The PE file digest comparison in verify_pefile_signature() uses
memcmp(), whose execution time depends on the position of the first
mismatched byte. This creates a timing side-channel that could allow
an attacker to forge PE file signatures byte by byte.

Replace memcmp() with crypto_memneq() to perform a constant-time
comparison, consistent with the rest of the crypto subsystem
(gcm, ccm, chacha20poly1305, rsassa-pkcs1, krb5, etc.). Add an
explicit <crypto/utils.h> include since this file did not previously
pull in the crypto_memneq() declaration.

Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
---
 crypto/asymmetric_keys/verify_pefile.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/crypto/asymmetric_keys/verify_pefile.c b/crypto/asymmetric_keys/verify_pefile.c
index cec99db14129..dce40a2a3fac 100644
--- a/crypto/asymmetric_keys/verify_pefile.c
+++ b/crypto/asymmetric_keys/verify_pefile.c
@@ -14,6 +14,7 @@
 #include <linux/asn1.h>
 #include <linux/verification.h>
 #include <crypto/hash.h>
+#include <crypto/utils.h>
 #include "verify_pefile.h"
 
 /*
@@ -374,7 +375,7 @@ static int pefile_digest_pe(const void *pebuf, unsigned int pelen,
 	/* Check that the PE file digest matches that in the MSCODE part of the
 	 * PKCS#7 certificate.
 	 */
-	if (memcmp(digest, ctx->digest, ctx->digest_len) != 0) {
+	if (crypto_memneq(digest, ctx->digest, ctx->digest_len)) {
 		pr_warn("Digest mismatch\n");
 		ret = -EKEYREJECTED;
 	} else {
-- 
2.25.1