diff --git a/crypto-fix-race-in-larval-lookup.patch b/crypto-fix-race-in-larval-lookup.patch new file mode 100644 index 0000000..d1b1941 --- /dev/null +++ b/crypto-fix-race-in-larval-lookup.patch @@ -0,0 +1,44 @@ +commit 77dbd7a95e4a4f15264c333a9e9ab97ee27dc2aa +Author: Herbert Xu +Date: Sun Sep 8 14:33:50 2013 +1000 + + crypto: api - Fix race condition in larval lookup + + crypto_larval_lookup should only return a larval if it created one. + Any larval created by another entity must be processed through + crypto_larval_wait before being returned. + + Otherwise this will lead to a larval being killed twice, which + will most likely lead to a crash. + + Cc: stable@vger.kernel.org + Reported-by: Kees Cook + Tested-by: Kees Cook + Signed-off-by: Herbert Xu + +diff --git a/crypto/api.c b/crypto/api.c +index 320ea4d..a2b39c5 100644 +--- a/crypto/api.c ++++ b/crypto/api.c +@@ -34,6 +34,8 @@ EXPORT_SYMBOL_GPL(crypto_alg_sem); + BLOCKING_NOTIFIER_HEAD(crypto_chain); + EXPORT_SYMBOL_GPL(crypto_chain); + ++static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg); ++ + struct crypto_alg *crypto_mod_get(struct crypto_alg *alg) + { + return try_module_get(alg->cra_module) ? crypto_alg_get(alg) : NULL; +@@ -144,8 +146,11 @@ static struct crypto_alg *crypto_larval_add(const char *name, u32 type, + } + up_write(&crypto_alg_sem); + +- if (alg != &larval->alg) ++ if (alg != &larval->alg) { + kfree(larval); ++ if (crypto_is_larval(alg)) ++ alg = crypto_larval_wait(alg); ++ } + + return alg; + } diff --git a/kernel.spec b/kernel.spec index 4d2c24a..a1657fe 100644 --- a/kernel.spec +++ b/kernel.spec @@ -779,6 +779,9 @@ Patch25079: rt2800-rearrange-bbp-rfcsr-initialization.patch #CVE-2013-2897 rhbz 1000536 1002600 CVE-2013-2899 rhbz 1000373 1002604 Patch25099: HID-CVE-fixes.patch +#rhbz 1002351 +Patch25100: crypto-fix-race-in-larval-lookup.patch + # END OF PATCH DEFINITIONS %endif @@ -1493,6 +1496,9 @@ ApplyPatch HID-CVE-fixes.patch #rhbz 1000679 ApplyPatch rt2800-rearrange-bbp-rfcsr-initialization.patch +#rhbz1002351 +ApplyPatch crypto-fix-race-in-larval-lookup.patch + # END OF PATCH APPLICATIONS %endif @@ -2334,6 +2340,9 @@ fi # ||----w | # || || %changelog +* Wed Sep 11 2013 Neil Horman +- Fix race in crypto larval lookup + * Mon Sep 09 2013 Josh Boyer 3.10.11-100 - Fix system freeze due to incorrect rt2800 initialization (rhbz 1000679)