From: Sasha Levin Date: Tue, 11 Aug 2026 18:55:13 +0000 (-0400) Subject: Fixes for all trees X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7e591fe225e9209903e2a34756e7796055910612;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch b/queue-5.10/s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch new file mode 100644 index 0000000000..c98febd797 --- /dev/null +++ b/queue-5.10/s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch @@ -0,0 +1,116 @@ +From 837b7bf400627d8dcfd5cd44f7631b2347e5d25f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2026 15:12:17 +0200 +Subject: s390/zcrypt: Fix missing mem scrub at clear key import in + cca_clr2cipherkey() + +From: Harald Freudenberger + +[ Upstream commit 01476391aecef36a3b789ee844357b22fbc90665 ] + +The helper function _ip_cprb_helper() uses internal buffer memory for +building and processing CPRBs. After use this buffer was never +scrubbed which could lead to leaving for example clear key material in +memory which could be exposed via tricky reuse of this same memory. + +Extend the _ip_cprb_helper() function with another parameter 'scrub' +used to steer scrubbing of this buffer. So now the caller has the +opportunity to decide if scrubbing is needed or not. + +Extend the clear key to secure key token import process in function +cca_clr2cipherkey() to tell the helper function from above to scrub +the cprb buffer when the clear key value is part of the request data. + +Add explicit scrubbing on return from function cca_clr2cipherkey() for +the random EXOR buffer and the cprb buffer. + +Overall this cleans the internal used buffer in case of clear key +import to prevent sensitive data to get exposed. + +Fixes: 4bc123b18ce6 ("s390/zcrypt: Add low level functions for CCA AES cipher keys") +Cc: stable@vger.kernel.org +Reviewed-by: Holger Dengler +Signed-off-by: Harald Freudenberger +Signed-off-by: Vasily Gorbik +Signed-off-by: Holger Dengler +Signed-off-by: Sasha Levin +--- + drivers/s390/crypto/zcrypt_ccamisc.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/drivers/s390/crypto/zcrypt_ccamisc.c b/drivers/s390/crypto/zcrypt_ccamisc.c +index 7af5176623bc1..7875519491dbd 100644 +--- a/drivers/s390/crypto/zcrypt_ccamisc.c ++++ b/drivers/s390/crypto/zcrypt_ccamisc.c +@@ -943,7 +943,8 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain, + const u8 *clr_key_value, + int clr_key_bit_size, + u8 *key_token, +- int *key_token_size) ++ int *key_token_size, ++ bool scrub) + { + int rc, n; + u8 *mem, *ptr; +@@ -1084,7 +1085,7 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain, + *key_token_size = t->len; + + out: +- free_cprbmem(mem, PARMBSIZE, 0); ++ free_cprbmem(mem, PARMBSIZE, scrub); + return rc; + } + +@@ -1127,7 +1128,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, + * 4/4 COMPLETE the secure cipher key import + */ + rc = _ip_cprb_helper(card, dom, "AES ", "FIRST ", "MIN3PART", +- exorbuf, keybitsize, token, &tokensize); ++ exorbuf, keybitsize, token, &tokensize, ++ true); + if (rc) { + DEBUG_ERR( + "%s clear key import 1/4 with CSNBKPI2 failed, rc=%d\n", +@@ -1135,7 +1137,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, + goto out; + } + rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL, +- clrkey, keybitsize, token, &tokensize); ++ clrkey, keybitsize, token, &tokensize, ++ true); + if (rc) { + DEBUG_ERR( + "%s clear key import 2/4 with CSNBKPI2 failed, rc=%d\n", +@@ -1143,7 +1146,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, + goto out; + } + rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL, +- exorbuf, keybitsize, token, &tokensize); ++ exorbuf, keybitsize, token, &tokensize, ++ true); + if (rc) { + DEBUG_ERR( + "%s clear key import 3/4 with CSNBKPI2 failed, rc=%d\n", +@@ -1151,7 +1155,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, + goto out; + } + rc = _ip_cprb_helper(card, dom, "AES ", "COMPLETE", NULL, +- NULL, keybitsize, token, &tokensize); ++ NULL, keybitsize, token, &tokensize, ++ true); + if (rc) { + DEBUG_ERR( + "%s clear key import 4/4 with CSNBKPI2 failed, rc=%d\n", +@@ -1169,7 +1174,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, + *keybufsize = tokensize; + + out: +- kfree(token); ++ memzero_explicit(exorbuf, sizeof(exorbuf)); ++ kfree_sensitive(token); + return rc; + } + EXPORT_SYMBOL(cca_clr2cipherkey); +-- +2.53.0 + diff --git a/queue-5.10/series b/queue-5.10/series index 202f9c9839..d6a8f4a242 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -307,3 +307,4 @@ net-openvswitch-fix-skb-leak-on-flow-key-update-fail.patch firmware-stratix10-svc-fix-memory-leaks-and-list-cor.patch gpio-pch-use-raw_spinlock_t-for-the-register-lock.patch mount-honour-sb_nouser-in-the-new-mount-api.patch +s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch diff --git a/queue-5.15/s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch b/queue-5.15/s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch new file mode 100644 index 0000000000..418bb36c6a --- /dev/null +++ b/queue-5.15/s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch @@ -0,0 +1,116 @@ +From 963edb2367f3e82d6533829b1d39e4a0609fc3a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2026 15:40:12 +0200 +Subject: s390/zcrypt: Fix missing mem scrub at clear key import in + cca_clr2cipherkey() + +From: Harald Freudenberger + +[ Upstream commit 01476391aecef36a3b789ee844357b22fbc90665 ] + +The helper function _ip_cprb_helper() uses internal buffer memory for +building and processing CPRBs. After use this buffer was never +scrubbed which could lead to leaving for example clear key material in +memory which could be exposed via tricky reuse of this same memory. + +Extend the _ip_cprb_helper() function with another parameter 'scrub' +used to steer scrubbing of this buffer. So now the caller has the +opportunity to decide if scrubbing is needed or not. + +Extend the clear key to secure key token import process in function +cca_clr2cipherkey() to tell the helper function from above to scrub +the cprb buffer when the clear key value is part of the request data. + +Add explicit scrubbing on return from function cca_clr2cipherkey() for +the random EXOR buffer and the cprb buffer. + +Overall this cleans the internal used buffer in case of clear key +import to prevent sensitive data to get exposed. + +Fixes: 4bc123b18ce6 ("s390/zcrypt: Add low level functions for CCA AES cipher keys") +Cc: stable@vger.kernel.org +Reviewed-by: Holger Dengler +Signed-off-by: Harald Freudenberger +Signed-off-by: Vasily Gorbik +Signed-off-by: Holger Dengler +Signed-off-by: Sasha Levin +--- + drivers/s390/crypto/zcrypt_ccamisc.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/drivers/s390/crypto/zcrypt_ccamisc.c b/drivers/s390/crypto/zcrypt_ccamisc.c +index e73645d72f2c4..cbd7c96ceb0ca 100644 +--- a/drivers/s390/crypto/zcrypt_ccamisc.c ++++ b/drivers/s390/crypto/zcrypt_ccamisc.c +@@ -946,7 +946,8 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain, + const u8 *clr_key_value, + int clr_key_bit_size, + u8 *key_token, +- int *key_token_size) ++ int *key_token_size, ++ bool scrub) + { + int rc, n; + u8 *mem, *ptr; +@@ -1087,7 +1088,7 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain, + *key_token_size = t->len; + + out: +- free_cprbmem(mem, PARMBSIZE, 0); ++ free_cprbmem(mem, PARMBSIZE, scrub); + return rc; + } + +@@ -1130,7 +1131,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, + * 4/4 COMPLETE the secure cipher key import + */ + rc = _ip_cprb_helper(card, dom, "AES ", "FIRST ", "MIN3PART", +- exorbuf, keybitsize, token, &tokensize); ++ exorbuf, keybitsize, token, &tokensize, ++ true); + if (rc) { + DEBUG_ERR( + "%s clear key import 1/4 with CSNBKPI2 failed, rc=%d\n", +@@ -1138,7 +1140,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, + goto out; + } + rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL, +- clrkey, keybitsize, token, &tokensize); ++ clrkey, keybitsize, token, &tokensize, ++ true); + if (rc) { + DEBUG_ERR( + "%s clear key import 2/4 with CSNBKPI2 failed, rc=%d\n", +@@ -1146,7 +1149,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, + goto out; + } + rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL, +- exorbuf, keybitsize, token, &tokensize); ++ exorbuf, keybitsize, token, &tokensize, ++ true); + if (rc) { + DEBUG_ERR( + "%s