From cf14fc2be868840c4c9e0e46a472995798b59712 Mon Sep 17 00:00:00 2001 From: David Disseldorp Date: Fri, 5 Jun 2026 22:16:48 +1000 Subject: [PATCH] scsi: target: Use constant-time crypto_memneq() for CHAP digests A constant-time memory comparison is more suitable than plain memcmp() for authentication digest comparison. CHAP digests use an authenticator-provided random challenge, so any timing side-channel shouldn't be easily exploitable. Reported-by: Sashiko (gemini/gemini-3.1-pro-preview) Link: https://sashiko.dev/#/patchset/20260521151121.808477-1-hossu.alexandru%40gmail.com Signed-off-by: David Disseldorp Reviewed-by: Lee Duncan Link: https://patch.msgid.link/20260605122019.24146-3-ddiss@suse.de Signed-off-by: Martin K. Petersen --- drivers/target/iscsi/iscsi_target_auth.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c index 5858cc308979..f3c0cdd31830 100644 --- a/drivers/target/iscsi/iscsi_target_auth.c +++ b/drivers/target/iscsi/iscsi_target_auth.c @@ -9,6 +9,7 @@ ******************************************************************************/ #include +#include #include #include #include @@ -408,7 +409,7 @@ static int chap_server_compute_hash( pr_debug("[server] %s Server Digest: %s\n", chap->digest_name, response); - if (memcmp(server_digest, client_digest, chap->digest_size) != 0) { + if (crypto_memneq(server_digest, client_digest, chap->digest_size)) { pr_debug("[server] %s Digests do not match!\n\n", chap->digest_name); goto out;