From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ed1-f54.google.com (mail-ed1-f54.google.com [209.85.208.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A82BB396597 for ; Fri, 7 Aug 2026 15:44:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.54 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786117463; cv=none; b=MAK781XpY6Lii5bHoSyXFJ4EkL1+jdF7mQxr2YpzEQSpDvKQp4cgvAt3U6eKUBA5i5uZytC4qEG9Ml6CK2vAf3eMNGP7U7DRFEjLIagWSwg7HUslXV+ycGB6ecUjJXGAbTg57JC+6fOwM1UMP6nTwqRXRd62yqrM90FoSZ3FT6o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786117463; c=relaxed/simple; bh=eHBUeNYAmYQqgSbomhjGrUI+jo6b4xG9p+7Unl8lsOU=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type: Content-Disposition; b=lzwKornONsrT1RWDZeMy6/+YQ02h5ClL7MAf06Yzx+qanAMR3TQVxtPkPwtgK1NyPRfdjpJglqkPH7Tqkc/2DhA3uCEhWDJd2qWvm9YM5hwZRBPK+3yp1kkB0mf4YpQySBXQB0qVYijLRQk2L8qmlm8kg19nbgy+xQftM5epxJg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com; spf=pass smtp.mailfrom=googlemail.com; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b=fIKm/Pfx; arc=none smtp.client-ip=209.85.208.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=googlemail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b="fIKm/Pfx" Received: by mail-ed1-f54.google.com with SMTP id 4fb4d7f45d1cf-6a156627e22so3266693a12.1 for ; Fri, 07 Aug 2026 08:44:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20251104; t=1786117460; x=1786722260; darn=vger.kernel.org; h=content-disposition:content-type:mime-version:message-id:subject:cc :to:from:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=jex9FjJ6TrVlpD/29LwZtxw48/lgu4Xc7Jori9zIbiQ=; b=fIKm/PfxZRrzTkazf6B7BKdp/Jj0u14wrKBvA9/mZMS6Di2Ia15ntVo+xZPzT7Yr3y CuYluY1QcVkq22B7gK8lXSfT2+6Vr8E7rd/nRlnH7/BmwbGb7GlY/hKFrhTL6vDZTv1V rIMLtVrQ+7UfWvX18Jjit8OqvN9nXX0lzV5wiuEcRA/q/gdW60EHmvjcUqv8j5qaeaIR SXanCqIqE2T17OCTq0S6T/X6f2kBiEr97/6bIGk5/j7O+f5+dc62pDZhDco3NWILlmF+ 8Z9oobdxgIyPCun7ARl0EVwlgyeE/E/zGnHDIwcqewSF1baZ7zxXusunmhI9t3PJCsaz YgCg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786117460; x=1786722260; h=content-disposition:content-type:mime-version:message-id:subject:cc :to:from:date:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=jex9FjJ6TrVlpD/29LwZtxw48/lgu4Xc7Jori9zIbiQ=; b=KMCi/xiiQII7eXOM34VRuGecRnkB8Dc0rCGW9ne8ha72EEbcdDEyI0gtkZ+RJpyvdS eO1c9GKM+F2OWG/4weeHWExXQ+P9OtVVVgyqJs81b/S1xK6+B9f4SlbF9lTuGqsSkbwB lqTAPiOOMXOfe1amUWQXsVfl4710MiX1x8z2QlyUuOLkOHmExNnvdX33OLa5dKu94F+u bdVfAUL9E1w/fK+PEe5Gj0+5IdBAeVK3n6P2e6MpZuOjW4M6uboNKulAQ/ocwvQAPZf2 jHdo/Pd3XlUbNwEvV3Dhwzhb44IfZdsHXXPMXAKA8ehBUnptAzXKhY6lsHsfUyeTJm3Z 8U2g== X-Forwarded-Encrypted: i=1; AHgh+Ro3kEWP7S6bqjO8sCu8Onv2z1JY1lPtNOZPNhbWmzOsVTEmqHdXaFvMWjCjtvW3gGD9FkPaQ6ktugukvrM=@vger.kernel.org X-Gm-Message-State: AOJu0YxjS3rwc8BjWBJYktjQUqUgGFvFVZcSjoHsJuUUh3yBM9nrU6os l4Xdvh87BRt3bMOrbD2/LTGWeoIvLBPrQ59fa4SUP6QuG38ypYaPDebd X-Gm-Gg: AR+sD10AqrBlEx6iCCVzXVEysmbKAbyk6PqNfZpz3Cw9ZSx5iXKTsLGHHp2upg34iHE BvTKvCVrS4lnXL29j8dsLiWUEHGwsTXTbn+MLOeBd9JPiD1HWSVZ9YcLIB3vq678yfiM53u+Rre 3V+uU79G8S/myb4ViHJOXIYZjZ2PLhtf2+Tp9CaeD6ZbBipEJvkwuoIxFHQfTSrmu7NMgapwvX4 TcCi/ht+zngWV5ecadZAfE6OWyXqmrPwkoY7SbCe5wDcXuCwBVzDVtiyO89TJySmpwH+jX8oEbk zXwXqnwHnPntoLmHw7MfhOQ+GtXa9Sjg1QSYkprYJncFeJYbphjQIy4Y3/DvehKLz8XjvJ8AfH+ TdDOiEgFYOAphukSJkyX+5Ep9oP1cnFHzGEBxptBQWjAWo6mut8njBYB4DWhyJrEMC76CaJUnRw uMkrRzqzBC0rtmpYBBokSpYph9fic4oUZEMA050MO3hGolqVcAj9ZGrPvuKsQP+GHe1ATVs9r5K eHhNZaRHm+MbZsUd4Ngv6ZT9+Hf X-Received: by 2002:a17:906:99d4:b0:c12:49d6:3c5b with SMTP id a640c23a62f3a-c2057fc248fmr744744966b.8.1786117459248; Fri, 07 Aug 2026 08:44:19 -0700 (PDT) Received: from fudgebox (k10193.upc-k.chello.nl. [62.108.10.193]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c2080cc3c80sm67378766b.47.2026.08.07.08.44.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 07 Aug 2026 08:44:18 -0700 (PDT) Date: Fri, 7 Aug 2026 17:44:16 +0200 From: "David C.C.M. Gall" To: Herbert Xu , "David S. Miller" , linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org Cc: gregkh@linuxfoundation.org Subject: [PATCH] crypto: sa2ul - use crypto_memneq() to compare AEAD tag Message-ID: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Use crypto_memneq() for a constant-time comparison. sa_aead_dma_in_callback() compares the computed authentication tag against the received tag with memcmp(), which short-circuits on the first differing byte. An attacker who can submit decrypt requests and observe completion latency could recover the expected tag byte by byte. Valid tag forgery for AEAD breaks the INT-CTXT guarantee. Assisted-by: gregkh_clanker_t1000 Signed-off-by: David C.C.M. Gall --- drivers/crypto/sa2ul.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/crypto/sa2ul.c b/drivers/crypto/sa2ul.c index 965a03d5b27a..7cdfc91670f7 100644 --- a/drivers/crypto/sa2ul.c +++ b/drivers/crypto/sa2ul.c @@ -22,6 +22,7 @@ #include #include +#include #include #include #include @@ -1688,7 +1689,7 @@ static void sa_aead_dma_in_callback(void *data) scatterwalk_map_and_copy(auth_tag, req->src, start, authsize, 0); - err = memcmp(&mdptr[4], auth_tag, authsize) ? -EBADMSG : 0; + err = crypto_memneq(&mdptr[4], auth_tag, authsize) ? -EBADMSG : 0; } sa_free_sa_rx_data(rxd); -- 2.43.0