clear key import 3/4 with CSNBKPI2 failed, rc=%d\n", +@@ -1154,7 +1158,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, + goto out; + } + rc = _ip_cprb_helper(card, dom, "AES ", "COMPLETE", NULL, +- NULL, keybitsize, token, &tokensize); ++ NULL, keybitsize, token, &tokensize, ++ true); + if (rc) { + DEBUG_ERR( + "%s clear key import 4/4 with CSNBKPI2 failed, rc=%d\n", +@@ -1172,7 +1177,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, + *keybufsize = tokensize; + + out: +- kfree(token); ++ memzero_explicit(exorbuf, sizeof(exorbuf)); ++ kfree_sensitive(token); + return rc; + } + EXPORT_SYMBOL(cca_clr2cipherkey); +-- +2.53.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 433b904705..3651ff94c5 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -364,3 +364,4 @@ net-openvswitch-fix-skb-leak-on-flow-key-update-fail.patch firmware-stratix10-svc-fix-memory-leaks-and-list-cor.patch gpio-pch-use-raw_spinlock_t-for-the-register-lock.patch mount-honour-sb_nouser-in-the-new-mount-api.patch +s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch diff --git a/queue-6.1/s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch b/queue-6.1/s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch new file mode 100644 index 0000000000..c8bec5f05d --- /dev/null +++ b/queue-6.1/s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch @@ -0,0 +1,116 @@ +From 305d9708bd7f0c23852607e72968243ba69f6e35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2026 16:00:30 +0200 +Subject: s390/zcrypt: Fix missing mem scrub at clear key import in + cca_clr2cipherkey() + +From: Harald Freudenberger + +[ Upstream commit 01476391aecef36a3b789ee844357b22fbc90665 ] + +The helper function _ip_cprb_helper() uses internal buffer memory for +building and processing CPRBs. After use this buffer was never +scrubbed which could lead to leaving for example clear key material in +memory which could be exposed via tricky reuse of this same memory. + +Extend the _ip_cprb_helper() function with another parameter 'scrub' +used to steer scrubbing of this buffer. So now the caller has the +opportunity to decide if scrubbing is needed or not. + +Extend the clear key to secure key token import process in function +cca_clr2cipherkey() to tell the helper function from above to scrub +the cprb buffer when the clear key value is part of the request data. + +Add explicit scrubbing on return from function cca_clr2cipherkey() for +the random EXOR buffer and the cprb buffer. + +Overall this cleans the internal used buffer in case of clear key +import to prevent sensitive data to get exposed. + +Fixes: 4bc123b18ce6 ("s390/zcrypt: Add low level functions for CCA AES cipher keys") +Cc: stable@vger.kernel.org +Reviewed-by: Holger Dengler +Signed-off-by: Harald Freudenberger +Signed-off-by: Vasily Gorbik +Signed-off-by: Holger Dengler +Signed-off-by: Sasha Levin +--- + drivers/s390/crypto/zcrypt_ccamisc.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/drivers/s390/crypto/zcrypt_ccamisc.c b/drivers/s390/crypto/zcrypt_ccamisc.c +index 59323c8ca2856..622d960098ad3 100644 +--- a/drivers/s390/crypto/zcrypt_ccamisc.c ++++ b/drivers/s390/crypto/zcrypt_ccamisc.c +@@ -946,7 +946,8 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain, + const u8 *clr_key_value, + int clr_key_bit_size, + u8 *key_token, +- int *key_token_size) ++ int *key_token_size, ++ bool scrub) + { + int rc, n; + u8 *mem, *ptr; +@@ -1087,7 +1088,7 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain, + *key_token_size = t->len; + + out: +- free_cprbmem(mem, PARMBSIZE, 0); ++ free_cprbmem(mem, PARMBSIZE, scrub); + return rc; + } + +@@ -1130,7 +1131,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, + * 4/4 COMPLETE the secure cipher key import + */ + rc = _ip_cprb_helper(card, dom, "AES ", "FIRST ", "MIN3PART", +- exorbuf, keybitsize, token, &tokensize); ++ exorbuf, keybitsize, token, &tokensize, ++ true); + if (rc) { + DEBUG_ERR( + "%s clear key import 1/4 with CSNBKPI2 failed, rc=%d\n", +@@ -1138,7 +1140,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, + goto out; + } + rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL, +- clrkey, keybitsize, token, &tokensize); ++ clrkey, keybitsize, token, &tokensize, ++ true); + if (rc) { + DEBUG_ERR( + "%s clear key import 2/4 with CSNBKPI2 failed, rc=%d\n", +@@ -1146,7 +1149,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, + goto out; + } + rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL, +- exorbuf, keybitsize, token, &tokensize); ++ exorbuf, keybitsize, token, &tokensize, ++ true); + if (rc) { + DEBUG_ERR( + "%s clear key import 3/4 with CSNBKPI2 failed, rc=%d\n", +@@ -1154,7 +1158,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, + goto out; + } + rc = _ip_cprb_helper(card, dom, "AES ", "COMPLETE", NULL, +- NULL, keybitsize, token, &tokensize); ++ NULL, keybitsize, token, &tokensize, ++ true); + if (rc) { + DEBUG_ERR( + "%s clear key import 4/4 with CSNBKPI2 failed, rc=%d\n", +@@ -1172,7 +1177,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, + *keybufsize = tokensize; + + out: +- kfree(token); ++ memzero_explicit(exorbuf, sizeof(exorbuf)); ++ kfree_sensitive(token); + return rc; + } + EXPORT_SYMBOL(cca_clr2cipherkey); +-- +2.53.0 + diff --git a/queue-6.1/series b/queue-6.1/series index 64c596a6e4..437503364c 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -484,3 +484,4 @@ bluetooth-l2cap-fix-uaf-in-channel-timeout-by-holdin.patch bluetooth-6lowpan-fix-using-chan-conn-as-indication-.patch bluetooth-hci_conn-fix-potential-uaf-in-create_big_s.patch mount-honour-sb_nouser-in-the-new-mount-api.patch +s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch diff --git a/queue-6.12/s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch b/queue-6.12/s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch new file mode 100644 index 0000000000..4af50557c6 --- /dev/null +++ b/queue-6.12/s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch @@ -0,0 +1,113 @@ +From 2b60f3cfc54ed969de5c250038f680022413992c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2026 16:37:19 +0200 +Subject: s390/zcrypt: Fix missing mem scrub at clear key import in + cca_clr2cipherkey() + +From: Harald Freudenberger + +[ Upstream commit 01476391aecef36a3b789ee844357b22fbc90665 ] + +The helper function _ip_cprb_helper() uses internal buffer memory for +building and processing CPRBs. After use this buffer was never +scrubbed which could lead to leaving for example clear key material in +memory which could be exposed via tricky reuse of this same memory. + +Extend the _ip_cprb_helper() function with another parameter 'scrub' +used to steer scrubbing of this buffer. So now the caller has the +opportunity to decide if scrubbing is needed or not. + +Extend the clear key to secure key token import process in function +cca_clr2cipherkey() to tell the helper function from above to scrub +the cprb buffer when the clear key value is part of the request data. + +Add explicit scrubbing on return from function cca_clr2cipherkey() for +the random EXOR buffer and the cprb buffer. + +Overall this cleans the internal used buffer in case of clear key +import to prevent sensitive data to get exposed. + +Fixes: 4bc123b18ce6 ("s390/zcrypt: Add low level functions for CCA AES cipher keys") +Cc: stable@vger.kernel.org +Reviewed-by: Holger Dengler +Signed-off-by: Harald Freudenberger +Signed-off-by: Vasily Gorbik +Signed-off-by: Holger Dengler +Signed-off-by: Sasha Levin +--- + drivers/s390/crypto/zcrypt_ccamisc.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/drivers/s390/crypto/zcrypt_ccamisc.c b/drivers/s390/crypto/zcrypt_ccamisc.c +index 6790afd517ec6..48d36d5a87118 100644 +--- a/drivers/s390/crypto/zcrypt_ccamisc.c ++++ b/drivers/s390/crypto/zcrypt_ccamisc.c +@@ -938,7 +938,8 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain, + const u8 *clr_key_value, + int clr_key_bit_size, + u8 *key_token, +- int *key_token_size) ++ int *key_token_size, ++ bool scrub) + { + int rc, n; + u8 *mem, *ptr; +@@ -1077,7 +1078,7 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain, + *key_token_size = t->len; + + out: +- free_cprbmem(mem, PARMBSIZE, 0); ++ free_cprbmem(mem, PARMBSIZE, scrub); + return rc; + } + +@@ -1120,28 +1121,32 