crypto: arm64/poly1305-neon - reorder PAC authentication with SP update

PAC pointer authentication signs the return address against the value
of the stack pointer, to prevent stack overrun exploits from corrupting
the control flow. However, this requires that the AUTIASP is issued with
SP holding the same value as it held when the PAC value was generated.
The Poly1305 NEON code got this wrong, resulting in crashes on PAC
capable hardware.

Fixes: f569ca164751 ("crypto: arm64/poly1305 - incorporate OpenSSL/CRYPTOGAMS ...")
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/arch/arm64/crypto/poly1305-armv8.pl b/arch/arm64/crypto/poly1305-armv8.pl
index 6e5576d19af8fcb7bfbf357330519b39cac5f677..cbc980fb02e3357feb25aad8f93c1ec86c11247d 100644 (file)
--- a/arch/arm64/crypto/poly1305-armv8.pl
+++ b/arch/arm64/crypto/poly1305-armv8.pl
@@ -840,7 +840,6 @@ poly1305_blocks_neon:
         ldp    d14,d15,[sp,#64]
        addp    $ACC2,$ACC2,$ACC2
         ldr    x30,[sp,#8]
-        .inst  0xd50323bf              // autiasp
 
        ////////////////////////////////////////////////////////////////
        // lazy reduction, but without narrowing
@@ -882,6 +881,7 @@ poly1305_blocks_neon:
        str     x4,[$ctx,#8]            // set is_base2_26
 
        ldr     x29,[sp],#80
+        .inst  0xd50323bf              // autiasp
        ret
 .size  poly1305_blocks_neon,.-poly1305_blocks_neon
 

diff --git a/arch/arm64/crypto/poly1305-core.S_shipped b/arch/arm64/crypto/poly1305-core.S_shipped
index 8d1c4e420ccdc75cf4a974d29990713dd7028849..fb2822abf63aa709c91eb3f9e4868fbd6918c955 100644 (file)
--- a/arch/arm64/crypto/poly1305-core.S_shipped
+++ b/arch/arm64/crypto/poly1305-core.S_shipped
@@ -779,7 +779,6 @@ poly1305_blocks_neon:
         ldp    d14,d15,[sp,#64]
        addp    v21.2d,v21.2d,v21.2d
         ldr    x30,[sp,#8]
-        .inst  0xd50323bf              // autiasp
 
        ////////////////////////////////////////////////////////////////
        // lazy reduction, but without narrowing
@@ -821,6 +820,7 @@ poly1305_blocks_neon:
        str     x4,[x0,#8]              // set is_base2_26
 
        ldr     x29,[sp],#80
+        .inst  0xd50323bf              // autiasp
        ret
 .size  poly1305_blocks_neon,.-poly1305_blocks_neon