL 2018-06-28 10:40:47 -07:00
ansi_cprng.c
anubis.c
api.c evm: Don't deadlock if a crypto algorithm is unavailable 2018-07-18 07:27:22 -04:00
arc4.c crypto: export arc4 defines 2019-02-15 13:21:55 +08:00
authenc.c crypto: authenc - fix parsing key with misaligned rta_len 2019-01-10 21:37:31 +08:00
authencesn.c crypto: authencesn - Avoid twice completion call in decrypt path 2019-01-10 21:37:31 +08:00
blkcipher.c crypto: skcipher - remove remnants of internal IV generators 2018-12-23 11:52:45 +08:00
blowfish_common.c
blowfish_generic.c
camellia_generic.c
cast5_generic.c
cast6_generic.c
cast_common.c
cbc.c crypto: cbc - convert to skcipher_alloc_instance_simple() 2019-01-11 14:16:57 +08:00
ccm.c crypto: ccm - use template array registering API to simplify the code 2019-01-25 18:41:52 +08:00
cfb.c crypto: cfb - convert to skcipher_alloc_instance_simple() 2019-01-11 14:16:57 +08:00
chacha20poly1305.c crypto: chacha20poly1305 - use template array registering API to simplify the code 2019-01-25 18:41:52 +08:00
chacha_generic.c crypto: chacha - add XChaCha12 support 2018-11-20 14:26:55 +08:00
cipher.c crypto: remove several VLAs 2018-04-21 00:58:34 +08:00
cmac.c
compress.c
crc32_generic.c crypto: crc32-generic - remove __crc32_le() 2018-05-27 00:12:09 +08:00
crc32c_generic.c crypto: crc32c-generic - remove cra_alignmask 2018-05-27 00:12:08 +08:00
crct10dif_common.c
crct10dif_generic.c
cryptd.c crypto: skcipher - remove remnants of internal IV generators 2018-12-23 11:52:45 +08:00
crypto_engine.c crypto: engine - Permit to enqueue all async requests 2018-02-15 23:26:50 +08:00
crypto_null.c crypto: null - convert ecb-cipher_null to skcipher API 2019-01-11 14:16:58 +08:00
crypto_user_base.c crypto: user - remove unused dump functions 2018-12-23 11:52:44 +08:00
crypto_user_stat.c crypto: stat - remove unused mutex 2019-01-18 18:43:43 +08:00
crypto_wq.c
ctr.c crypto: ctr - use template array registering API to simplify the code 2019-01-25 18:41:52 +08:00
cts.c crypto: remove several VLAs 2018-04-21 00:58:34 +08:00
deflate.c
des_generic.c crypto: clarify name of WEAK_KEY request flag 2019-01-25 18:41:52 +08:00
dh_helper.c crypto: dh - make crypto_dh_encode_key() make robust 2018-08-03 18:06:06 +08:00
dh.c crypto: dh - fix memory leak 2018-07-20 13:51:21 +08:00
drbg.c crypto: drbg - in-place cipher operation for CTR 2018-08-03 18:05:48 +08:00
ecb.c crypto: ecb - convert to skcipher API 2019-01-11 14:16:58 +08:00
ecc_curve_defs.h crypto: ecdh - fix typo of P-192 b value 2018-07-20 13:51:22 +08:00
ecc.c crypto: ecc - regularize scalar for scalar multiplication 2018-11-16 14:11:04 +08:00
ecc.h crypto: ecc - Actually remove stack VLA usage 2018-04-21 00:58:29 +08:00
ecdh_helper.c
ecdh.c crypto: ecc - Actually remove stack VLA usage 2018-04-21 00:58:29 +08:00
echainiv.c crypto: null - Remove VLA usage of skcipher 2018-09-28 12:46:08 +08:00
fcrypt.c
fips.c
gcm.c crypto: gcm - use template array registering API to simplify the code 2019-01-25 18:41:52 +08:00
gf128mul.c
ghash-generic.c crypto: shash - remove useless setting of type flags 2018-07-09 00:30:24 +08:00
hash_info.c crypto: streebog - register Streebog in hash info for IMA 2018-11-16 14:09:40 +08:00
hmac.c
internal.h crypto: api - Introduce notifier for new crypto algorithms 2018-09-04 11:37:04 +08:00
jitterentropy-kcapi.c
jitterentropy.c
Kconfig crypto: testmgr - introduce CONFIG_CRYPTO_MANAGER_EXTRA_TESTS 2019-02-08 15:30:09 +08:00
keywrap.c crypto: keywrap - convert to skcipher API 2019-01-11 14:16:58 +08:00
khazad.c
kpp.c crypto: user - clean up report structure copying 2018-11-09 17:41:39 +08:00
lrw.c crypto: lrw - fix rebase error after out of bounds fix 2018-10-05 10:22:48 +08:00
lz4.c crypto: remove useless initializations of cra_list 2018-11-20 14:26:55 +08:00
lz4hc.c crypto: remove useless initializations of cra_list 2018-11-20 14:26:55 +08:00
lzo-rle.c lib/lzo: separate lzo-rle from lzo 2019-03-07 18:32:03 -08:00
lzo.c