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, + * 4/4 COMPLETE the secure cipher key import + */ + rc = _ip_cprb_helper(card, dom, "AES ", "FIRST ", "MIN3PART", +- exorbuf, keybitsize, token, &tokensize); ++ exorbuf, keybitsize, token, &tokensize, ++ true); + if (rc) { + ZCRYPT_DBF_ERR("%s clear key import 1/4 with CSNBKPI2 failed, rc=%d\n", + __func__, rc); + goto out; + } + rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL, +- clrkey, keybitsize, token, &tokensize); ++ clrkey, keybitsize, token, &tokensize, ++ true); + if (rc) { + ZCRYPT_DBF_ERR("%s clear key import 2/4 with CSNBKPI2 failed, rc=%d\n", + __func__, rc); + goto out; + } + rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL, +- exorbuf, keybitsize, token, &tokensize); ++ exorbuf, keybitsize, token, &tokensize, ++ true); + if (rc) { + ZCRYPT_DBF_ERR("%s clear key import 3/4 with CSNBKPI2 failed, rc=%d\n", + __func__, rc); + goto out; + } + rc = _ip_cprb_helper(card, dom, "AES ", "COMPLETE", NULL, +- NULL, keybitsize, token, &tokensize); ++ NULL, keybitsize, token, &tokensize, ++ true); + if (rc) { + ZCRYPT_DBF_ERR("%s clear key import 4/4 with CSNBKPI2 failed, rc=%d\n", + __func__, rc); +@@ -1158,7 +1163,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, + *keybufsize = tokensize; + + out: +- kfree(token); ++ memzero_explicit(exorbuf, sizeof(exorbuf)); ++ kfree_sensitive(token); + return rc; + } + EXPORT_SYMBOL(cca_clr2cipherkey); +-- +2.53.0 + diff --git a/queue-6.12/series b/queue-6.12/series index 1c5d48325b..92cae60f74 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -2,3 +2,4 @@ mount-honour-sb_nouser-in-the-new-mount-api.patch selftests-bpf-fail-unbound-udp-on-sockmap-update.patch drm-amd-display-add-av-mute-wait-frames-to-dce110_se.patch drm-amd-display-check-for-tg-ops-in-dce110_set_avmut.patch +s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch diff --git a/queue-6.18/sched-fair-separate-se-vlag-from-se-vprot.patch b/queue-6.18/sched-fair-separate-se-vlag-from-se-vprot.patch new file mode 100644 index 0000000000..a36ade5664 --- /dev/null +++ b/queue-6.18/sched-fair-separate-se-vlag-from-se-vprot.patch @@ -0,0 +1,46 @@ +From c67a94c3ff8ce39425f6b2d0cdc77a1a97e8080b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Nov 2025 05:31:28 +0100 +Subject: sched/fair: Separate se->vlag from se->vprot + +From: Ingo Molnar + +[ Upstream commit 80390ead2080071cbd6f427ff8deb94d10a4a50f ] + +There's no real space concerns here and keeping these fields +in a union makes reading (and tracing) the scheduler code harder. + +Signed-off-by: Ingo Molnar +Link: https://patch.msgid.link/20251201064647.1851919-4-mingo@kernel.org +Signed-off-by: Sasha Levin +--- + include/linux/sched.h | 13 ++++--------- + 1 file changed, 4 insertions(+), 9 deletions(-) + +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 5dea369fcfc96..fa02b2254905c 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -587,15 +587,10 @@ struct sched_entity { + u64 sum_exec_runtime; + u64 prev_sum_exec_runtime; + u64 vruntime; +- union { +- /* +- * When !@on_rq this field is vlag. +- * When cfs_rq->curr == se (which implies @on_rq) +- * this field is vprot. See protect_slice(). +- */ +- s64 vlag; +- u64 vprot; +- }; ++ /* Approximated virtual lag: */ ++ s64 vlag; ++ /* 'Protected' deadline, to give out minimum quantums: */ ++ u64 vprot; + u64 slice; + + u64 nr_migrations; +-- +2.53.0 + diff --git a/queue-6.18/series b/queue-6.18/series index bca57c8862..8b6e6d52cf 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -4,3 +4,4 @@ sched-fair-revert-6d71a9c61604-sched-fair-fix-eevdf-.patch selftests-bpf-fail-unbound-udp-on-sockmap-update.patch drm-amd-display-add-av-mute-wait-frames-to-dce110_se.patch drm-amd-display-check-for-tg-ops-in-dce110_set_avmut.patch +sched-fair-separate-se-vlag-from-se-vprot.patch diff --git a/queue-6.6/s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch b/queue-6.6/s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch new file mode 100644 index 0000000000..4319f701ce --- /dev/null +++ b/queue-6.6/s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch @@ -0,0 +1,116 @@ +From 0d851f1dedc3e657baeed5e404539a181b2e1810 