Skip to contentSkip to conversation

crypto: arm64/poly1305-neon - reorder PAC authentication with SP update

PATCH Applied Ard Biesheuvel 4 participants 6 messages Oct 26, 2020 – Nov 6, 2020

Subsystems (2)
Crypto API arm64
lore
Share & tools
lore

Ard Biesheuvel

author
#0 lore raw

PATCH 1/1 crypto: arm64/poly1305-neon - reorder PAC authentication with SP update

PAC pointer authentication signs the return address against the value of the stack pointer, to prevent stack overrun exploits from corrupting the control flow. However, this requires that the AUTIASP is issued with SP holding the same value as it held when the PAC value was generated. The Poly1305 NEON code got this wrong, resulting in crashes on PAC capable hardware.

Fixes f569ca164751 ("crypto: arm64/poly1305 - incorporate OpenSSL/CRYPTOGAMS ...")
Signed-off-by Ard Biesheuvel <[email protected]>
---
 arch/arm64/crypto/poly1305-armv8.pl       | 2 +-
 arch/arm64/crypto/poly1305-core.S_shipped | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
arch/arm64/crypto/poly1305-armv8.pl +1 -1
index 6e5576d19af8..cbc980fb02e3 100644
@@ -840,7 +840,6 @@ poly1305_blocks_neon:
 	 ldp	d14,d15,[sp,#64]
 	addp	$ACC2,$ACC2,$ACC2
 	 ldr	x30,[sp,#8]
-	 .inst	0xd50323bf		// autiasp
 
 	////////////////////////////////////////////////////////////////
 	// lazy reduction, but without narrowing

@@ -882,6 +881,7 @@ poly1305_blocks_neon:
 	str	x4,[$ctx,#8]		// set is_base2_26
 
 	ldr	x29,[sp],#80
+	 .inst	0xd50323bf		// autiasp
 	ret
 .size	poly1305_blocks_neon,.-poly1305_blocks_neon
arch/arm64/crypto/poly1305-core.S_shipped +1 -1
index 8d1c4e420ccd..fb2822abf63a 100644
@@ -779,7 +779,6 @@ poly1305_blocks_neon:
 	 ldp	d14,d15,[sp,#64]
 	addp	v21.2d,v21.2d,v21.2d
 	 ldr	x30,[sp,#8]
-	 .inst	0xd50323bf		// autiasp
 
 	////////////////////////////////////////////////////////////////
 	// lazy reduction, but without narrowing

@@ -821,6 +820,7 @@ poly1305_blocks_neon:
 	str	x4,[x0,#8]		// set is_base2_26
 
 	ldr	x29,[sp],#80
+	 .inst	0xd50323bf		// autiasp
 	ret
 .size	poly1305_blocks_neon,.-poly1305_blocks_neon
Signature · 1 line
2.17.1
#1 lore raw
Quoted 7 lines · Ard Biesheuvel

PAC pointer authentication signs the return address against the value of the stack pointer, to prevent stack overrun exploits from corrupting the control flow. However, this requires that the AUTIASP is issued with SP holding the same value as it held when the PAC value was generated. The Poly1305 NEON code got this wrong, resulting in crashes on PAC capable hardware.

Quoted 6 lines
Fixes f569ca164751 ("crypto: arm64/poly1305 - incorporate OpenSSL/CRYPTOGAMS ...")
Signed-off-by Ard Biesheuvel <[email protected]>
---
 arch/arm64/crypto/poly1305-armv8.pl       | 2 +-
 arch/arm64/crypto/poly1305-core.S_shipped | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

This needs to be fixed at https://github.com/dot-asm/cryptogams too, I assume?

- Eric

author
#2 lore raw
Quoted 9 lines · Eric Biggers
Quoted 7 lines · Ard Biesheuvel

PAC pointer authentication signs the return address against the value of the stack pointer, to prevent stack overrun exploits from corrupting the control flow. However, this requires that the AUTIASP is issued with SP holding the same value as it held when the PAC value was generated. The Poly1305 NEON code got this wrong, resulting in crashes on PAC capable hardware.

Quoted 9 lines
Quoted 6 lines
Fixes f569ca164751 ("crypto: arm64/poly1305 - incorporate OpenSSL/CRYPTOGAMS ...")
Signed-off-by Ard Biesheuvel <[email protected]>
---
 arch/arm64/crypto/poly1305-armv8.pl       | 2 +-
 arch/arm64/crypto/poly1305-core.S_shipped | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

This needs to be fixed at https://github.com/dot-asm/cryptogams too, I assume?

Yes, and in OpenSSL.

author
#3 lore raw

(+ Andy)

Quoted 22 lines · Ard Biesheuvel
Quoted 9 lines · Eric Biggers
Quoted 7 lines · Ard Biesheuvel

PAC pointer authentication signs the return address against the value of the stack pointer, to prevent stack overrun exploits from corrupting the control flow. However, this requires that the AUTIASP is issued with SP holding the same value as it held when the PAC value was generated. The Poly1305 NEON code got this wrong, resulting in crashes on PAC capable hardware.

Quoted 9 lines
Quoted 6 lines
Fixes f569ca164751 ("crypto: arm64/poly1305 - incorporate OpenSSL/CRYPTOGAMS ...")
Signed-off-by Ard Biesheuvel <[email protected]>
---
 arch/arm64/crypto/poly1305-armv8.pl       | 2 +-
 arch/arm64/crypto/poly1305-core.S_shipped | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

This needs to be fixed at https://github.com/dot-asm/cryptogams too, I assume?

Yes, and in OpenSSL.

Applied
#4 lore raw
Quoted 1 line

(+ Andy)

Thanks! Applied to cryptogams, pinged openssl. Cheers.

maintainer
#5 lore raw
In reply to Ard Biesheuvel
Quoted 7 lines · Ard Biesheuvel

PAC pointer authentication signs the return address against the value of the stack pointer, to prevent stack overrun exploits from corrupting the control flow. However, this requires that the AUTIASP is issued with SP holding the same value as it held when the PAC value was generated. The Poly1305 NEON code got this wrong, resulting in crashes on PAC capable hardware.

Quoted 6 lines
Fixes f569ca164751 ("crypto: arm64/poly1305 - incorporate OpenSSL/CRYPTOGAMS ...")
Signed-off-by Ard Biesheuvel <[email protected]>
---
 arch/arm64/crypto/poly1305-armv8.pl       | 2 +-
 arch/arm64/crypto/poly1305-core.S_shipped | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

Patch applied. Thanks.

Signature · 3 lines
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt