mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-10-26 10:57:38 +08:00
Vladimir Kukharenko
f92159895b
chacha_doarm() compares the remaining length with signed conditions (blt, movle/movgt, bgt), and DIV_ROUND_UP(bytes, CHACHA_BLOCK_SIZE) in chacha_crypt_arch() wraps above 0xffffffc0, so lengths of 2 GiB or more are mishandled. size_t is 32 bits on arm, so declaring the length as size_t does not avoid this. On a Cortex-A7, an in-place chacha20_crypt() of 2 GiB + 4101 bytes changed only one byte. Use unsigned conditions (blo, movls/movhi, bhi) and DIV_ROUND_UP_POW2(). This affects the scalar code, which is used when NEON isn't usable and always on Cortex-A5 and Cortex-A7. No in-tree caller passes such lengths. Tested in QEMU on a Cortex-A7 with CONFIG_VMSPLIT_1G. An LLM review of this code found the bug. Assisted-by: LLM Signed-off-by: Vladimir Kukharenko <vladimir@genproof.com> Link: https://patch.msgid.link/20261014-libcrypto-chacha-32bit-2gib-v1-1-e0719ca0be89@genproof.com Signed-off-by: Eric Biggers <ebiggers@kernel.org>