[kernel/f18] Resolves: rhbz1002351

[Neil Horman]

commit f9abad3a38c84b4396166c8ef45e79290fbdc537
Author: Neil Horman <nhorman at tuxdriver.com>
Date:   Wed Sep 11 11:03:20 2013 -0400

    Resolves: rhbz1002351

 crypto-fix-race-in-larval-lookup.patch |   44 ++++++++++++++++++++++++++++++++
 kernel.spec                            |    9 ++++++
 2 files changed, 53 insertions(+), 0 deletions(-)
---
diff --git a/crypto-fix-race-in-larval-lookup.patch b/crypto-fix-race-in-larval-lookup.patch
new file mode 100644
index 0000000..d1b1941
--- /dev/null
+++ b/crypto-fix-race-in-larval-lookup.patch
@@ -0,0 +1,44 @@
+commit 77dbd7a95e4a4f15264c333a9e9ab97ee27dc2aa
+Author: Herbert Xu <herbert at gondor.apana.org.au>
+Date:   Sun Sep 8 14:33:50 2013 +1000
+
+    crypto: api - Fix race condition in larval lookup
+    
+    crypto_larval_lookup should only return a larval if it created one.
+    Any larval created by another entity must be processed through
+    crypto_larval_wait before being returned.
+    
+    Otherwise this will lead to a larval being killed twice, which
+    will most likely lead to a crash.
+    
+    Cc: stable at vger.kernel.org
+    Reported-by: Kees Cook <keescook at chromium.org>
+    Tested-by: Kees Cook <keescook at chromium.org>
+    Signed-off-by: Herbert Xu <herbert at gondor.apana.org.au>
+
+diff --git a/crypto/api.c b/crypto/api.c
+index 320ea4d..a2b39c5 100644
+--- a/crypto/api.c
++++ b/crypto/api.c
+@@ -34,6 +34,8 @@ EXPORT_SYMBOL_GPL(crypto_alg_sem);
+ BLOCKING_NOTIFIER_HEAD(crypto_chain);
+ EXPORT_SYMBOL_GPL(crypto_chain);
+ 
++static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg);
++
+ struct crypto_alg *crypto_mod_get(struct crypto_alg *alg)
+ {
+ 	return try_module_get(alg->cra_module) ? crypto_alg_get(alg) : NULL;
+@@ -144,8 +146,11 @@ static struct crypto_alg *crypto_larval_add(const char *name, u32 type,
+ 	}
+ 	up_write(&crypto_alg_sem);
+ 
+-	if (alg != &larval->alg)
++	if (alg != &larval->alg) {
+ 		kfree(larval);
++		if (crypto_is_larval(alg))
++			alg = crypto_larval_wait(alg);
++	}
+ 
+ 	return alg;
+ }
diff --git a/kernel.spec b/kernel.spec
index 4d2c24a..a1657fe 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -779,6 +779,9 @@ Patch25079: rt2800-rearrange-bbp-rfcsr-initialization.patch
 #CVE-2013-2897 rhbz 1000536 1002600 CVE-2013-2899 rhbz 1000373 1002604
 Patch25099: HID-CVE-fixes.patch
 
+#rhbz 1002351
+Patch25100: crypto-fix-race-in-larval-lookup.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1493,6 +1496,9 @@ ApplyPatch HID-CVE-fixes.patch
 #rhbz 1000679
 ApplyPatch rt2800-rearrange-bbp-rfcsr-initialization.patch
 
+#rhbz1002351
+ApplyPatch crypto-fix-race-in-larval-lookup.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2334,6 +2340,9 @@ fi
 #                 ||----w |
 #                 ||     ||
 %changelog
+* Wed Sep 11 2013 Neil Horman <nhorman at redhat.com>
+- Fix race in crypto larval lookup
+
 * Mon Sep 09 2013 Josh Boyer <jwboyer at fedoraproject.org> 3.10.11-100
 - Fix system freeze due to incorrect rt2800 initialization (rhbz 1000679)