patch 'crypto/cnxk: use timing-safe digest comparison' has been queued to stable release 25.11.3

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 08/04/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/0296235f421f9004db184c2a0ced78aaeebbf083

Thanks.

Kevin

---
>From 0296235f421f9004db184c2a0ced78aaeebbf083 Mon Sep 17 00:00:00 2001
From: Stephen Hemminger <stephen at networkplumber.org>
Date: Mon, 29 Jun 2026 11:59:28 -0700
Subject: [PATCH] crypto/cnxk: use timing-safe digest comparison
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ upstream commit f72517b8e7dbfa17f8d493af6a8ad94747c5bc21 ]

compl_auth_verify() compared the generated and received MAC with
memcmp(), which returns early on the first differing byte and leaks
the number of matching leading bytes through timing.

Use rte_memeq_timingsafe() for the verify comparison.

Bugzilla ID: 1773
Fixes: 786963fdcf3e ("crypto/cnxk: add digest support")

Signed-off-by: Stephen Hemminger <stephen at networkplumber.org>
Acked-by: Tejasree Kondoj <ktejasree at marvell.com>
Acked-by: Morten Brørup <mb at smartsharesystems.com>
---
 drivers/crypto/cnxk/cnxk_ae.h | 4 +++-
 drivers/crypto/cnxk/cnxk_se.h | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/cnxk/cnxk_ae.h b/drivers/crypto/cnxk/cnxk_ae.h
index 21a0c8068a..d43a0958ee 100644
--- a/drivers/crypto/cnxk/cnxk_ae.h
+++ b/drivers/crypto/cnxk/cnxk_ae.h
@@ -9,4 +9,5 @@
 #include <rte_crypto_asym.h>
 #include <rte_malloc.h>
+#include <rte_memory.h>
 
 #include "roc_ae.h"
@@ -1603,5 +1604,6 @@ cnxk_ae_dequeue_rsa_op(struct rte_crypto_op *cop, uint8_t *rptr,
 			 * (2 bytes) and compare signed data.
 			 */
-			if (memcmp(rptr + 2, rsa->message.data, rsa->message.length))
+			if (!rte_memeq_timingsafe(rptr + 2,
+						  rsa->message.data, rsa->message.length))
 				cop->status = RTE_CRYPTO_OP_STATUS_ERROR;
 		}
diff --git a/drivers/crypto/cnxk/cnxk_se.h b/drivers/crypto/cnxk/cnxk_se.h
index 080539e7f1..2bc40afe41 100644
--- a/drivers/crypto/cnxk/cnxk_se.h
+++ b/drivers/crypto/cnxk/cnxk_se.h
@@ -3343,5 +3343,5 @@ compl_auth_verify(struct rte_crypto_op *op, uint8_t *gen_mac, uint64_t mac_len)
 	}
 
-	if (memcmp(mac, gen_mac, mac_len))
+	if (!rte_memeq_timingsafe(mac, gen_mac, mac_len))
 		op->status = RTE_CRYPTO_OP_STATUS_AUTH_FAILED;
 	else
-- 
2.55.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-30 10:16:03.315653813 +0100
+++ 0064-crypto-cnxk-use-timing-safe-digest-comparison.patch	2026-07-30 10:16:01.494330750 +0100
@@ -1 +1 @@
-From f72517b8e7dbfa17f8d493af6a8ad94747c5bc21 Mon Sep 17 00:00:00 2001
+From 0296235f421f9004db184c2a0ced78aaeebbf083 Mon Sep 17 00:00:00 2001
@@ -8,0 +9,2 @@
+[ upstream commit f72517b8e7dbfa17f8d493af6a8ad94747c5bc21 ]
+
@@ -17 +18,0 @@
-Cc: stable at dpdk.org
@@ -28 +29 @@
-index 691f9bfce5..f2aa5d5a2e 100644
+index 21a0c8068a..d43a0958ee 100644
@@ -37 +38 @@
-@@ -1922,5 +1923,6 @@ cnxk_ae_dequeue_rsa_op(struct rte_crypto_op *cop, uint8_t *rptr,
+@@ -1603,5 +1604,6 @@ cnxk_ae_dequeue_rsa_op(struct rte_crypto_op *cop, uint8_t *rptr,
@@ -46 +47 @@
-index fdf2fd1504..505a5fcd37 100644
+index 080539e7f1..2bc40afe41 100644
@@ -49 +50 @@
-@@ -3368,5 +3368,5 @@ compl_auth_verify(struct rte_crypto_op *op, uint8_t *gen_mac, uint64_t mac_len)
+@@ -3343,5 +3343,5 @@ compl_auth_verify(struct rte_crypto_op *op, uint8_t *gen_mac, uint64_t mac_len)