[ Sasha's backport helper bot ]
Hi,
The upstream commit SHA1 provided is correct: d65d76a44ffe74c73298ada25b0f578680576073
WARNING: Author mismatch between patch and upstream commit:
Backport author: Bin Lan <bin.lan.cn@xxxxxxxxxxxxx>
Commit author: Holger Dengler <dengler@xxxxxxxxxxxxx>
Status in newer kernel trees:
6.12.y | Present (exact SHA1)
6.11.y | Present (exact SHA1)
6.6.y | Not found
Note: The patch differs from the upstream commit:
---
--- - 2024-11-21 06:54:04.315780402 -0500
+++ /tmp/tmp.dzrYUeNwaI 2024-11-21 06:54:04.312033373 -0500
@@ -1,3 +1,5 @@
+[ Upstream commit d65d76a44ffe74c73298ada25b0f578680576073 ]
+
Wipe all sensitive data from stack for all IOCTLs, which convert a
clear-key into a protected- or secure-key.
@@ -6,18 +8,20 @@
Acked-by: Heiko Carstens <hca@xxxxxxxxxxxxx>
Signed-off-by: Holger Dengler <dengler@xxxxxxxxxxxxx>
Signed-off-by: Alexander Gordeev <agordeev@xxxxxxxxxxxxx>
+[ Resolve minor conflicts to fix CVE-2024-42156 ]
+Signed-off-by: Bin Lan <bin.lan.cn@xxxxxxxxxxxxx>
---
drivers/s390/crypto/pkey_api.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c
-index 179287157c2fe..1aa78a74fbade 100644
+index d2ffdf2491da..70fcb5c40cfe 100644
--- a/drivers/s390/crypto/pkey_api.c
+++ b/drivers/s390/crypto/pkey_api.c
-@@ -1374,9 +1374,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
+@@ -1366,9 +1366,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
rc = cca_clr2seckey(kcs.cardnr, kcs.domain, kcs.keytype,
kcs.clrkey.clrkey, kcs.seckey.seckey);
- pr_debug("%s cca_clr2seckey()=%d\n", __func__, rc);
+ DEBUG_DBG("%s cca_clr2seckey()=%d\n", __func__, rc);
- if (rc)
- break;
- if (copy_to_user(ucs, &kcs, sizeof(kcs)))
@@ -25,10 +29,10 @@
rc = -EFAULT;
memzero_explicit(&kcs, sizeof(kcs));
break;
-@@ -1409,9 +1407,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
+@@ -1401,9 +1399,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
kcp.protkey.protkey,
&kcp.protkey.len, &kcp.protkey.type);
- pr_debug("%s pkey_clr2protkey()=%d\n", __func__, rc);
+ DEBUG_DBG("%s pkey_clr2protkey()=%d\n", __func__, rc);
- if (rc)
- break;
- if (copy_to_user(ucp, &kcp, sizeof(kcp)))
@@ -36,7 +40,7 @@
rc = -EFAULT;
memzero_explicit(&kcp, sizeof(kcp));
break;
-@@ -1562,11 +1558,14 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
+@@ -1555,11 +1551,14 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
if (copy_from_user(&kcs, ucs, sizeof(kcs)))
return -EFAULT;
apqns = _copy_apqns_from_user(kcs.apqns, kcs.apqn_entries);
@@ -52,7 +56,7 @@
return -ENOMEM;
}
rc = pkey_clr2seckey2(apqns, kcs.apqn_entries,
-@@ -1576,15 +1575,18 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
+@@ -1569,15 +1568,18 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
kfree(apqns);
if (rc) {
kfree(kkey);
@@ -71,3 +75,6 @@
return -EFAULT;
}
}
+--
+2.43.0
+
---
Results of testing on various branches:
| Branch | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.6.y | Success | Success |
