Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto fix from Herbert Xu:
"Fix a bug in the implementation of the x86 accelerated version of
poly1305"
* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
crypto: x86/poly1305 - fix overflow during partial reduction
+67
-13
+10
-4
arch/x86/crypto/poly1305-avx2-x86_64.S
+10
-4
arch/x86/crypto/poly1305-avx2-x86_64.S
···
323
323
vpaddq t2,t1,t1
324
324
vmovq t1x,d4
325
325
326
+
# Now do a partial reduction mod (2^130)-5, carrying h0 -> h1 -> h2 ->
327
+
# h3 -> h4 -> h0 -> h1 to get h0,h2,h3,h4 < 2^26 and h1 < 2^26 + a small
328
+
# amount. Careful: we must not assume the carry bits 'd0 >> 26',
329
+
# 'd1 >> 26', 'd2 >> 26', 'd3 >> 26', and '(d4 >> 26) * 5' fit in 32-bit
330
+
# integers. It's true in a single-block implementation, but not here.
331
+
326
332
# d1 += d0 >> 26
327
333
mov d0,%rax
328
334
shr $26,%rax
···
367
361
# h0 += (d4 >> 26) * 5
368
362
mov d4,%rax
369
363
shr $26,%rax
370
-
lea (%eax,%eax,4),%eax
371
-
add %eax,%ebx
364
+
lea (%rax,%rax,4),%rax
365
+
add %rax,%rbx
372
366
# h4 = d4 & 0x3ffffff
373
367
mov d4,%rax
374
368
and $0x3ffffff,%eax
375
369
mov %eax,h4
376
370
377
371
# h1 += h0 >> 26
378
-
mov %ebx,%eax
379
-
shr $26,%eax
372
+
mov %rbx,%rax
373
+
shr $26,%rax
380
374
add %eax,h1
381
375
# h0 = h0 & 0x3ffffff
382
376
andl $0x3ffffff,%ebx
+14
-8
arch/x86/crypto/poly1305-sse2-x86_64.S
+14
-8
arch/x86/crypto/poly1305-sse2-x86_64.S
···
253
253
# h0 += (d4 >> 26) * 5
254
254
mov d4,%rax
255
255
shr $26,%rax
256
-
lea (%eax,%eax,4),%eax
257
-
add %eax,%ebx
256
+
lea (%rax,%rax,4),%rax
257
+
add %rax,%rbx
258
258
# h4 = d4 & 0x3ffffff
259
259
mov d4,%rax
260
260
and $0x3ffffff,%eax
261
261
mov %eax,h4
262
262
263
263
# h1 += h0 >> 26
264
-
mov %ebx,%eax
265
-
shr $26,%eax
264
+
mov %rbx,%rax
265
+
shr $26,%rax
266
266
add %eax,h1
267
267
# h0 = h0 & 0x3ffffff
268
268
andl $0x3ffffff,%ebx
···
524
524
paddq t2,t1
525
525
movq t1,d4
526
526
527
+
# Now do a partial reduction mod (2^130)-5, carrying h0 -> h1 -> h2 ->
528
+
# h3 -> h4 -> h0 -> h1 to get h0,h2,h3,h4 < 2^26 and h1 < 2^26 + a small
529
+
# amount. Careful: we must not assume the carry bits 'd0 >> 26',
530
+
# 'd1 >> 26', 'd2 >> 26', 'd3 >> 26', and '(d4 >> 26) * 5' fit in 32-bit
531
+
# integers. It's true in a single-block implementation, but not here.
532
+
527
533
# d1 += d0 >> 26
528
534
mov d0,%rax
529
535
shr $26,%rax
···
568
562
# h0 += (d4 >> 26) * 5
569
563
mov d4,%rax
570
564
shr $26,%rax
571
-
lea (%eax,%eax,4),%eax
572
-
add %eax,%ebx
565
+
lea (%rax,%rax,4),%rax
566
+
add %rax,%rbx
573
567
# h4 = d4 & 0x3ffffff
574
568
mov d4,%rax
575
569
and $0x3ffffff,%eax
576
570
mov %eax,h4
577
571
578
572
# h1 += h0 >> 26
579
-
mov %ebx,%eax
580
-
shr $26,%eax
573
+
mov %rbx,%rax
574
+
shr $26,%rax
581
575
add %eax,h1
582
576
# h0 = h0 & 0x3ffffff
583
577
andl $0x3ffffff,%ebx
+43
-1
crypto/testmgr.h
+43
-1
crypto/testmgr.h
···
5634
5634
.psize = 80,
5635
5635
.digest = "\x13\x00\x00\x00\x00\x00\x00\x00"
5636
5636
"\x00\x00\x00\x00\x00\x00\x00\x00",
5637
-
},
5637
+
}, { /* Regression test for overflow in AVX2 implementation */
5638
+
.plaintext = "\xff\xff\xff\xff\xff\xff\xff\xff"
5639
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5640
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5641
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5642
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5643
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5644
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5645
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5646
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5647
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5648
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5649
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5650
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5651
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5652
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5653
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5654
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5655
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5656
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5657
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5658
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5659
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5660
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5661
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5662
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5663
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5664
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5665
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5666
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5667
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5668
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5669
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5670
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5671
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5672
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5673
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5674
+
"\xff\xff\xff\xff\xff\xff\xff\xff"
5675
+
"\xff\xff\xff\xff",
5676
+
.psize = 300,
5677
+
.digest = "\xfb\x5e\x96\xd8\x61\xd5\xc7\xc8"
5678
+
"\x78\xe5\x87\xcc\x2d\x5a\x22\xe1",
5679
+
}
5638
5680
};
5639
5681
5640
5682
/* NHPoly1305 test vectors from https://github.com/google/adiantum */