Makefile lib/lzo: separate lzo-rle from lzo 2019-03-07 18:32:03 -08:00
md4.c crypto: shash - remove useless setting of type flags 2018-07-09 00:30:24 +08:00
md5.c crypto: shash - remove useless setting of type flags 2018-07-09 00:30:24 +08:00
memneq.c
michael_mic.c
morus640.c crypto: morus - fix handling chunked inputs 2019-02-08 15:30:08 +08:00
morus1280.c crypto: morus - fix handling chunked inputs 2019-02-08 15:30:08 +08:00
nhpoly1305.c crypto: adiantum - adjust some comments to match latest paper 2018-12-13 18:24:59 +08:00
ofb.c crypto: ofb - convert to skcipher_alloc_instance_simple() 2019-01-11 14:16:58 +08:00
pcbc.c crypto: pcbc - convert to skcipher_alloc_instance_simple() 2019-01-11 14:16:58 +08:00
pcrypt.c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2018-12-27 13:53:32 -08:00
poly1305_generic.c crypto: poly1305 - add Poly1305 core API 2018-11-20 14:26:56 +08:00
proc.c proc: introduce proc_create_seq{,_data} 2018-05-16 07:23:35 +02:00
ripemd.h
rmd128.c crypto: shash - remove useless setting of type flags 2018-07-09 00:30:24 +08:00
rmd160.c crypto: shash - remove useless setting of type flags 2018-07-09 00:30:24 +08:00
rmd256.c crypto: rmd256 - use swap macro in rmd256_transform 2018-07-27 19:28:36 +08:00
rmd320.c crypto: rmd320 - use swap macro in rmd320_transform 2018-07-27 19:28:36 +08:00
rng.c crypto: user - fix use_after_free of struct xxx_request 2018-12-07 14:15:00 +08:00
rsa_helper.c kbuild: rename *-asn1.[ch] to *.asn1.[ch] 2018-04-07 19:04:02 +09:00
rsa-pkcs1pad.c crypto: rsa-pkcs1pad - include <crypto/internal/rsa.h> 2019-01-18 18:43:42 +08:00
rsa.c crypto: rsa - Remove unneeded error assignment 2018-04-21 00:58:37 +08:00
rsaprivkey.asn1
rsapubkey.asn1
salsa20_generic.c crypto: salsa20-generic - don't unnecessarily use atomic walk 2018-12-23 11:52:44 +08:00
scatterwalk.c crypto: scatterwalk - remove 'chain' argument from scatterwalk_crypto_chain() 2018-08-03 18:06:03 +08:00
scompress.c crypto: user - clean up report structure copying 2018-11-09 17:41:39 +08:00
seed.c
seqiv.c crypto: seqiv - Use kmemdup in seqiv_aead_encrypt() 2019-02-01 14:42:03 +08:00
serpent_generic.c
sha1_generic.c crypto: shash - remove useless setting of type flags 2018-07-09 00:30:24 +08:00
sha3_generic.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux 2018-08-03 17:55:12 +08:00
sha256_generic.c crypto: shash - remove useless setting of type flags 2018-07-09 00:30:24 +08:00
sha512_generic.c crypto: shash - remove useless setting of type flags 2018-07-09 00:30:24 +08:00
shash.c crypto: shash - remove pointless checks of shash_alg::{export,import} 2019-01-18 18:40:24 +08:00
simd.c crypto: simd - correctly take reqsize of wrapped skcipher into account 2018-11-09 17:35:43 +08:00
skcipher.c crypto: skcipher - set CRYPTO_TFM_NEED_KEY if ->setkey() fails 2019-01-18 18:40:24 +08:00
sm3_generic.c crypto: sm3 - fix undefined shift by >= width of value 2019-01-10 21:37:32 +08:00
sm4_generic.c crypto: sm4 - export encrypt/decrypt routines to other drivers 2018-05-05 14:52:51 +08:00
streebog_generic.c crypto: streebog - use correct endianness type 2019-01-18 18:43:43 +08:00
tcrypt.c lib/lzo: separate lzo-rle from lzo 2019-03-07 18:32:03 -08:00
tcrypt.h crypto: testmgr - update sm4 test vectors 2018-09-28 12:46:26 +08:00
tea.c
testmgr.c crypto: testmgr - support checking skcipher output IV 2019-02-22 12:47:27 +08:00
testmgr.h crypto: x86/poly1305 - fix overflow during partial reduction 2019-04-08 14:43:06 +08:00
tgr192.c crypto: tgr192 - fix unaligned memory access 2019-01-18 18:43:43 +08:00
twofish_common.c
twofish_generic.c
vmac.c crypto: vmac - remove insecure version with hardcoded nonce 2018-07-01 21:00:44 +08:00
wp512.c crypto: shash - remove useless setting of type flags 2018-07-09 00:30:24 +08:00
xcbc.c crypto: xcbc - Remove VLA usage 2018-09-04 11:35:03 +08:00
xor.c
xts.c crypto: xts - Drop use of auxiliary buffer 2018-09-21 13:24:50 +08:00
zstd.c crypto: zstd - Add zstd support 2018-04-21 00:58:30 +08:00