Commit 519a0d7e authored by Ard Biesheuvel's avatar Ard Biesheuvel Committed by Herbert Xu
Browse files

crypto: arm64/poly1305-neon - reorder PAC authentication with SP update 



PAC pointer authentication signs the return address against the value
of the stack pointer, to prevent stack overrun exploits from corrupting
the control flow. However, this requires that the AUTIASP is issued with
SP holding the same value as it held when the PAC value was generated.
The Poly1305 NEON code got this wrong, resulting in crashes on PAC
capable hardware.

Fixes: f569ca16 ("crypto: arm64/poly1305 - incorporate OpenSSL/CRYPTOGAMS ...")
Signed-off-by: default avatarArd Biesheuvel <ardb@kernel.org>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 92eb6c30

arch/arm64/crypto/poly1305-armv8.pl

+1 −1
Original line number Diff line number Diff line
@@ -840,7 +840,6 @@ poly1305_blocks_neon: 
	 ldp	d14,d15,[sp,#64]

	addp	$ACC2,$ACC2,$ACC2

	 ldr	x30,[sp,#8]

	 .inst	0xd50323bf		// autiasp



	////////////////////////////////////////////////////////////////

	// lazy reduction, but without narrowing
@@ -882,6 +881,7 @@ poly1305_blocks_neon: 
	str	x4,[$ctx,#8]		// set is_base2_26



	ldr	x29,[sp],#80

	 .inst	0xd50323bf		// autiasp

	ret

.size	poly1305_blocks_neon,.-poly1305_blocks_neon

arch/arm64/crypto/poly1305-core.S_shipped

+1 −1
Original line number Diff line number Diff line
@@ -779,7 +779,6 @@ poly1305_blocks_neon: 
	 ldp	d14,d15,[sp,#64]

	addp	v21.2d,v21.2d,v21.2d

	 ldr	x30,[sp,#8]

	 .inst	0xd50323bf		// autiasp



	////////////////////////////////////////////////////////////////

	// lazy reduction, but without narrowing
@@ -821,6 +820,7 @@ poly1305_blocks_neon: 
	str	x4,[x0,#8]		// set is_base2_26



	ldr	x29,[sp],#80

	 .inst	0xd50323bf		// autiasp

	ret

.size	poly1305_blocks_neon,.-poly1305_blocks_neon