From: Greg Kroah-Hartman Date: Sat, 24 Oct 2020 10:41:02 +0000 (+0200) Subject: 4.9-stable patches X-Git-Tag: v4.4.241~34 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=07847aa6d5f5afbd2f193e4bbf871b413cb5aef4;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: crypto-algif_aead-do-not-set-may_backlog-on-the-async-path.patch ima-don-t-ignore-errors-from-crypto_shash_update.patch --- diff --git a/queue-4.9/crypto-algif_aead-do-not-set-may_backlog-on-the-async-path.patch b/queue-4.9/crypto-algif_aead-do-not-set-may_backlog-on-the-async-path.patch new file mode 100644 index 00000000000..f1345212f83 --- /dev/null +++ b/queue-4.9/crypto-algif_aead-do-not-set-may_backlog-on-the-async-path.patch @@ -0,0 +1,42 @@ +From cbdad1f246dd98e6c9c32a6e5212337f542aa7e0 Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Fri, 31 Jul 2020 17:03:50 +1000 +Subject: crypto: algif_aead - Do not set MAY_BACKLOG on the async path + +From: Herbert Xu + +commit cbdad1f246dd98e6c9c32a6e5212337f542aa7e0 upstream. + +The async path cannot use MAY_BACKLOG because it is not meant to +block, which is what MAY_BACKLOG does. On the other hand, both +the sync and async paths can make use of MAY_SLEEP. + +Fixes: 83094e5e9e49 ("crypto: af_alg - add async support to...") +Cc: +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + crypto/algif_aead.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/crypto/algif_aead.c ++++ b/crypto/algif_aead.c +@@ -455,7 +455,7 @@ static int aead_recvmsg_async(struct soc + memcpy(areq->iv, ctx->iv, crypto_aead_ivsize(tfm)); + aead_request_set_tfm(req, tfm); + aead_request_set_ad(req, ctx->aead_assoclen); +- aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, ++ aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP, + aead_async_cb, req); + used -= ctx->aead_assoclen; + +@@ -925,7 +925,7 @@ static int aead_accept_parent_nokey(void + ask->private = ctx; + + aead_request_set_tfm(&ctx->aead_req, aead); +- aead_request_set_callback(&ctx->aead_req, CRYPTO_TFM_REQ_MAY_BACKLOG, ++ aead_request_set_callback(&ctx->aead_req, CRYPTO_TFM_REQ_MAY_SLEEP, + af_alg_complete, &ctx->completion); + + sk->sk_destruct = aead_sock_destruct; diff --git a/queue-4.9/ima-don-t-ignore-errors-from-crypto_shash_update.patch b/queue-4.9/ima-don-t-ignore-errors-from-crypto_shash_update.patch new file mode 100644 index 00000000000..fbf88c70ae3 --- /dev/null +++ b/queue-4.9/ima-don-t-ignore-errors-from-crypto_shash_update.patch @@ -0,0 +1,35 @@ +From 60386b854008adc951c470067f90a2d85b5d520f Mon Sep 17 00:00:00 2001 +From: Roberto Sassu +Date: Fri, 4 Sep 2020 11:23:28 +0200 +Subject: ima: Don't ignore errors from crypto_shash_update() + +From: Roberto Sassu + +commit 60386b854008adc951c470067f90a2d85b5d520f upstream. + +Errors returned by crypto_shash_update() are not checked in +ima_calc_boot_aggregate_tfm() and thus can be overwritten at the next +iteration of the loop. This patch adds a check after calling +crypto_shash_update() and returns immediately if the result is not zero. + +Cc: stable@vger.kernel.org +Fixes: 3323eec921efd ("integrity: IMA as an integrity service provider") +Signed-off-by: Roberto Sassu +Signed-off-by: Mimi Zohar +Signed-off-by: Greg Kroah-Hartman + +--- + security/integrity/ima/ima_crypto.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/security/integrity/ima/ima_crypto.c ++++ b/security/integrity/ima/ima_crypto.c +@@ -683,6 +683,8 @@ static int __init ima_calc_boot_aggregat + ima_pcrread(i, pcr_i); + /* now accumulate with current aggregate */ + rc = crypto_shash_update(shash, pcr_i, TPM_DIGEST_SIZE); ++ if (rc != 0) ++ return rc; + } + if (!rc) + crypto_shash_final(shash, digest); diff --git a/queue-4.9/series b/queue-4.9/series index 6e5c998acb9..afed2841d17 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -10,3 +10,5 @@ tcp-fix-to-update-snd_wl1-in-bulk-receiver-fast-path.patch icmp-randomize-the-global-rate-limiter.patch cifs-remove-bogus-debug-code.patch kvm-x86-mmu-commit-zap-of-remaining-invalid-pages-when-recovering-lpages.patch +ima-don-t-ignore-errors-from-crypto_shash_update.patch +crypto-algif_aead-do-not-set-may_backlog-on-the-async-path.patch