4.9-stable patches

added patches:
	crypto-algif_aead-do-not-set-may_backlog-on-the-async-path.patch
	ima-don-t-ignore-errors-from-crypto_shash_update.patch

diff --git a/queue-4.9/crypto-algif_aead-do-not-set-may_backlog-on-the-async-path.patch b/queue-4.9/crypto-algif_aead-do-not-set-may_backlog-on-the-async-path.patch
new file mode 100644 (file)
index 0000000..f134521
--- /dev/null
+++ b/queue-4.9/crypto-algif_aead-do-not-set-may_backlog-on-the-async-path.patch
@@ -0,0 +1,42 @@
+From cbdad1f246dd98e6c9c32a6e5212337f542aa7e0 Mon Sep 17 00:00:00 2001
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Fri, 31 Jul 2020 17:03:50 +1000
+Subject: crypto: algif_aead - Do not set MAY_BACKLOG on the async path
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+commit cbdad1f246dd98e6c9c32a6e5212337f542aa7e0 upstream.
+
+The async path cannot use MAY_BACKLOG because it is not meant to
+block, which is what MAY_BACKLOG does.  On the other hand, both
+the sync and async paths can make use of MAY_SLEEP.
+
+Fixes: 83094e5e9e49 ("crypto: af_alg - add async support to...")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ crypto/algif_aead.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/crypto/algif_aead.c
++++ b/crypto/algif_aead.c
+@@ -455,7 +455,7 @@ static int aead_recvmsg_async(struct soc
+       memcpy(areq->iv, ctx->iv, crypto_aead_ivsize(tfm));
+       aead_request_set_tfm(req, tfm);
+       aead_request_set_ad(req, ctx->aead_assoclen);
+-      aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
++      aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP,
+                                 aead_async_cb, req);
+       used -= ctx->aead_assoclen;
+ 
+@@ -925,7 +925,7 @@ static int aead_accept_parent_nokey(void
+       ask->private = ctx;
+ 
+       aead_request_set_tfm(&ctx->aead_req, aead);
+-      aead_request_set_callback(&ctx->aead_req, CRYPTO_TFM_REQ_MAY_BACKLOG,
++      aead_request_set_callback(&ctx->aead_req, CRYPTO_TFM_REQ_MAY_SLEEP,
+                                 af_alg_complete, &ctx->completion);
+ 
+       sk->sk_destruct = aead_sock_destruct;

diff --git a/queue-4.9/ima-don-t-ignore-errors-from-crypto_shash_update.patch b/queue-4.9/ima-don-t-ignore-errors-from-crypto_shash_update.patch
new file mode 100644 (file)
index 0000000..fbf88c7
--- /dev/null
+++ b/queue-4.9/ima-don-t-ignore-errors-from-crypto_shash_update.patch
@@ -0,0 +1,35 @@
+From 60386b854008adc951c470067f90a2d85b5d520f Mon Sep 17 00:00:00 2001
+From: Roberto Sassu <roberto.sassu@huawei.com>
+Date: Fri, 4 Sep 2020 11:23:28 +0200
+Subject: ima: Don't ignore errors from crypto_shash_update()
+
+From: Roberto Sassu <roberto.sassu@huawei.com>
+
+commit 60386b854008adc951c470067f90a2d85b5d520f upstream.
+
+Errors returned by crypto_shash_update() are not checked in
+ima_calc_boot_aggregate_tfm() and thus can be overwritten at the next
+iteration of the loop. This patch adds a check after calling
+crypto_shash_update() and returns immediately if the result is not zero.
+
+Cc: stable@vger.kernel.org
+Fixes: 3323eec921efd ("integrity: IMA as an integrity service provider")
+Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/integrity/ima/ima_crypto.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/security/integrity/ima/ima_crypto.c
++++ b/security/integrity/ima/ima_crypto.c
+@@ -683,6 +683,8 @@ static int __init ima_calc_boot_aggregat
+               ima_pcrread(i, pcr_i);
+               /* now accumulate with current aggregate */
+               rc = crypto_shash_update(shash, pcr_i, TPM_DIGEST_SIZE);
++              if (rc != 0)
++                      return rc;
+       }
+       if (!rc)
+               crypto_shash_final(shash, digest);

diff --git a/queue-4.9/series b/queue-4.9/series
index 6e5c998acb9249ddf0be9d003c1d01a6d75757b0..afed2841d1730deb0e0104be97d3cbc9910afb19 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -10,3 +10,5 @@ tcp-fix-to-update-snd_wl1-in-bulk-receiver-fast-path.patch
 icmp-randomize-the-global-rate-limiter.patch
 cifs-remove-bogus-debug-code.patch
 kvm-x86-mmu-commit-zap-of-remaining-invalid-pages-when-recovering-lpages.patch
+ima-don-t-ignore-errors-from-crypto_shash_update.patch
+crypto-algif_aead-do-not-set-may_backlog-on-the-async-path.patch