Commit a458b290 authored by Eric Biggers's avatar Eric Biggers Committed by Jakub Kicinski
Browse files

ipv6: sr: Fix MAC comparison to be constant-time 



To prevent timing attacks, MACs need to be compared in constant time.
Use the appropriate helper function for this.

Fixes: bf355b8d ("ipv6: sr: add core files for SR HMAC support")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarEric Biggers <ebiggers@kernel.org>
Reviewed-by: default avatarAndrea Mayer <andrea.mayer@uniroma2.it>
Link: https://patch.msgid.link/20250818202724.15713-1-ebiggers@kernel.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 7af76e9d

net/ipv6/seg6_hmac.c

+2 −1
Original line number Diff line number Diff line
@@ -35,6 +35,7 @@ 
#include <net/xfrm.h>



#include <crypto/hash.h>

#include <crypto/utils.h>

#include <net/seg6.h>

#include <net/genetlink.h>

#include <net/seg6_hmac.h>
@@ -280,7 +281,7 @@ bool seg6_hmac_validate_skb(struct sk_buff *skb) 
	if (seg6_hmac_compute(hinfo, srh, &ipv6_hdr(skb)->saddr, hmac_output))

		return false;



	if (memcmp(hmac_output, tlv->hmac, SEG6_HMAC_FIELD_LEN) != 0)

	if (crypto_memneq(hmac_output, tlv->hmac, SEG6_HMAC_FIELD_LEN))

		return false;



	return true;