Fix riscv64 carry bug in SM2 modulo reduction

Fixes #28731

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28746)

diff --git a/crypto/ec/asm/ecp_sm2p256-riscv64.pl b/crypto/ec/asm/ecp_sm2p256-riscv64.pl
index 0fb167530278022970cf9ccd0fdd05b94afc2dbe..2a17e124dc45b7c833bebc4a19a2750e0a474dc5 100644 (file)
--- a/crypto/ec/asm/ecp_sm2p256-riscv64.pl
+++ b/crypto/ec/asm/ecp_sm2p256-riscv64.pl
@@ -881,6 +881,7 @@ $code.=<<___;
        add $t1, $t1, $s6
        sltu $c2, $t1, $s6
        add $t1, $t1, $c1
+       sltu $c1, $t1, $c1
        add $c1, $c1, $c2
        add $t2, $t2, $c1
        sltu $c1, $t2, $c1