[meta-freescale] [meta-fsl-ppc][PATCH 2/2] target: CVE-2014-4027

[Sona Sarmadi]

Explicitly clear ramdisk_mcp backend pages

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4027
http://permalink.gmane.org/gmane.linux.scsi.target.devel/6618

Signed-off-by: Sona Sarmadi <sona.sarmadi at enea.com>
---
 .../linux/files/target-CVE-2014-4027.patch         | 46 ++++++++++++++++++++++
 recipes-kernel/linux/linux-qoriq_3.12.bb           |  1 +
 2 files changed, 47 insertions(+)
 create mode 100644 recipes-kernel/linux/files/target-CVE-2014-4027.patch

diff --git a/recipes-kernel/linux/files/target-CVE-2014-4027.patch b/recipes-kernel/linux/files/target-CVE-2014-4027.patch
new file mode 100644
index 0000000..0f8b49c
--- /dev/null
+++ b/recipes-kernel/linux/files/target-CVE-2014-4027.patch
@@ -0,0 +1,46 @@
+From 186f32e2096c7d9cd9106b8dedd79c596f4c8398 Mon Sep 17 00:00:00 2001
+From: "Nicholas A. Bellinger" <nab at linux-iscsi.org>
+Date: Mon, 16 Jun 2014 20:59:52 +0000
+Subject: [PATCH] target: Explicitly clear ramdisk_mcp backend pages
+
+[Note that a different patch to address the same issue went in during
+v3.15-rc1 (commit 4442dc8a), but includes a bunch of other changes that
+don't strictly apply to fixing the bug]
+
+This patch changes rd_allocate_sgl_table() to explicitly clear
+ramdisk_mcp backend memory pages by passing __GFP_ZERO into
+alloc_pages().
+
+This addresses a potential security issue where reading from a
+ramdisk_mcp could return sensitive information, and follows what
+>= v3.15 does to explicitly clear ramdisk_mcp memory at backend
+device initialization time.
+
+This fixes CVE-2014-4027
+Upstream-Status: Backport
+
+Reported-by: Jorge Daniel Sequeira Matias <jdsm at tecnico.ulisboa.pt>
+Cc: Jorge Daniel Sequeira Matias <jdsm at tecnico.ulisboa.pt>
+Signed-off-by: Nicholas Bellinger <nab at linux-iscsi.org>
+Signed-off-by: Jiri Slaby <jslaby at suse.cz>
+Signed-off-by: Sona Sarmadi <sona.sarmadi at enea.com>
+---
+ drivers/target/target_core_rd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/target/target_core_rd.c b/drivers/target/target_core_rd.c
+index 131327a..9f6bede 100644
+--- a/drivers/target/target_core_rd.c
++++ b/drivers/target/target_core_rd.c
+@@ -179,7 +179,7 @@ static int rd_build_device_space(struct rd_dev *rd_dev)
+ 						- 1;
+ 
+ 		for (j = 0; j < sg_per_table; j++) {
+-			pg = alloc_pages(GFP_KERNEL, 0);
++			pg = alloc_pages(GFP_KERNEL | __GFP_ZERO, 0);
+ 			if (!pg) {
+ 				pr_err("Unable to allocate scatterlist"
+ 					" pages for struct rd_dev_sg_table\n");
+-- 
+1.9.1
+
diff --git a/recipes-kernel/linux/linux-qoriq_3.12.bb b/recipes-kernel/linux/linux-qoriq_3.12.bb
index de11046..a65c458 100644
--- a/recipes-kernel/linux/linux-qoriq_3.12.bb
+++ b/recipes-kernel/linux/linux-qoriq_3.12.bb
@@ -29,6 +29,7 @@ SRC_URI = "git://git.freescale.com/ppc/sdk/linux.git;nobranch=1 \
     file://sctp-CVE-2014-7841.patch \
     file://0001-ALSA-CVE-2014-4656.patch \
     file://0002-ALSA-CVE-2014-4656.patch \
+    file://target-CVE-2014-4027.patch \
 "
 SRCREV = "6619b8b55796cdf0cec04b66a71288edd3057229"
 
-- 
1.9.1