Fix undefined behaviour in keccak4x #919
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There are two uint64_t arrays declared in
KeccakP-1600-times4-SIMD256.c
that are accessed using_mm256_load_si256
but are not guaranteed to have 32 byte alignment.This is (likely) the undefined behaviour detected by UBSan in #791.
The first commit of this PR fixes the alignment with a union type. The second commit backports some minor changes to the definitions of other macros in
KeccakP-1600-times4-SIMD256.c
from XKCP. Only the first commit is related to the undefined behaviour.The UB issue is also present in XKCP, PQClean, and in our
src/kem/kyber/pqcrystals-kyber_common_avx2
. However it only manifests when the rho arrays are misaligned at compile time.With the compilers I've tested, the arrays are correctly aligned when
KeccakP-1600-times4-SIMD256.c
is its own compilation unit. That's why, as Basil mentioned in the comments of #791, UBSan does not flag the new Kyber code.We just happened to get unlucky with the layout of data sections when we included
KeccakP-1600-times4-SIMD256.c
intosrc/common/sha3/sha3x4_avx2.c
. The situation could reverse with a compiler update, etc, so we should leave #791 open until it's fixed in Kyber or we switch Kyber over to common keccak4x.