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2026 16:17:13 +0200 +Subject: s390/zcrypt: Fix missing mem scrub at clear key import in + cca_clr2cipherkey() + +From: Harald Freudenberger + +[ Upstream commit 01476391aecef36a3b789ee844357b22fbc90665 ] + +The helper function _ip_cprb_helper() uses internal buffer memory for +building and processing CPRBs. After use this buffer was never +scrubbed which could lead to leaving for example clear key material in +memory which could be exposed via tricky reuse of this same memory. + +Extend the _ip_cprb_helper() function with another parameter 'scrub' +used to steer scrubbing of this buffer. So now the caller has the +opportunity to decide if scrubbing is needed or not. + +Extend the clear key to secure key token import process in function +cca_clr2cipherkey() to tell the helper function from above to scrub +the cprb buffer when the clear key value is part of the request data. + +Add explicit scrubbing on return from function cca_clr2cipherkey() for +the random EXOR buffer and the cprb buffer. + +Overall this cleans the internal used buffer in case of clear key +import to prevent sensitive data to get exposed. + +Fixes: 4bc123b18ce6 ("s390/zcrypt: Add low level functions for CCA AES cipher keys") +Cc: stable@vger.kernel.org +Reviewed-by: Holger Dengler +Signed-off-by: Harald Freudenberger +Signed-off-by: Vasily Gorbik +Signed-off-by: Holger Dengler +Signed-off-by: Sasha Levin +--- + drivers/s390/crypto/zcrypt_ccamisc.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/drivers/s390/crypto/zcrypt_ccamisc.c b/drivers/s390/crypto/zcrypt_ccamisc.c +index c3e3f3a3d8f96..b8526219ecebe 100644 +--- a/drivers/s390/crypto/zcrypt_ccamisc.c ++++ b/drivers/s390/crypto/zcrypt_ccamisc.c +@@ -946,7 +946,8 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain, + const u8 *clr_key_value, + int clr_key_bit_size, + u8 *key_token, +- int *key_token_size) ++ int *key_token_size, ++ bool scrub) + { + int rc, n; + u8 *mem, *ptr; +@@ -1087,7 +1088,7 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain, + *key_token_size = t->len; + + out: +- free_cprbmem(mem, PARMBSIZE, 0); ++ free_cprbmem(mem, PARMBSIZE, scrub); + return rc; + } + +@@ -1130,7 +1131,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, + * 4/4 COMPLETE the secure cipher key import + */ + rc = _ip_cprb_helper(card, dom, "AES ", "FIRST ", "MIN3PART", +- exorbuf, keybitsize, token, &tokensize); ++ exorbuf, keybitsize, token, &tokensize, ++ true); + if (rc) { + DEBUG_ERR( + "%s clear key import 1/4 with CSNBKPI2 failed, rc=%d\n", +@@ -1138,7 +1140,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, + goto out; + } + rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL, +- clrkey, keybitsize, token, &tokensize); ++ clrkey, keybitsize, token, &tokensize, ++ true); + if (rc) { + DEBUG_ERR( + "%s clear key import 2/4 with CSNBKPI2 failed, rc=%d\n", +@@ -1146,7 +1149,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, + goto out; + } + rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL, +- exorbuf, keybitsize, token, &tokensize); ++ exorbuf, keybitsize, token, &tokensize, ++ true); + if (rc) { + DEBUG_ERR( + "%s clear key import 3/4 with CSNBKPI2 failed, rc=%d\n", +@@ -1154,7 +1158,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, + goto out; + } + rc = _ip_cprb_helper(card, dom, "AES ", "COMPLETE", NULL, +- NULL, keybitsize, token, &tokensize); ++ NULL, keybitsize, token, &tokensize, ++ true); + if (rc) { + DEBUG_ERR( + "%s clear key import 4/4 with CSNBKPI2 failed, rc=%d\n", +@@ -1172,7 +1177,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags, + *keybufsize = tokensize; + + out: +- kfree(token); ++ memzero_explicit(exorbuf, sizeof(exorbuf)); ++ kfree_sensitive(token); + return rc; + } + EXPORT_SYMBOL(cca_clr2cipherkey); +-- +2.53.0 + diff --git a/queue-6.6/series b/queue-6.6/series index bf7fbe4bf4..aa60066a86 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -1,2 +1,3 @@ mount-honour-sb_nouser-in-the-new-mount-api.patch selftests-bpf-fail-unbound-udp-on-sockmap-update.patch +s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch