From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ej1-f47.google.com (mail-ej1-f47.google.com [209.85.218.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3C7B3397958 for ; Fri, 7 Aug 2026 16:13:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786119237; cv=none; b=i5cFnkfOZh0asYEDKl2WzUQJlxDECRgBxu/j8SEV/MK5N5IEW36hkEFEKjyww5vScugr/GVSDUCrLJxOl9hz31NoOv4eaZjjCSus8xcyeNmCDE1X160WGzwC62XK7Wm7OH8+hfgWQliYie6QehK2Fkh8jzcCkZ2LEbQQCFDOoY4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786119237; c=relaxed/simple; bh=t0Xer58sL6heqEqGaYvs7twJ2gJF7MKb+PJJ2R/T5uY=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type: Content-Disposition; b=clbaNxNcWVx1ZHre3kKzmUfbnQb2dxkAeJVjuVEsipFrJBaLnB8KkWXoiXDw3IgYRj3cyJgpgnHi4+ly7xrgo/QRqktnuJRNhwtXRoBuBc+PuUC6Uyi5b9wIEPoYUvi5cSWoEmesCDANh2AXzHUh08RI+hRjrI5Bvpur4HrX6IY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com; spf=pass smtp.mailfrom=googlemail.com; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b=elixrAJh; arc=none smtp.client-ip=209.85.218.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=googlemail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b="elixrAJh" Received: by mail-ej1-f47.google.com with SMTP id a640c23a62f3a-c1f5208b38dso619793366b.0 for ; Fri, 07 Aug 2026 09:13:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20251104; t=1786119234; x=1786724034; darn=vger.kernel.org; h=content-disposition:content-type:mime-version:message-id:subject:cc :to:from:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=TPEYjqEYnl2DLLI5hMOioqJc22NNsDcohHqI88LFN80=; b=elixrAJhfFZBjQvB9BFwAYxZRZLB5oiQ+MqQzInJI6kiyT7wDYFHhIyizK5QqY7f/P pb44atvf2CfeEskoPbAUig+czm/hrpMrUBPkGOn7X3qSg4CnlgFNj4Ktes3bSko/JSm1 OjclMrDyd5SEcTAflBQesBn6ESo2yYKn/oN/zn8yQB7DRuWP2tbsF78svY9eVuAukGdd +to5d0CmwyPJQiPujbFltSSjdv6l26vZVyqAOycB/mrnRUxbpTipjnX2IegfVYR4m3vy WRudRkIDTVevsSolMnc1JP/ra2zZV/eaTkhHt5LZQNvUEPDf2W3YI5m2G8LoQi4D+tgu ePfg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786119234; x=1786724034; h=content-disposition:content-type:mime-version:message-id:subject:cc :to:from:date:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=TPEYjqEYnl2DLLI5hMOioqJc22NNsDcohHqI88LFN80=; b=CCDQFEx3HlIpBB0GB2VC+hbjHXtQvjKqO3uwIxRChCigDv6ZvBqBqS9zuerIbWuCI8 33O6HNIeVktKrlkatJdQYDq4aZDvrWxET/s07fPyjrDSU3GAyE+e3jGyaetWVoxmCbaL vtHPZxZ6QKJ0MTAaY8O/UWEkdVZRZhntBflS5/a3VzNIeSH3ysoUbLzLB/wFijIAKLRY xRDgqteGjqclqTyTvla+9uEON8R7NVtVCfLfuehEXg79xA57+Y/qr1NIMLgWrzLq+sjQ ZeU2rfAdJtORtu8CkwfY4TswUeQY8FzAtLkCixBS/b48ppKlTkWkilH8ys5XEY3zQ4zm 7mEg== X-Forwarded-Encrypted: i=1; AHgh+RrrsIrvIbXvFu9BkCOvIKR+j9v1hGVEZTycPFAT658Rh0KCXODh7lw5A/6WJCra456dinVWQaLGPoziIUE=@vger.kernel.org X-Gm-Message-State: AOJu0YwYeiObcrBZclQdqNum9AmN9hyno+s9l38p7rpBH0eE30z853F2 NXd/+bC0afbEYL9B9Z1nfQm8wghyaP7V4opc/EdI8iBLwNERaaKsDcCmyDkaGKfA X-Gm-Gg: AR+sD12beGhnyNPb6UbgfjPX6n/bjldI5y52ExSomtyW5xICUKjeqrsZwn0NxrFN7xY 88gqIhjneRqAB/OnTxd4eKVC+/eNqEB8n9aGW8BaFpg2SDTePLK05BMw0NQCz9ARF0bpwVTtJC3 QFm21gGFB6E3yEAbAcZthNFxfFM3ANRrdl3wjylpOlFT/uJUjIo6KlS1ncmIjr9jZG+Amfl/ksy WGmkSnrgzU6eRLJiCXCfbD29h6ek+LgK1WtI45HqEqWyYFaT5gF8t4YAgFvforJwFjt1jknUSm8 U9PygyXf72jlBaOzrHirII5iDRREJ0QlQGND1SrsVMgFMUx+U+tfyle+5JjvOiqswYG+SumW01C 8fK+av+/LMCEIwOlSbOEk1QYnuu2TlIe+Y/XV6e3zp5xW/Bo3upiZVDfEe5f6cHZxvwdD7kF0Az wiGIxvUd4NNvqiD8XqvxI7DPFZpUXpl1QlP1gplBU264jLAfu6ALO03eaAg64a06g9GH9oY8P0e 1D+4InBFIKR+kXo09k= X-Received: by 2002:a17:907:1ca7:b0:c1c:4adc:31a9 with SMTP id a640c23a62f3a-c2039e3fe56mr1214112566b.28.1786119234238; Fri, 07 Aug 2026 09:13:54 -0700 (PDT) Received: from david.gall (k10193.upc-k.chello.nl. [62.108.10.193]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c2080cf749fsm72440166b.58.2026.08.07.09.13.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 07 Aug 2026 09:13:53 -0700 (PDT) Date: Fri, 7 Aug 2026 18:13:52 +0200 From: "David C.C.M. Gall" To: Herbert Xu , "David S. Miller" , linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org Cc: gregkh@linuxfoundation.org Subject: [PATCH 1/2] crypto: keembay - use crypto_memneq() to compare GCM AEAD tags Message-ID: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Use crypto_memneq() for constant-time comparison. The GCM path in keembay-ocs-aes-core.c verifes the received authentication tag with memcmp(), which returns early on the first mismatched byte. This leaks valid-prefix length and allows for valid tag forgery which violates the INT-CTXT guarantee of AEAD. Assisted-by: gregkh_clanker_t1000 Signed-off-by: David C.C.M. Gall --- drivers/crypto/intel/keembay/keembay-ocs-aes-core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c b/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c index 8a8f6c81e010..f8f4517ccad0 100644 --- a/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c +++ b/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c @@ -11,6 +11,7 @@ #include #include #include +#include #include #include #include @@ -919,7 +920,7 @@ static int kmb_ocs_aead_run(struct aead_request *req) /* For GCM decrypt, we have to compare in_tag with out_tag. */ if (rctx->instruction == OCS_DECRYPT) { - rc = memcmp(rctx->in_tag, rctx->out_tag, tag_size) ? + rc = crypto_memneq(rctx->in_tag, rctx->out_tag, tag_size) ? -EBADMSG : 0; goto exit; } -- 2.43.0