[kernel/f19] Resolves: rhbz1002351

[Josh Boyer]

commit 648716ae0362ff78f9022e9fde6bff072d27f382
Author: Neil Horman <nhorman at tuxdriver.com>
Date:   Wed Sep 11 11:03:20 2013 -0400

    Resolves: rhbz1002351

 crypto-fix-race-in-larval-lookup.patch |   44 ++++++++++++++++++++++++++++++++
 kernel.spec                            |    7 +++++
 2 files changed, 51 insertions(+), 0 deletions(-)
---
diff --git a/crypto-fix-race-in-larval-lookup.patch b/crypto-fix-race-in-larval-lookup.patch
new file mode 100644
index 0000000..d1b1941
--- /dev/null
+++ b/crypto-fix-race-in-larval-lookup.patch
@@ -0,0 +1,44 @@
+commit 77dbd7a95e4a4f15264c333a9e9ab97ee27dc2aa
+Author: Herbert Xu <herbert at gondor.apana.org.au>
+Date:   Sun Sep 8 14:33:50 2013 +1000
+
+    crypto: api - Fix race condition in larval lookup
+    
+    crypto_larval_lookup should only return a larval if it created one.
+    Any larval created by another entity must be processed through
+    crypto_larval_wait before being returned.
+    
+    Otherwise this will lead to a larval being killed twice, which
+    will most likely lead to a crash.
+    
+    Cc: stable at vger.kernel.org
+    Reported-by: Kees Cook <keescook at chromium.org>
+    Tested-by: Kees Cook <keescook at chromium.org>
+    Signed-off-by: Herbert Xu <herbert at gondor.apana.org.au>
+
+diff --git a/crypto/api.c b/crypto/api.c
+index 320ea4d..a2b39c5 100644
+--- a/crypto/api.c
++++ b/crypto/api.c
+@@ -34,6 +34,8 @@ EXPORT_SYMBOL_GPL(crypto_alg_sem);
+ BLOCKING_NOTIFIER_HEAD(crypto_chain);
+ EXPORT_SYMBOL_GPL(crypto_chain);
+ 
++static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg);
++
+ struct crypto_alg *crypto_mod_get(struct crypto_alg *alg)
+ {
+ 	return try_module_get(alg->cra_module) ? crypto_alg_get(alg) : NULL;
+@@ -144,8 +146,11 @@ static struct crypto_alg *crypto_larval_add(const char *name, u32 type,
+ 	}
+ 	up_write(&crypto_alg_sem);
+ 
+-	if (alg != &larval->alg)
++	if (alg != &larval->alg) {
+ 		kfree(larval);
++		if (crypto_is_larval(alg))
++			alg = crypto_larval_wait(alg);
++	}
+ 
+ 	return alg;
+ }
diff --git a/kernel.spec b/kernel.spec
index 838bb8f..44f4ffc 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -748,6 +748,9 @@ Patch25099: HID-CVE-fixes.patch
 #rhbz 963991
 Patch26000: acpi-pcie-hotplug-conflict.patch
 
+#rhbz 1002351
+Patch25100: crypto-fix-race-in-larval-lookup.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1444,6 +1447,9 @@ ApplyPatch rt2800-rearrange-bbp-rfcsr-initialization.patch
 #rhbz 963991
 ApplyPatch acpi-pcie-hotplug-conflict.patch
 
+#rhbz1002351
+ApplyPatch crypto-fix-race-in-larval-lookup.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2258,6 +2264,7 @@ fi
 %changelog
 * Wed Sep 11 2013 Neil Horman <nhorman at redhat.com>
 - Fix pcie/acpi hotplug conflict (rhbz 963991)
+- Fix race in crypto larval lookup
 
 * Wed Sep 11 2013 Justin M. Forbes <jforbes at fedoraproject.org>
 - Linux v3.11 rebase