ksmbd: Compare MACs in constant time

To prevent timing attacks, MAC comparisons need to be constant-time.
Replace the memcmp() with the correct function, crypto_memneq().

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/server/Kconfig b/fs/smb/server/Kconfig
index 2775162c535c6b2de013cbc99a2fd37011dfb79c..12594879cb640f34b020e60b26e5e58a89f5a1f3 100644 (file)
--- a/fs/smb/server/Kconfig
+++ b/fs/smb/server/Kconfig
@@ -13,6 +13,7 @@ config SMB_SERVER
        select CRYPTO_LIB_MD5
        select CRYPTO_LIB_SHA256
        select CRYPTO_LIB_SHA512
+       select CRYPTO_LIB_UTILS
        select CRYPTO_CMAC
        select CRYPTO_AEAD2
        select CRYPTO_CCM

diff --git a/fs/smb/server/auth.c b/fs/smb/server/auth.c
index 580c4d303dc3f4904a2d7d8603fd1757c34564b0..5fe8c667c6b1d9bd7cd40dfc47aea1211fc7d03f 100644 (file)
--- a/fs/smb/server/auth.c
+++ b/fs/smb/server/auth.c
@@ -15,6 +15,7 @@
 #include <crypto/aead.h>
 #include <crypto/md5.h>
 #include <crypto/sha2.h>
+#include <crypto/utils.h>
 #include <linux/random.h>
 #include <linux/scatterlist.h>
 
@@ -165,7 +166,8 @@ int ksmbd_auth_ntlmv2(struct ksmbd_conn *conn, struct ksmbd_session *sess,
                             ntlmv2_rsp, CIFS_HMAC_MD5_HASH_SIZE,
                             sess->sess_key);
 
-       if (memcmp(ntlmv2->ntlmv2_hash, ntlmv2_rsp, CIFS_HMAC_MD5_HASH_SIZE) != 0)
+       if (crypto_memneq(ntlmv2->ntlmv2_hash, ntlmv2_rsp,
+                         CIFS_HMAC_MD5_HASH_SIZE))
                return -EINVAL;
        return 0;
 }

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 95901a78951cc40236a6962db7435148843a5bdd..743c629fe7ec64c391479d9412fed56e0739ccf8 100644 (file)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -4,6 +4,7 @@
  *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
  */
 
+#include <crypto/utils.h>
 #include <linux/inetdevice.h>
 #include <net/addrconf.h>
 #include <linux/syscalls.h>
@@ -8880,7 +8881,7 @@ int smb2_check_sign_req(struct ksmbd_work *work)
        ksmbd_sign_smb2_pdu(work->conn, work->sess->sess_key, iov, 1,
                            signature);
 
-       if (memcmp(signature, signature_req, SMB2_SIGNATURE_SIZE)) {
+       if (crypto_memneq(signature, signature_req, SMB2_SIGNATURE_SIZE)) {
                pr_err("bad smb2 signature\n");
                return 0;
        }
@@ -8968,7 +8969,7 @@ int smb3_check_sign_req(struct ksmbd_work *work)
        if (ksmbd_sign_smb3_pdu(conn, signing_key, iov, 1, signature))
                return 0;
 
-       if (memcmp(signature, signature_req, SMB2_SIGNATURE_SIZE)) {
+       if (crypto_memneq(signature, signature_req, SMB2_SIGNATURE_SIZE)) {
                pr_err("bad smb2 signature\n");
                return 0;
        }