3.16.7-ckt22 -stable review patch. If anyone has any objections, please let me
know.
------------------
From: David Gstir <da...@sigma-star.at>
commit 79960943fdc114fd4583c9ab164b5c89da7aa601 upstream.
Using non-constant time memcmp() makes the verification of the authentication
tag in the decrypt path vulnerable to timing attacks. Fix this by using
crypto_memneq() instead.
Signed-off-by: David Gstir <da...@sigma-star.at>
Signed-off-by: Herbert Xu <herb...@gondor.apana.org.au>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriq...@canonical.com>
---
drivers/crypto/talitos.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 307931528eb2..da328ed633fb 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -870,8 +870,8 @@ static void ipsec_esp_decrypt_swauth_done(struct device
*dev,
icvdata = &edesc->link_tbl[0];
sg = sg_last(req->dst, edesc->dst_nents ? : 1);
- err = memcmp(icvdata, (char *)sg_virt(sg) + sg->length -
- ctx->authsize, ctx->authsize) ? -EBADMSG : 0;
+ err = crypto_memneq(icvdata, (char *)sg_virt(sg) + sg->length -
+ ctx->authsize, ctx->authsize) ? -EBADMSG :
0;
}
kfree(edesc);
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
