mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-20 22:23:27 +00:00
d540725871
Without this patch, the chacha block counter is not incremented on neon rounds, resulting in incorrect calculations and corrupt packets. This also switches to using `--no-numbered --zero-commit` so that future diffs are smaller. Reported-by: Hans Geiblinger <cybrnook2002@yahoo.com> Reviewed-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com> Cc: David Bauer <mail@david-bauer.net> Cc: Petr Štetiar <ynezz@true.cz> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
39 lines
1.6 KiB
Diff
39 lines
1.6 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Ard Biesheuvel <ardb@kernel.org>
|
|
Date: Sun, 13 Dec 2020 15:39:29 +0100
|
|
Subject: [PATCH] crypto: arm/chacha-neon - add missing counter increment
|
|
|
|
commit fd16931a2f518a32753920ff20895e5cf04c8ff1 upstream.
|
|
|
|
Commit 86cd97ec4b943af3 ("crypto: arm/chacha-neon - optimize for non-block
|
|
size multiples") refactored the chacha block handling in the glue code in
|
|
a way that may result in the counter increment to be omitted when calling
|
|
chacha_block_xor_neon() to process a full block. This violates the skcipher
|
|
API, which requires that the output IV is suitable for handling more input
|
|
as long as the preceding input has been presented in round multiples of the
|
|
block size. Also, the same code is exposed via the chacha library interface
|
|
whose callers may actually rely on this increment to occur even for final
|
|
blocks that are smaller than the chacha block size.
|
|
|
|
So increment the counter after calling chacha_block_xor_neon().
|
|
|
|
Fixes: 86cd97ec4b943af3 ("crypto: arm/chacha-neon - optimize for non-block size multiples")
|
|
Reported-by: Eric Biggers <ebiggers@kernel.org>
|
|
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
|
|
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
---
|
|
arch/arm/crypto/chacha-glue.c | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
--- a/arch/arm/crypto/chacha-glue.c
|
|
+++ b/arch/arm/crypto/chacha-glue.c
|
|
@@ -60,6 +60,7 @@ static void chacha_doneon(u32 *state, u8
|
|
chacha_block_xor_neon(state, d, s, nrounds);
|
|
if (d != dst)
|
|
memcpy(dst, buf, bytes);
|
|
+ state[12]++;
|
|
}
|
|
}
|
|
|