[RFC/RFT PATCH 01/15] crypto: aegis - fix handling chunked inputs

[Eric Biggers]

From: Eric Biggers <ebigg...@google.com>

The generic AEGIS implementations all fail the improved AEAD tests
because they produce the wrong result with some data layouts.  Fix them.

Fixes: f606a88e5823 ("crypto: aegis - Add generic AEGIS AEAD implementations")
Cc: <sta...@vger.kernel.org> # v4.18+
Cc: Ondrej Mosnacek <omosn...@redhat.com>
Signed-off-by: Eric Biggers <ebigg...@google.com>
---
 crypto/aegis128.c  | 14 +++++++-------
 crypto/aegis128l.c | 14 +++++++-------
 crypto/aegis256.c  | 14 +++++++-------
 3 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/crypto/aegis128.c b/crypto/aegis128.c
index c22f4414856d..789716f92e4c 100644
--- a/crypto/aegis128.c
+++ b/crypto/aegis128.c
@@ -290,19 +290,19 @@ static void crypto_aegis128_process_crypt(struct 
aegis_state *state,
                                          const struct aegis128_ops *ops)
 {
        struct skcipher_walk walk;
-       u8 *src, *dst;
-       unsigned int chunksize;
 
        ops->skcipher_walk_init(&walk, req, false);
 
        while (walk.nbytes) {
-               src = walk.src.virt.addr;
-               dst = walk.dst.virt.addr;
-               chunksize = walk.nbytes;
+               unsigned int nbytes = walk.nbytes;
 
-               ops->crypt_chunk(state, dst, src, chunksize);
+               if (nbytes < walk.total)
+                       nbytes = round_down(nbytes, walk.stride);
 
-               skcipher_walk_done(&walk, 0);
+               ops->crypt_chunk(state, walk.dst.virt.addr, walk.src.virt.addr,
+                                nbytes);
+
+               skcipher_walk_done(&walk, walk.nbytes - nbytes);
        }
 }
 
diff --git a/crypto/aegis128l.c b/crypto/aegis128l.c
index b6fb21ebdc3e..73811448cb6b 100644
--- a/crypto/aegis128l.c
+++ b/crypto/aegis128l.c
@@ -353,19 +353,19 @@ static void crypto_aegis128l_process_crypt(struct 
aegis_state *state,
                                           const struct aegis128l_ops *ops)
 {
        struct skcipher_walk walk;
-       u8 *src, *dst;
-       unsigned int chunksize;
 
        ops->skcipher_walk_init(&walk, req, false);
 
        while (walk.nbytes) {
-               src = walk.src.virt.addr;
-               dst = walk.dst.virt.addr;
-               chunksize = walk.nbytes;
+               unsigned int nbytes = walk.nbytes;
 
-               ops->crypt_chunk(state, dst, src, chunksize);
+               if (nbytes < walk.total)
+                       nbytes = round_down(nbytes, walk.stride);
 
-               skcipher_walk_done(&walk, 0);
+               ops->crypt_chunk(state, walk.dst.virt.addr, walk.src.virt.addr,
+                                nbytes);
+
+               skcipher_walk_done(&walk, walk.nbytes - nbytes);
        }
 }
 
diff --git a/crypto/aegis256.c b/crypto/aegis256.c
index 11f0f8ec9c7c..8a71e9c06193 100644
--- a/crypto/aegis256.c
+++ b/crypto/aegis256.c
@@ -303,19 +303,19 @@ static void crypto_aegis256_process_crypt(struct 
aegis_state *state,
                                          const struct aegis256_ops *ops)
 {
        struct skcipher_walk walk;
-       u8 *src, *dst;
-       unsigned int chunksize;
 
        ops->skcipher_walk_init(&walk, req, false);
 
        while (walk.nbytes) {
-               src = walk.src.virt.addr;
-               dst = walk.dst.virt.addr;
-               chunksize = walk.nbytes;
+               unsigned int nbytes = walk.nbytes;
 
-               ops->crypt_chunk(state, dst, src, chunksize);
+               if (nbytes < walk.total)
+                       nbytes = round_down(nbytes, walk.stride);
 
-               skcipher_walk_done(&walk, 0);
+               ops->crypt_chunk(state, walk.dst.virt.addr, walk.src.virt.addr,
+                                nbytes);
+
+               skcipher_walk_done(&walk, walk.nbytes - nbytes);
        }
 }
 
-- 
2.20.1.321.g9e740568ce-goog