|
 |
fd2893 |
From ca51bafc1a88d8b8348f5fd97adc5d6ca93f8e76 Mon Sep 17 00:00:00 2001
|
|
|
fd2893 |
From: Andy Polyakov <appro@openssl.org>
|
|
|
fd2893 |
Date: Fri, 24 Nov 2017 11:35:50 +0100
|
|
|
fd2893 |
Subject: [PATCH] bn/asm/rsaz-avx2.pl: fix digit correction bug in
|
|
|
fd2893 |
rsaz_1024_mul_avx2.
|
|
|
fd2893 |
|
|
|
fd2893 |
Credit to OSS-Fuzz for finding this.
|
|
|
fd2893 |
|
|
|
fd2893 |
CVE-2017-3738
|
|
|
fd2893 |
|
|
|
fd2893 |
Reviewed-by: Rich Salz <rsalz@openssl.org>
|
|
|
fd2893 |
---
|
|
|
fd2893 |
crypto/bn/asm/rsaz-avx2.pl | 15 +++++++--------
|
|
|
fd2893 |
1 file changed, 7 insertions(+), 8 deletions(-)
|
|
|
fd2893 |
|
|
|
fd2893 |
diff --git a/crypto/bn/asm/rsaz-avx2.pl b/crypto/bn/asm/rsaz-avx2.pl
|
|
|
fd2893 |
index 712a77f..2b3f8b0 100755
|
|
|
fd2893 |
--- a/crypto/bn/asm/rsaz-avx2.pl
|
|
|
fd2893 |
+++ b/crypto/bn/asm/rsaz-avx2.pl
|
|
|
fd2893 |
@@ -239,7 +239,7 @@ $code.=<<___;
|
|
|
fd2893 |
vmovdqu 32*8-128($ap), $ACC8
|
|
|
fd2893 |
|
|
|
fd2893 |
lea 192(%rsp), $tp0 # 64+128=192
|
|
|
fd2893 |
- vpbroadcastq .Land_mask(%rip), $AND_MASK
|
|
|
fd2893 |
+ vmovdqu .Land_mask(%rip), $AND_MASK
|
|
|
fd2893 |
jmp .LOOP_GRANDE_SQR_1024
|
|
|
fd2893 |
|
|
|
fd2893 |
.align 32
|
|
|
fd2893 |
@@ -1070,10 +1070,10 @@ $code.=<<___;
|
|
|
fd2893 |
vpmuludq 32*6-128($np),$Yi,$TEMP1
|
|
|
fd2893 |
vpaddq $TEMP1,$ACC6,$ACC6
|
|
|
fd2893 |
vpmuludq 32*7-128($np),$Yi,$TEMP2
|
|
|
fd2893 |
- vpblendd \$3, $ZERO, $ACC9, $ACC9 # correct $ACC3
|
|
|
fd2893 |
+ vpblendd \$3, $ZERO, $ACC9, $TEMP1 # correct $ACC3
|
|
|
fd2893 |
vpaddq $TEMP2,$ACC7,$ACC7
|
|
|
fd2893 |
vpmuludq 32*8-128($np),$Yi,$TEMP0
|
|
|
fd2893 |
- vpaddq $ACC9, $ACC3, $ACC3 # correct $ACC3
|
|
|
fd2893 |
+ vpaddq $TEMP1, $ACC3, $ACC3 # correct $ACC3
|
|
|
fd2893 |
vpaddq $TEMP0,$ACC8,$ACC8
|
|
|
fd2893 |
|
|
|
fd2893 |
mov %rbx, %rax
|
|
|
fd2893 |
@@ -1086,7 +1086,9 @@ $code.=<<___;
|
|
|
fd2893 |
vmovdqu -8+32*2-128($ap),$TEMP2
|
|
|
fd2893 |
|
|
|
fd2893 |
mov $r1, %rax
|
|
|
fd2893 |
+ vpblendd \$0xfc, $ZERO, $ACC9, $ACC9 # correct $ACC3
|
|
|
fd2893 |
imull $n0, %eax
|
|
|
fd2893 |
+ vpaddq $ACC9,$ACC4,$ACC4 # correct $ACC3
|
|
|
fd2893 |
and \$0x1fffffff, %eax
|
|
|
fd2893 |
|
|
|
fd2893 |
imulq 16-128($ap),%rbx
|
|
|
fd2893 |
@@ -1322,15 +1324,12 @@ ___
|
|
|
fd2893 |
# But as we underutilize resources, it's possible to correct in
|
|
|
fd2893 |
# each iteration with marginal performance loss. But then, as
|
|
|
fd2893 |
# we do it in each iteration, we can correct less digits, and
|
|
|
fd2893 |
-# avoid performance penalties completely. Also note that we
|
|
|
fd2893 |
-# correct only three digits out of four. This works because
|
|
|
fd2893 |
-# most significant digit is subjected to less additions.
|
|
|
fd2893 |
+# avoid performance penalties completely.
|
|
|
fd2893 |
|
|
|
fd2893 |
$TEMP0 = $ACC9;
|
|
|
fd2893 |
$TEMP3 = $Bi;
|
|
|
fd2893 |
$TEMP4 = $Yi;
|
|
|
fd2893 |
$code.=<<___;
|
|
|
fd2893 |
- vpermq \$0, $AND_MASK, $AND_MASK
|
|
|
fd2893 |
vpaddq (%rsp), $TEMP1, $ACC0
|
|
|
fd2893 |
|
|
|
fd2893 |
vpsrlq \$29, $ACC0, $TEMP1
|
|
|
fd2893 |
@@ -1763,7 +1762,7 @@ $code.=<<___;
|
|
|
fd2893 |
|
|
|
fd2893 |
.align 64
|
|
|
fd2893 |
.Land_mask:
|
|
|
fd2893 |
- .quad 0x1fffffff,0x1fffffff,0x1fffffff,-1
|
|
|
fd2893 |
+ .quad 0x1fffffff,0x1fffffff,0x1fffffff,0x1fffffff
|
|
|
fd2893 |
.Lscatter_permd:
|
|
|
fd2893 |
.long 0,2,4,6,7,7,7,7
|
|
|
fd2893 |
.Lgather_permd:
|
|
|
fd2893 |
--
|
|
|
fd2893 |
2.9.5
|
|
|
fd2893 |
|