Bluetooth: use constant time memory comparison for secret values

commit 329d82309824ff1082dc4a91a5bbed8c3bec1580 upstream.

This file is filled with complex cryptography. Thus, the comparisons of
MACs and secret keys and curve points and so forth should not add timing
attacks, which could either result in a direct forgery, or, given the
complexity, some other type of attack.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 9ebc394ea5e518cf6fd8d32cacee8867a20413df..39b04f919cb69c0ef58a2f721a89b1e7e57e7aa5 100644 (file)
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -22,6 +22,7 @@
 
 #include <linux/crypto.h>
 #include <linux/scatterlist.h>
+#include <crypto/algapi.h>
 #include <crypto/b128ops.h>
 
 #include <net/bluetooth/bluetooth.h>
@@ -163,7 +164,7 @@ bool smp_irk_matches(struct hci_dev *hdev, u8 irk[16], bdaddr_t *bdaddr)
        if (err)
                return false;
 
-       return !memcmp(bdaddr->b, hash, 3);
+       return !crypto_memneq(bdaddr->b, hash, 3);
 }
 
 int smp_generate_rpa(struct hci_dev *hdev, u8 irk[16], bdaddr_t *rpa)
@@ -584,7 +585,7 @@ static u8 smp_random(struct smp_chan *smp)
        if (ret)
                return SMP_UNSPECIFIED;
 
-       if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
+       if (crypto_memneq(smp->pcnf, confirm, sizeof(smp->pcnf))) {
                BT_ERR("Pairing failed (confirmation values mismatch)");
                return SMP_CONFIRM_FAILED;
        }