| From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 |
| From: Ard Biesheuvel <ardb@kernel.org> |
| Date: Sun, 13 Dec 2020 15:39:29 +0100 |
| Subject: [PATCH] crypto: arm/chacha-neon - add missing counter increment |
| |
| commit fd16931a2f518a32753920ff20895e5cf04c8ff1 upstream. |
| |
| Commit 86cd97ec4b943af3 ("crypto: arm/chacha-neon - optimize for non-block |
| size multiples") refactored the chacha block handling in the glue code in |
| a way that may result in the counter increment to be omitted when calling |
| chacha_block_xor_neon() to process a full block. This violates the skcipher |
| API, which requires that the output IV is suitable for handling more input |
| as long as the preceding input has been presented in round multiples of the |
| block size. Also, the same code is exposed via the chacha library interface |
| whose callers may actually rely on this increment to occur even for final |
| blocks that are smaller than the chacha block size. |
| |
| So increment the counter after calling chacha_block_xor_neon(). |
| |
| Fixes: 86cd97ec4b943af3 ("crypto: arm/chacha-neon - optimize for non-block size multiples") |
| Reported-by: Eric Biggers <ebiggers@kernel.org> |
| Signed-off-by: Ard Biesheuvel <ardb@kernel.org> |
| Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> |
| Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> |
| --- |
| arch/arm/crypto/chacha-glue.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| --- a/arch/arm/crypto/chacha-glue.c |
| +++ b/arch/arm/crypto/chacha-glue.c |
| @@ -60,6 +60,7 @@ static void chacha_doneon(u32 *state, u8 |
| chacha_block_xor_neon(state, d, s, nrounds); |
| if (d != dst) |
| memcpy(dst, buf, bytes); |
| + state[12]++; |
| } |
| } |
| |