PAC pointer authentication signs the return address against the value
of the stack pointer, to prevent stack overrun exploits from corrupting
the control flow. However, this requires that the AUTIASP is issued with
SP holding the same value as it held when the PAC value was generated.
The Poly1305 NEON code got this wrong, resulting in crashes on PAC
capable hardware.
Fixes: f569ca164751 ("crypto: arm64/poly1305 - incorporate OpenSSL/CRYPTOGAMS ...")
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Bug: 152722841
Link: https://lore.kernel.org/linux-crypto/20201026230027.25813-1-ardb@kernel.org/
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Change-Id: Ib5282ac56ba5158c7d97195c2460701006bf82f6
4fc615abdd