|SUCCESS| [v2] common/cpt: use timing-safe digest comparison

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: SUCCESS
https://dpdk.org/patch/167845

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-08-17

# DPDK Patch Review

## Summary
This patch addresses a timing side-channel vulnerability in MAC verification by replacing `memcmp()` with `rte_memeq_timingsafe()`. The patch is correct and properly implements constant-time comparison for cryptographic authentication tag verification.

---

## Correctness

**No issues found.**

The patch correctly:
- Identifies a timing side-channel vulnerability in authentication tag comparison
- Replaces `memcmp()` with `rte_memeq_timingsafe()` for constant-time comparison
- Adjusts the conditional logic to match the different return semantics
  (`memcmp()` returns 0 on equal; `rte_memeq_timingsafe()` returns true on equal)
- Uses the timing-safe comparison for attacker-influenced data (received MAC vs computed MAC)

---

## C Coding Style

**No issues found.**

The patch:
- Uses proper indentation
- Follows existing code formatting
- Maintains consistency with the surrounding code

---

## API and Documentation

**Info:**
The patch references Bugzilla ID 1773 but does not update release notes.
While the guidelines state that API changes and new drivers/subsystems require release notes,
security fixes in internal driver code are a gray area.
Consider whether this security fix warrants a mention in the release notes
(typically security fixes are documented to inform users of the vulnerability addressed).

**No other issues found.**

The patch:
- Operates on internal driver code (not public API)
- Does not introduce new API or change existing API signatures
- Does not require Doxygen updates
- Correctly targets a bug fix without introducing new features

---

## Additional Observations

**None.**

The patch is narrowly scoped, addresses a real security issue, and implements the fix correctly.
The v2 changelog correctly notes that comparisons on non-secret data (salt, MAC addresses)
were dropped from the series.

---

## Verdict

**No errors or warnings.** This is a correct security fix.

The only consideration is whether to document this in release notes as a security fix,
which is an Info-level suggestion, not a requirement for correctness.