3.10-stable patches

added patches:
	random-add-and-use-memzero_explicit-for-clearing-data.patch

diff --git a/queue-3.10/random-add-and-use-memzero_explicit-for-clearing-data.patch b/queue-3.10/random-add-and-use-memzero_explicit-for-clearing-data.patch
new file mode 100644 (file)
index 0000000..232fa0e
--- /dev/null
+++ b/queue-3.10/random-add-and-use-memzero_explicit-for-clearing-data.patch
@@ -0,0 +1,120 @@
+From d4c5efdb97773f59a2b711754ca0953f24516739 Mon Sep 17 00:00:00 2001
+From: Daniel Borkmann <dborkman@redhat.com>
+Date: Tue, 26 Aug 2014 23:16:35 -0400
+Subject: random: add and use memzero_explicit() for clearing data
+
+From: Daniel Borkmann <dborkman@redhat.com>
+
+commit d4c5efdb97773f59a2b711754ca0953f24516739 upstream.
+
+zatimend has reported that in his environment (3.16/gcc4.8.3/corei7)
+memset() calls which clear out sensitive data in extract_{buf,entropy,
+entropy_user}() in random driver are being optimized away by gcc.
+
+Add a helper memzero_explicit() (similarly as explicit_bzero() variants)
+that can be used in such cases where a variable with sensitive data is
+being cleared out in the end. Other use cases might also be in crypto
+code. [ I have put this into lib/string.c though, as it's always built-in
+and doesn't need any dependencies then. ]
+
+Fixes kernel bugzilla: 82041
+
+Reported-by: zatimend@hotmail.co.uk
+Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
+Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/random.c  |   10 +++++-----
+ include/linux/string.h |    5 +++--
+ lib/string.c           |   16 ++++++++++++++++
+ 3 files changed, 24 insertions(+), 7 deletions(-)
+
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -933,8 +933,8 @@ static void extract_buf(struct entropy_s
+        * pool while mixing, and hash one final time.
+        */
+       sha_transform(hash.w, extract, workspace);
+-      memset(extract, 0, sizeof(extract));
+-      memset(workspace, 0, sizeof(workspace));
++      memzero_explicit(extract, sizeof(extract));
++      memzero_explicit(workspace, sizeof(workspace));
+ 
+       /*
+        * In case the hash function has some recognizable output
+@@ -957,7 +957,7 @@ static void extract_buf(struct entropy_s
+       }
+ 
+       memcpy(out, &hash, EXTRACT_SIZE);
+-      memset(&hash, 0, sizeof(hash));
++      memzero_explicit(&hash, sizeof(hash));
+ }
+ 
+ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
+@@ -1005,7 +1005,7 @@ static ssize_t extract_entropy(struct en
+       }
+ 
+       /* Wipe data just returned from memory */
+-      memset(tmp, 0, sizeof(tmp));
++      memzero_explicit(tmp, sizeof(tmp));
+ 
+       return ret;
+ }
+@@ -1043,7 +1043,7 @@ static ssize_t extract_entropy_user(stru
+       }
+ 
+       /* Wipe data just returned from memory */
+-      memset(tmp, 0, sizeof(tmp));
++      memzero_explicit(tmp, sizeof(tmp));
+ 
+       return ret;
+ }
+--- a/include/linux/string.h
++++ b/include/linux/string.h
+@@ -129,7 +129,7 @@ int bprintf(u32 *bin_buf, size_t size, c
+ #endif
+ 
+ extern ssize_t memory_read_from_buffer(void *to, size_t count, loff_t *ppos,
+-                      const void *from, size_t available);
++                                     const void *from, size_t available);
+ 
+ /**
+  * strstarts - does @str start with @prefix?
+@@ -141,7 +141,8 @@ static inline bool strstarts(const char
+       return strncmp(str, prefix, strlen(prefix)) == 0;
+ }
+ 
+-extern size_t memweight(const void *ptr, size_t bytes);
++size_t memweight(const void *ptr, size_t bytes);
++void memzero_explicit(void *s, size_t count);
+ 
+ /**
+  * kbasename - return the last part of a pathname.
+--- a/lib/string.c
++++ b/lib/string.c
+@@ -586,6 +586,22 @@ void *memset(void *s, int c, size_t coun
+ EXPORT_SYMBOL(memset);
+ #endif
+ 
++/**
++ * memzero_explicit - Fill a region of memory (e.g. sensitive
++ *                  keying data) with 0s.
++ * @s: Pointer to the start of the area.
++ * @count: The size of the area.
++ *
++ * memzero_explicit() doesn't need an arch-specific version as
++ * it just invokes the one of memset() implicitly.
++ */
++void memzero_explicit(void *s, size_t count)
++{
++      memset(s, 0, count);
++      OPTIMIZER_HIDE_VAR(s);
++}
++EXPORT_SYMBOL(memzero_explicit);
++
+ #ifndef __HAVE_ARCH_MEMCPY
+ /**
+  * memcpy - Copy one area of memory to another

diff --git a/queue-3.10/series b/queue-3.10/series
index c6e7ae72e1e4ba8745fb39964a50bdee8ec49743..a9d383a6a4a11c523b8f070644aa3c8ba5e2b3a2 100644 (file)
--- a/queue-3.10/series
+++ b/queue-3.10/series
@@ -25,3 +25,4 @@ evm-check-xattr-value-length-and-type-in-evm_inode_setxattr.patch
 alsa-pcm-zero-clear-reserved-fields-of-pcm-status-ioctl-in-compat-mode.patch
 kill-wbuf_queued-wbuf_dwork_lock.patch
 fix-misuses-of-f_count-in-ppp-and-netlink.patch
+random-add-and-use-memzero_explicit-for-clearing-data.patch