[PATCH] crypto: sha256_ssse3 - fix stack corruption with SSSE3 and AVX implementations

[PATCH] crypto: sha256_ssse3 - fix stack corruption with SSSE3 and AVX implementations

[Jussi Kivilinna]

The _XFER stack element size was set too small, 8 bytes, when it needs to be
16 bytes. As _XFER is the last stack element used by these implementations,
the 16 byte stores with 'movdqa' corrupt the stack where the value of register
%r12 is temporarily stored. As these implementations align the stack pointer
to 16 bytes, this corruption did not happen every time.

Patch corrects this issue.

Reported-by: Julian Wollrath <jwollrath@web.de>
Cc: Tim Chen <tim.c.chen@linux.intel.com>
Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
---
 arch/x86/crypto/sha256-avx-asm.S   |    2 +-
 arch/x86/crypto/sha256-ssse3-asm.S |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/crypto/sha256-avx-asm.S b/arch/x86/crypto/sha256-avx-asm.S
index 56610c4..642f156 100644
--- a/arch/x86/crypto/sha256-avx-asm.S
+++ b/arch/x86/crypto/sha256-avx-asm.S
@@ -118,7 +118,7 @@ y2 = %r15d
 
 _INP_END_SIZE = 8
 _INP_SIZE = 8
-_XFER_SIZE = 8
+_XFER_SIZE = 16
 _XMM_SAVE_SIZE = 0
 
 _INP_END = 0
diff --git a/arch/x86/crypto/sha256-ssse3-asm.S b/arch/x86/crypto/sha256-ssse3-asm.S
index 98d3c39..f833b74 100644
--- a/arch/x86/crypto/sha256-ssse3-asm.S
+++ b/arch/x86/crypto/sha256-ssse3-asm.S
@@ -111,7 +111,7 @@ y2 = %r15d
 
 _INP_END_SIZE = 8
 _INP_SIZE = 8
-_XFER_SIZE = 8
+_XFER_SIZE = 16
 _XMM_SAVE_SIZE = 0
 
 _INP_END = 0

Re: [PATCH] crypto: sha256_ssse3 - fix stack corruption with SSSE3 and AVX implementations

[Julian Wollrath]

Hi,

> The _XFER stack element size was set too small, 8 bytes, when it
> needs to be 16 bytes. As _XFER is the last stack element used by
> these implementations, the 16 byte stores with 'movdqa' corrupt the
> stack where the value of register %r12 is temporarily stored. As
> these implementations align the stack pointer to 16 bytes, this
> corruption did not happen every time.
> 
> Patch corrects this issue.
> 
> Reported-by: Julian Wollrath <jwollrath@web.de>
> Cc: Tim Chen <tim.c.chen@linux.intel.com>
> Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
Tested-by: Julian Wollrath <jwollrath@web.de>

Thank you for fixing this issue.

Best regards,
Julian Wollrath
> ---
>  arch/x86/crypto/sha256-avx-asm.S   |    2 +-
>  arch/x86/crypto/sha256-ssse3-asm.S |    2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/x86/crypto/sha256-avx-asm.S
> b/arch/x86/crypto/sha256-avx-asm.S index 56610c4..642f156 100644
> --- a/arch/x86/crypto/sha256-avx-asm.S
> +++ b/arch/x86/crypto/sha256-avx-asm.S
> @@ -118,7 +118,7 @@ y2 = %r15d
>  
>  _INP_END_SIZE = 8
>  _INP_SIZE = 8
> -_XFER_SIZE = 8
> +_XFER_SIZE = 16
>  _XMM_SAVE_SIZE = 0
>  
>  _INP_END = 0
> diff --git a/arch/x86/crypto/sha256-ssse3-asm.S
> b/arch/x86/crypto/sha256-ssse3-asm.S index 98d3c39..f833b74 100644
> --- a/arch/x86/crypto/sha256-ssse3-asm.S
> +++ b/arch/x86/crypto/sha256-ssse3-asm.S
> @@ -111,7 +111,7 @@ y2 = %r15d
>  
>  _INP_END_SIZE = 8
>  _INP_SIZE = 8
> -_XFER_SIZE = 8
> +_XFER_SIZE = 16
>  _XMM_SAVE_SIZE = 0
>  
>  _INP_END = 0
> 

Re: [PATCH] crypto: sha256_ssse3 - fix stack corruption with SSSE3 and AVX implementations

[Tim Chen]

On Tue, 2013-05-21 at 17:09 +0300, Jussi Kivilinna wrote:
> The _XFER stack element size was set too small, 8 bytes, when it needs to be
> 16 bytes. As _XFER is the last stack element used by these implementations,
> the 16 byte stores with 'movdqa' corrupt the stack where the value of register
> %r12 is temporarily stored. As these implementations align the stack pointer
> to 16 bytes, this corruption did not happen every time.
> 
> Patch corrects this issue.

Thanks for catching and fixing the issue.

Acked-by: Tim Chen <tim.c.chen@linux.intel.com>

Tim

Re: [PATCH] crypto: sha256_ssse3 - fix stack corruption with SSSE3 and AVX implementations

[Herbert Xu]

On Wed, May 22, 2013 at 05:32:04PM -0700, Tim Chen wrote:
> On Tue, 2013-05-21 at 17:09 +0300, Jussi Kivilinna wrote:
> > The _XFER stack element size was set too small, 8 bytes, when it needs to be
> > 16 bytes. As _XFER is the last stack element used by these implementations,
> > the 16 byte stores with 'movdqa' corrupt the stack where the value of register
> > %r12 is temporarily stored. As these implementations align the stack pointer
> > to 16 bytes, this corruption did not happen every time.
> > 
> > Patch corrects this issue.
> 
> Thanks for catching and fixing the issue.
> 
> Acked-by: Tim Chen <tim.c.chen@linux.intel.com>

Patch applied.  Thanks!
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt