Eric Biggers 678cce4019 crypto: x86/poly1305 - fix overflow during partial reduction ... The x86_64 implementation of Poly1305 produces the wrong result on some inputs because poly1305_4block_avx2() incorrectly assumes that when partially reducing the accumulator, the bits carried from limb 'd4' to limb 'h0' fit in a 32-bit integer. This is true for poly1305-generic which processes only one block at a time. However, it's not true for the AVX2 implementation, which processes 4 blocks at a time and therefore can produce intermediate limbs about 4x larger. Fix it by making the relevant calculations use 64-bit arithmetic rather than 32-bit. Note that most of the carries already used 64-bit arithmetic, but the d4 -> h0 carry was different for some reason. To be safe I also made the same change to the corresponding SSE2 code, though that only operates on 1 or 2 blocks at a time. I don't think it's really needed for poly1305_block_sse2(), but it doesn't hurt because it's already x86_64 code. It *might* be needed for poly1305_2block_sse2(), but overflows aren't easy to reproduce there. This bug was originally detected by my patches that improve testmgr to fuzz algorithms against their generic implementation. But also add a test vector which reproduces it directly (in the AVX2 case). Fixes: b1ccc8f4b6 ("crypto: poly1305 - Add a four block AVX2 variant for x86_64") Fixes: c70f4abef0 ("crypto: poly1305 - Add a SSE2 SIMD variant for x86_64") Cc: <stable@vger.kernel.org> # v4.3+ Cc: Martin Willi <martin@strongswan.org> Cc: Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by: Eric Biggers <ebiggers@google.com> Reviewed-by: Martin Willi <martin@strongswan.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>		2019-04-08 14:43:06 +08:00
..
asymmetric_keys	KEYS: asym_tpm: Add support for the sign operation [ver #2]	2018-10-26 09:30:47 +01:00
async_tx	…
842.c	…
Kconfig	crypto: testmgr - introduce CONFIG_CRYPTO_MANAGER_EXTRA_TESTS	2019-02-08 15:30:09 +08:00
Makefile	lib/lzo: separate lzo-rle from lzo	2019-03-07 18:32:03 -08:00
ablkcipher.c	crypto: skcipher - remove remnants of internal IV generators	2018-12-23 11:52:45 +08:00
acompress.c	crypto: user - clean up report structure copying	2018-11-09 17:41:39 +08:00
adiantum.c	crypto: adiantum - initialize crypto_spawn::inst	2019-01-10 21:37:31 +08:00
aead.c	crypto: aead - set CRYPTO_TFM_NEED_KEY if ->setkey() fails	2019-01-18 18:40:24 +08:00
aegis.h	crypto: aegis - Cleanup license mess	2019-01-25 18:41:51 +08:00
aegis128.c	crypto: aegis - fix handling chunked inputs	2019-02-08 15:30:08 +08:00
aegis128l.c	crypto: aegis - fix handling chunked inputs	2019-02-08 15:30:08 +08:00
aegis256.c	crypto: aegis - fix handling chunked inputs	2019-02-08 15:30:08 +08:00
aes_generic.c	crypto: arm/aes - add some hardening against cache-timing attacks	2018-11-09 17:36:48 +08:00
aes_ti.c	crypto: aes_ti - disable interrupts while accessing S-box	2018-11-09 17:36:48 +08:00
af_alg.c	Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6	2019-03-05 09:09:55 -08:00
ahash.c	crypto: ahash - fix another early termination in hash walk	2019-02-08 15:30:08 +08:00
akcipher.c	crypto: user - clean up report structure copying	2018-11-09 17:41:39 +08:00
algapi.c	crypto: api - add a helper to (un)register a array of templates	2019-01-25 18:41:52 +08:00
algboss.c	crypto: api - Introduce notifier for new crypto algorithms	2018-09-04 11:37:04 +08:00
algif_aead.c	crypto: null - Remove VLA usage of skcipher	2018-09-28 12:46:08 +08:00
algif_hash.c	crypto: hash - Remove VLA usage	2018-09-04 11:35:03 +08:00
algif_rng.c	…
algif_skcipher.c	…
ansi_cprng.c	…
anubis.c	…
api.c	…
arc4.c	crypto: export arc4 defines	2019-02-15 13:21:55 +08:00
authenc.c	crypto: authenc - fix parsing key with misaligned rta_len	2019-01-10 21:37:31 +08:00
authencesn.c	crypto: authencesn - Avoid twice completion call in decrypt path	2019-01-10 21:37:31 +08:00
blkcipher.c	crypto: skcipher - remove remnants of internal IV generators	2018-12-23 11:52:45 +08:00
blowfish_common.c	…
blowfish_generic.c	…
camellia_generic.c	…
cast5_generic.c	…
cast6_generic.c	…
cast_common.c	…
cbc.c	crypto: cbc - convert to skcipher_alloc_instance_simple()	2019-01-11 14:16:57 +08:00
ccm.c	crypto: ccm - use template array registering API to simplify the code	2019-01-25 18:41:52 +08:00
cfb.c	crypto: cfb - convert to skcipher_alloc_instance_simple()	2019-01-11 14:16:57 +08:00
chacha20poly1305.c	crypto: chacha20poly1305 - use template array registering API to simplify the code	2019-01-25 18:41:52 +08:00
chacha_generic.c	crypto: chacha - add XChaCha12 support	2018-11-20 14:26:55 +08:00
cipher.c	…
cmac.c	…
compress.c	…
crc32_generic.c	…
crc32c_generic.c	…
crct10dif_common.c	…
crct10dif_generic.c	…
cryptd.c	crypto: skcipher - remove remnants of internal IV generators	2018-12-23 11:52:45 +08:00
crypto_engine.c	…
crypto_null.c	crypto: null - convert ecb-cipher_null to skcipher API	2019-01-11 14:16:58 +08:00
crypto_user_base.c	crypto: user - remove unused dump functions	2018-12-23 11:52:44 +08:00
crypto_user_stat.c	crypto: stat - remove unused mutex	2019-01-18 18:43:43 +08:00
crypto_wq.c	…
ctr.c	crypto: ctr - use template array registering API to simplify the code	2019-01-25 18:41:52 +08:00
cts.c	…
deflate.c	…
des_generic.c	crypto: clarify name of WEAK_KEY request flag	2019-01-25 18:41:52 +08:00
dh.c	…
dh_helper.c	crypto: dh - make crypto_dh_encode_key() make robust	2018-08-03 18:06:06 +08:00
drbg.c	crypto: drbg - in-place cipher operation for CTR	2018-08-03 18:05:48 +08:00
ecb.c	crypto: ecb - convert to skcipher API	2019-01-11 14:16:58 +08:00
ecc.c	crypto: ecc - regularize scalar for scalar multiplication	2018-11-16 14:11:04 +08:00
ecc.h	…
ecc_curve_defs.h	crypto: ecdh - fix typo of P-192 b value	2018-07-20 13:51:22 +08:00
ecdh.c	…
ecdh_helper.c	…
echainiv.c	crypto: null - Remove VLA usage of skcipher	2018-09-28 12:46:08 +08:00
fcrypt.c	…
fips.c	…
gcm.c	crypto: gcm - use template array registering API to simplify the code	2019-01-25 18:41:52 +08:00
gf128mul.c	…
ghash-generic.c	…
hash_info.c	crypto: streebog - register Streebog in hash info for IMA	2018-11-16 14:09:40 +08:00
hmac.c	…
internal.h	crypto: api - Introduce notifier for new crypto algorithms	2018-09-04 11:37:04 +08:00
jitterentropy-kcapi.c	…
jitterentropy.c	…
keywrap.c	crypto: keywrap - convert to skcipher API	2019-01-11 14:16:58 +08:00
khazad.c	…
kpp.c	crypto: user - clean up report structure copying	2018-11-09 17:41:39 +08:00
lrw.c	crypto: lrw - fix rebase error after out of bounds fix	2018-10-05 10:22:48 +08:00
lz4.c	crypto: remove useless initializations of cra_list	2018-11-20 14:26:55 +08:00
lz4hc.c	crypto: remove useless initializations of cra_list	2018-11-20 14:26:55 +08:00
lzo-rle.c	lib/lzo: separate lzo-rle from lzo	2019-03-07 18:32:03 -08:00
lzo.c	…
md4.c	…
md5.c	…
memneq.c	…
michael_mic.c	…
morus640.c	crypto: morus - fix handling chunked inputs	2019-02-08 15:30:08 +08:00
morus1280.c	crypto: morus - fix handling chunked inputs	2019-02-08 15:30:08 +08:00
nhpoly1305.c	crypto: adiantum - adjust some comments to match latest paper	2018-12-13 18:24:59 +08:00
ofb.c	crypto: ofb - convert to skcipher_alloc_instance_simple()	2019-01-11 14:16:58 +08:00
pcbc.c	crypto: pcbc - convert to skcipher_alloc_instance_simple()	2019-01-11 14:16:58 +08:00
pcrypt.c	Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6	2018-12-27 13:53:32 -08:00
poly1305_generic.c	crypto: poly1305 - add Poly1305 core API	2018-11-20 14:26:56 +08:00
proc.c	…
ripemd.h	…
rmd128.c	…
rmd160.c	…
rmd256.c	crypto: rmd256 - use swap macro in rmd256_transform	2018-07-27 19:28:36 +08:00
rmd320.c	crypto: rmd320 - use swap macro in rmd320_transform	2018-07-27 19:28:36 +08:00
rng.c	crypto: user - fix use_after_free of struct xxx_request	2018-12-07 14:15:00 +08:00
rsa-pkcs1pad.c	crypto: rsa-pkcs1pad - include <crypto/internal/rsa.h>	2019-01-18 18:43:42 +08:00
rsa.c	…
rsa_helper.c	…
rsaprivkey.asn1	…
rsapubkey.asn1	…
salsa20_generic.c	crypto: salsa20-generic - don't unnecessarily use atomic walk	2018-12-23 11:52:44 +08:00
scatterwalk.c	crypto: scatterwalk - remove 'chain' argument from scatterwalk_crypto_chain()	2018-08-03 18:06:03 +08:00
scompress.c	crypto: user - clean up report structure copying	2018-11-09 17:41:39 +08:00
seed.c	…
seqiv.c	crypto: seqiv - Use kmemdup in seqiv_aead_encrypt()	2019-02-01 14:42:03 +08:00
serpent_generic.c	…
sha1_generic.c	…
sha3_generic.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux	2018-08-03 17:55:12 +08:00
sha256_generic.c	…
sha512_generic.c	…
shash.c	crypto: shash - remove pointless checks of shash_alg::{export,import}	2019-01-18 18:40:24 +08:00
simd.c	crypto: simd - correctly take reqsize of wrapped skcipher into account	2018-11-09 17:35:43 +08:00
skcipher.c	crypto: skcipher - set CRYPTO_TFM_NEED_KEY if ->setkey() fails	2019-01-18 18:40:24 +08:00
sm3_generic.c	crypto: sm3 - fix undefined shift by >= width of value	2019-01-10 21:37:32 +08:00
sm4_generic.c	…
streebog_generic.c	crypto: streebog - use correct endianness type	2019-01-18 18:43:43 +08:00
tcrypt.c	lib/lzo: separate lzo-rle from lzo	2019-03-07 18:32:03 -08:00
tcrypt.h	crypto: testmgr - update sm4 test vectors	2018-09-28 12:46:26 +08:00
tea.c	…
testmgr.c	crypto: testmgr - support checking skcipher output IV	2019-02-22 12:47:27 +08:00
testmgr.h	crypto: x86/poly1305 - fix overflow during partial reduction	2019-04-08 14:43:06 +08:00
tgr192.c	crypto: tgr192 - fix unaligned memory access	2019-01-18 18:43:43 +08:00
twofish_common.c	…
twofish_generic.c	…
vmac.c	…
wp512.c	…
xcbc.c	crypto: xcbc - Remove VLA usage	2018-09-04 11:35:03 +08:00
xor.c	…
xts.c	crypto: xts - Drop use of auxiliary buffer	2018-09-21 13:24:50 +08:00
zstd.c	…