From patchwork Sat Jun 10 02:59:09 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jason A. Donenfeld" X-Patchwork-Id: 9779627 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id B6A9C60393 for ; Sat, 10 Jun 2017 03:00:06 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A85222857D for ; Sat, 10 Jun 2017 03:00:06 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9CE2E285ED; Sat, 10 Jun 2017 03:00:06 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 8E6F82857D for ; Sat, 10 Jun 2017 03:00:05 +0000 (UTC) Received: (qmail 26131 invoked by uid 550); 10 Jun 2017 02:59:46 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 24172 invoked from network); 10 Jun 2017 02:59:36 -0000 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=zx2c4.com; h=from:to:cc :subject:date:message-id:in-reply-to:references; s=mail; bh=zmX8 A8hi7bTsK1ey6DUI/K8nDFc=; b=Imq793LuY4e4uFEMcsYVjK/pcQFPuQgAhFBe YedKMnSJskeoJ0CObBuGa5FfGYIE5wkbGwQPYq1ILzf/c/NjeyEyuD9qi+uEMSsD 4jz11Qo+EKGGXCrn7gSL8Wy+j3zFGld+ECz1Yqc5ewSjjxVgnd2d9yOLwg26+0sZ oVAy7z+4PlLSpNJPCcu+j/MTTdcAyluasYBK9+2SqmaKGepd2EH8cU7nmVNOsUtX gNbGnajmX6E+eBREeH+G8shdZe+Crh8zB4mnXc8Aa4MLHODpkb+L/mNkFdfTFyAx X3ZzWJxzjsm7MAX0XZH0A4if/K+ddZipFZx8MTsTft9TzUkjPw== From: "Jason A. Donenfeld" To: linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com Cc: "Jason A. Donenfeld" , Gilad Ben-Yossef , Greg Kroah-Hartman , stable@vger.kernel.org Date: Sat, 10 Jun 2017 04:59:09 +0200 Message-Id: <20170610025912.6499-4-Jason@zx2c4.com> In-Reply-To: <20170610025912.6499-1-Jason@zx2c4.com> References: <20170610025912.6499-1-Jason@zx2c4.com> Subject: [kernel-hardening] [PATCH 3/6] ccree: use constant time memory comparison for macs and tags X-Virus-Scanned: ClamAV using ClamSMTP Otherwise, we enable several different forgeries via timing attack. While the C inside this file is nearly incomprehensible, I did notice a high volume of "FIPS" and "NIST", which makes this kind of bug slightly more embarrassing. Signed-off-by: Jason A. Donenfeld Cc: Gilad Ben-Yossef Cc: Greg Kroah-Hartman Cc: stable@vger.kernel.org --- drivers/staging/ccree/ssi_fips_ll.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/drivers/staging/ccree/ssi_fips_ll.c b/drivers/staging/ccree/ssi_fips_ll.c index d573574bbb98..3310997d8e3e 100644 --- a/drivers/staging/ccree/ssi_fips_ll.c +++ b/drivers/staging/ccree/ssi_fips_ll.c @@ -19,6 +19,7 @@ This file defines the driver FIPS Low Level implmentaion functions, that executes the KAT. ***************************************************************/ #include +#include #include "ssi_driver.h" #include "ssi_fips_local.h" @@ -462,7 +463,7 @@ ssi_cipher_fips_power_up_tests(struct ssi_drvdata *drvdata, void *cpu_addr_buffe } /* compare actual dout to expected */ - if (memcmp(virt_ctx->dout, cipherData->dataOut, cipherData->dataInSize) != 0) + if (crypto_memneq(virt_ctx->dout, cipherData->dataOut, cipherData->dataInSize)) { FIPS_LOG("dout comparison error %d - oprMode=%d, isAes=%d\n", i, cipherData->oprMode, cipherData->isAes); FIPS_LOG(" i expected received \n"); @@ -586,7 +587,7 @@ ssi_cmac_fips_power_up_tests(struct ssi_drvdata *drvdata, void *cpu_addr_buffer, } /* compare actual mac result to expected */ - if (memcmp(virt_ctx->mac_res, cmac_data->mac_res, cmac_data->mac_res_size) != 0) + if (crypto_memneq(virt_ctx->mac_res, cmac_data->mac_res, cmac_data->mac_res_size)) { FIPS_LOG("comparison error %d - digest_size=%d \n", i, cmac_data->mac_res_size); FIPS_LOG(" i expected received \n"); @@ -760,7 +761,7 @@ ssi_hash_fips_power_up_tests(struct ssi_drvdata *drvdata, void *cpu_addr_buffer, } /* compare actual mac result to expected */ - if (memcmp(virt_ctx->mac_res, hash_data->mac_res, digest_size) != 0) + if (crypto_memneq(virt_ctx->mac_res, hash_data->mac_res, digest_size)) { FIPS_LOG("comparison error %d - hash_mode=%d digest_size=%d \n", i, hash_data->hash_mode, digest_size); FIPS_LOG(" i expected received \n"); @@ -1093,7 +1094,7 @@ ssi_hmac_fips_power_up_tests(struct ssi_drvdata *drvdata, void *cpu_addr_buffer, } /* compare actual mac result to expected */ - if (memcmp(virt_ctx->mac_res, hmac_data->mac_res, digest_size) != 0) + if (crypto_memneq(virt_ctx->mac_res, hmac_data->mac_res, digest_size)) { FIPS_LOG("comparison error %d - hash_mode=%d digest_size=%d \n", i, hmac_data->hash_mode, digest_size); FIPS_LOG(" i expected received \n"); @@ -1310,7 +1311,7 @@ ssi_ccm_fips_power_up_tests(struct ssi_drvdata *drvdata, void *cpu_addr_buffer, } /* compare actual dout to expected */ - if (memcmp(virt_ctx->dout, ccmData->dataOut, ccmData->dataInSize) != 0) + if (crypto_memneq(virt_ctx->dout, ccmData->dataOut, ccmData->dataInSize)) { FIPS_LOG("dout comparison error %d - size=%d \n", i, ccmData->dataInSize); error = CC_REE_FIPS_ERROR_AESCCM_PUT; @@ -1318,7 +1319,7 @@ ssi_ccm_fips_power_up_tests(struct ssi_drvdata *drvdata, void *cpu_addr_buffer, } /* compare actual mac result to expected */ - if (memcmp(virt_ctx->mac_res, ccmData->macResOut, ccmData->tagSize) != 0) + if (crypto_memneq(virt_ctx->mac_res, ccmData->macResOut, ccmData->tagSize)) { FIPS_LOG("mac_res comparison error %d - mac_size=%d \n", i, ccmData->tagSize); FIPS_LOG(" i expected received \n"); @@ -1633,7 +1634,7 @@ ssi_gcm_fips_power_up_tests(struct ssi_drvdata *drvdata, void *cpu_addr_buffer, if (gcmData->direction == DRV_CRYPTO_DIRECTION_ENCRYPT) { /* compare actual dout to expected */ - if (memcmp(virt_ctx->dout, gcmData->dataOut, gcmData->dataInSize) != 0) + if (crypto_memneq(virt_ctx->dout, gcmData->dataOut, gcmData->dataInSize)) { FIPS_LOG("dout comparison error %d - size=%d \n", i, gcmData->dataInSize); FIPS_LOG(" i expected received \n"); @@ -1649,7 +1650,7 @@ ssi_gcm_fips_power_up_tests(struct ssi_drvdata *drvdata, void *cpu_addr_buffer, } /* compare actual mac result to expected */ - if (memcmp(virt_ctx->mac_res, gcmData->macResOut, gcmData->tagSize) != 0) + if (crypto_memneq(virt_ctx->mac_res, gcmData->macResOut, gcmData->tagSize)) { FIPS_LOG("mac_res comparison error %d - mac_size=%d \n", i, gcmData->tagSize); FIPS_LOG(" i expected received \n");