From aaab22844300556823474f57aa7622e87606afb0 Mon Sep 17 00:00:00 2001 From: "David C.C.M. Gall" Date: Sat, 15 Aug 2026 19:08:21 +0200 Subject: [PATCH] crypto: octeontx2 - use crypto_memneq() to check HMAC for cipher_null authenc validate_hmac_cipher_null() compares the computed and received HMAC with memcmp(), which short-circuits on the first differing byte and leaks tag-match length via timing. Use crypto_memneq() instead. Because for cipher_null the validated payload is un-encrypted, this valid prefix leak allows for authenticated message forgery. Assisted-by: gregkh_clanker_t1000 Signed-off-by: David C.C.M. Gall Signed-off-by: Herbert Xu --- drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c b/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c index 8d9f394d6b50..3ccf17d031c6 100644 --- a/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c +++ b/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c @@ -11,6 +11,7 @@ #include #include #include +#include #include #include #include "otx2_cptvf.h" @@ -90,9 +91,9 @@ static inline int validate_hmac_cipher_null(struct otx2_cpt_req_info *cpt_req) req = container_of(cpt_req->areq, struct aead_request, base); tfm = crypto_aead_reqtfm(req); rctx = aead_request_ctx_dma(req); - if (memcmp(rctx->fctx.hmac.s.hmac_calc, - rctx->fctx.hmac.s.hmac_recv, - crypto_aead_authsize(tfm)) != 0) + if (crypto_memneq(rctx->fctx.hmac.s.hmac_calc, + rctx->fctx.hmac.s.hmac_recv, + crypto_aead_authsize(tfm))) return -EBADMSG; return 0;