From: Greg Kroah-Hartman Date: Sat, 24 Oct 2020 10:41:31 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.4.241~32 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=66eebc266a67e0e036c21b7ac4bbd717f5a9fa39;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: crypto-algif_aead-do-not-set-may_backlog-on-the-async-path.patch ima-don-t-ignore-errors-from-crypto_shash_update.patch --- diff --git a/queue-4.19/crypto-algif_aead-do-not-set-may_backlog-on-the-async-path.patch b/queue-4.19/crypto-algif_aead-do-not-set-may_backlog-on-the-async-path.patch new file mode 100644 index 00000000000..5a13cade0c3 --- /dev/null +++ b/queue-4.19/crypto-algif_aead-do-not-set-may_backlog-on-the-async-path.patch @@ -0,0 +1,56 @@ +From cbdad1f246dd98e6c9c32a6e5212337f542aa7e0 Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Fri, 31 Jul 2020 17:03:50 +1000 +Subject: crypto: algif_aead - Do not set MAY_BACKLOG on the async path + +From: Herbert Xu + +commit cbdad1f246dd98e6c9c32a6e5212337f542aa7e0 upstream. + +The async path cannot use MAY_BACKLOG because it is not meant to +block, which is what MAY_BACKLOG does. On the other hand, both +the sync and async paths can make use of MAY_SLEEP. + +Fixes: 83094e5e9e49 ("crypto: af_alg - add async support to...") +Cc: +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + crypto/algif_aead.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/crypto/algif_aead.c ++++ b/crypto/algif_aead.c +@@ -82,7 +82,7 @@ static int crypto_aead_copy_sgl(struct c + SKCIPHER_REQUEST_ON_STACK(skreq, null_tfm); + + skcipher_request_set_tfm(skreq, null_tfm); +- skcipher_request_set_callback(skreq, CRYPTO_TFM_REQ_MAY_BACKLOG, ++ skcipher_request_set_callback(skreq, CRYPTO_TFM_REQ_MAY_SLEEP, + NULL, NULL); + skcipher_request_set_crypt(skreq, src, dst, len, NULL); + +@@ -295,19 +295,20 @@ static int _aead_recvmsg(struct socket * + areq->outlen = outlen; + + aead_request_set_callback(&areq->cra_u.aead_req, +- CRYPTO_TFM_REQ_MAY_BACKLOG, ++ CRYPTO_TFM_REQ_MAY_SLEEP, + af_alg_async_cb, areq); + err = ctx->enc ? crypto_aead_encrypt(&areq->cra_u.aead_req) : + crypto_aead_decrypt(&areq->cra_u.aead_req); + + /* AIO operation in progress */ +- if (err == -EINPROGRESS || err == -EBUSY) ++ if (err == -EINPROGRESS) + return -EIOCBQUEUED; + + sock_put(sk); + } else { + /* Synchronous operation */ + aead_request_set_callback(&areq->cra_u.aead_req, ++ CRYPTO_TFM_REQ_MAY_SLEEP | + CRYPTO_TFM_REQ_MAY_BACKLOG, + crypto_req_done, &ctx->wait); + err = crypto_wait_req(ctx->enc ? diff --git a/queue-4.19/ima-don-t-ignore-errors-from-crypto_shash_update.patch b/queue-4.19/ima-don-t-ignore-errors-from-crypto_shash_update.patch new file mode 100644 index 00000000000..0c8978ac829 --- /dev/null +++ b/queue-4.19/ima-don-t-ignore-errors-from-crypto_shash_update.patch @@ -0,0 +1,35 @@ +From 60386b854008adc951c470067f90a2d85b5d520f Mon Sep 17 00:00:00 2001 +From: Roberto Sassu +Date: Fri, 4 Sep 2020 11:23:28 +0200 +Subject: ima: Don't ignore errors from crypto_shash_update() + +From: Roberto Sassu + +commit 60386b854008adc951c470067f90a2d85b5d520f upstream. + +Errors returned by crypto_shash_update() are not checked in +ima_calc_boot_aggregate_tfm() and thus can be overwritten at the next +iteration of the loop. This patch adds a check after calling +crypto_shash_update() and returns immediately if the result is not zero. + +Cc: stable@vger.kernel.org +Fixes: 3323eec921efd ("integrity: IMA as an integrity service provider") +Signed-off-by: Roberto Sassu +Signed-off-by: Mimi Zohar +Signed-off-by: Greg Kroah-Hartman + +--- + security/integrity/ima/ima_crypto.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/security/integrity/ima/ima_crypto.c ++++ b/security/integrity/ima/ima_crypto.c +@@ -682,6 +682,8 @@ static int ima_calc_boot_aggregate_tfm(c + ima_pcrread(i, pcr_i); + /* now accumulate with current aggregate */ + rc = crypto_shash_update(shash, pcr_i, TPM_DIGEST_SIZE); ++ if (rc != 0) ++ return rc; + } + if (!rc) + crypto_shash_final(shash, digest); diff --git a/queue-4.19/series b/queue-4.19/series index 6625ac6983c..9754ef05dd6 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -28,3 +28,5 @@ cifs-remove-bogus-debug-code.patch cifs-return-the-error-from-crypt_message-when-enc-dec-key-not-found.patch kvm-x86-mmu-commit-zap-of-remaining-invalid-pages-when-recovering-lpages.patch kvm-svm-initialize-prev_ga_tag-before-use.patch +ima-don-t-ignore-errors-from-crypto_shash_update.patch +crypto-algif_aead-do-not-set-may_backlog-on-the-async-path.patch