From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755132AbdJINUF (ORCPT ); Mon, 9 Oct 2017 09:20:05 -0400 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:43462 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755123AbdJINUC (ORCPT ); Mon, 9 Oct 2017 09:20:02 -0400 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Jason A. Donenfeld" , "Marcel Holtmann" Date: Mon, 09 Oct 2017 13:44:24 +0100 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.16 026/192] Bluetooth: use constant time memory comparison for secret values In-Reply-To: X-SA-Exim-Connect-IP: 2a02:8011:400e:2:6f00:88c8:c921:d332 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.16.49-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: "Jason A. Donenfeld" commit 329d82309824ff1082dc4a91a5bbed8c3bec1580 upstream. This file is filled with complex cryptography. Thus, the comparisons of MACs and secret keys and curve points and so forth should not add timing attacks, which could either result in a direct forgery, or, given the complexity, some other type of attack. Signed-off-by: Jason A. Donenfeld Signed-off-by: Marcel Holtmann [bwh: Backported to 3.16: - Drop inapplicable changes - Adjust context] Signed-off-by: Ben Hutchings --- --- a/net/bluetooth/smp.c +++ b/net/bluetooth/smp.c @@ -22,6 +22,7 @@ #include #include +#include #include #include @@ -153,7 +154,7 @@ bool smp_irk_matches(struct crypto_blkci if (err) return false; - return !memcmp(bdaddr->b, hash, 3); + return !crypto_memneq(bdaddr->b, hash, 3); } int smp_generate_rpa(struct crypto_blkcipher *tfm, u8 irk[16], bdaddr_t *rpa) @@ -533,7 +534,7 @@ static u8 smp_random(struct smp_chan *sm if (ret) return SMP_UNSPECIFIED; - if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) { + if (crypto_memneq(smp->pcnf, confirm, sizeof(smp->pcnf))) { BT_ERR("Pairing failed (confirmation values mismatch)"); return SMP_CONFIRM_FAILED; }