Daily update · Oct 14–15, 2026
Poly1305 fixes: ARM64 carry bug and explicit key zeroing
A small crypto update fixes a lost-carry bug in the ARM64 NEON Poly1305 path and adds a regression test.
In brief
These commits touch the kernel's Poly1305 library code. The main fix addresses an ARM64 NEON path bug that could drop a carry when resuming from a split update, producing an incorrect authentication tag. A new KUnit test covers that case, and poly1305_final() now uses memzero_explicit() to guarantee state zeroization.
Bug fixes
ARM64 Poly1305: fix lost carry when resuming NEON state
When the NEON code resumes from a base-2^26 accumulator and the next chunk has an odd number of full 16-byte blocks, it converts to base-2^64 form. The final ADC of that conversion stores the carry into d2, but the following accumulation and poly1305_mult() use h2, so a carry above bit 128 is dropped and the emitted tag can be wrong.
Why it matters: Correctness fix for ARM64 Poly1305 when updates are split across multiple calls; without it, an incorrect authentication tag could be produced.
Poly1305 final: use memzero_explicit() to clear context
poly1305_final() previously cleared the descriptor with a plain struct assignment, which could theoretically be optimized away by dead store elimination under LTO. Replacing it with memzero_explicit() guarantees the state is actually zeroized.
Why it matters: Ensures sensitive Poly1305 state is erased after use; no actual compiler-driven leak is known to have occurred, but the theoretical risk is removed.
Tests
Add Poly1305 split-update carry regression test
Adds a KUnit test case that reproduces the lost-carry bug fixed in the ARM64 NEON path. It is written generally so it can also catch similar issues in other Poly1305 implementations.
Why it matters: Prevents recurrence of this class of bug and helps validate future Poly1305 changes.
Source commits3 entries +
lib/crypto: poly1305: Use memzero_explicit() in poly1305_final()
Eric Biggers · Oct 6, 2026 · 1 files
lib/crypto: arm64: Fix lost Poly1305 carry when resuming NEON state
Jérémy Jean · Oct 9, 2026 · 1 files
lib/crypto: tests: Add Poly1305 split-update carry regression test
Eric Biggers · Oct 9, 2026 · 1 files