target/linux/generic/backport-5.4/080-wireguard-0071-crypto-arm-chacha-neon-add-missing-counter-increment.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: Ard Biesheuvel <ardb@kernel.org>
   3 Date: Sun, 13 Dec 2020 15:39:29 +0100
   4 Subject: [PATCH] crypto: arm/chacha-neon - add missing counter increment
   5
   6 commit fd16931a2f518a32753920ff20895e5cf04c8ff1 upstream.
   7
   8 Commit 86cd97ec4b943af3 ("crypto: arm/chacha-neon - optimize for non-block
   9 size multiples") refactored the chacha block handling in the glue code in
  10 a way that may result in the counter increment to be omitted when calling
  11 chacha_block_xor_neon() to process a full block. This violates the skcipher
  12 API, which requires that the output IV is suitable for handling more input
  13 as long as the preceding input has been presented in round multiples of the
  14 block size. Also, the same code is exposed via the chacha library interface
  15 whose callers may actually rely on this increment to occur even for final
  16 blocks that are smaller than the chacha block size.
  17
  18 So increment the counter after calling chacha_block_xor_neon().
  19
  20 Fixes: 86cd97ec4b943af3 ("crypto: arm/chacha-neon - optimize for non-block size multiples")
  21 Reported-by: Eric Biggers <ebiggers@kernel.org>
  22 Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
  23 Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
  24 Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
  25 ---
  26  arch/arm/crypto/chacha-glue.c | 1 +
  27  1 file changed, 1 insertion(+)
  28
  29 --- a/arch/arm/crypto/chacha-glue.c
  30 +++ b/arch/arm/crypto/chacha-glue.c
  31 @@ -60,6 +60,7 @@ static void chacha_doneon(u32 *state, u8
  32                 chacha_block_xor_neon(state, d, s, nrounds);
  33                 if (d != dst)
  34                         memcpy(dst, buf, bytes);
  35 +               state[12]++;
  36         }
  37  }
  38