target: CVE-2014-4027

Explicitly clear ramdisk_mcp backend pages

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4027
http://permalink.gmane.org/gmane.linux.scsi.target.devel/6618

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>

2 files changed, 47 insertions, 0 deletions

diff --git a/meta-fsl-ppc/recipes-kernel/linux/files/target-CVE-2014-4027.patch b/meta-fsl-ppc/recipes-kernel/linux/files/target-CVE-2014-4027.patch
new file mode 100644
index 00000000..0f8b49c1
--- /dev/null
+++ b/meta-fsl-ppc/recipes-kernel/linux/files/target-CVE-2014-4027.patch
@@ -0,0 +1,46 @@
+From 186f32e2096c7d9cd9106b8dedd79c596f4c8398 Mon Sep 17 00:00:00 2001
+From: "Nicholas A. Bellinger" <nab@linux-iscsi.org>
+Date: Mon, 16 Jun 2014 20:59:52 +0000
+Subject: [PATCH] target: Explicitly clear ramdisk_mcp backend pages
+
+[Note that a different patch to address the same issue went in during
+v3.15-rc1 (commit 4442dc8a), but includes a bunch of other changes that
+don't strictly apply to fixing the bug]
+
+This patch changes rd_allocate_sgl_table() to explicitly clear
+ramdisk_mcp backend memory pages by passing __GFP_ZERO into
+alloc_pages().
+
+This addresses a potential security issue where reading from a
+ramdisk_mcp could return sensitive information, and follows what
+>= v3.15 does to explicitly clear ramdisk_mcp memory at backend
+device initialization time.
+
+This fixes CVE-2014-4027
+Upstream-Status: Backport
+
+Reported-by: Jorge Daniel Sequeira Matias <jdsm@tecnico.ulisboa.pt>
+Cc: Jorge Daniel Sequeira Matias <jdsm@tecnico.ulisboa.pt>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+ drivers/target/target_core_rd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/target/target_core_rd.c b/drivers/target/target_core_rd.c
+index 131327a..9f6bede 100644
+--- a/drivers/target/target_core_rd.c
++++ b/drivers/target/target_core_rd.c
+@@ -179,7 +179,7 @@ static int rd_build_device_space(struct rd_dev *rd_dev)
+                                                - 1;
+ 
+                for (j = 0; j < sg_per_table; j++) {
+-                       pg = alloc_pages(GFP_KERNEL, 0);
++                       pg = alloc_pages(GFP_KERNEL | __GFP_ZERO, 0);
+                        if (!pg) {
+                                pr_err("Unable to allocate scatterlist"
+                                        " pages for struct rd_dev_sg_table\n");
+-- 
+1.9.1
+
diff --git a/meta-fsl-ppc/recipes-kernel/linux/linux-qoriq_3.12.bb b/meta-fsl-ppc/recipes-kernel/linux/linux-qoriq_3.12.bb
index de110465..a65c458d 100644
--- a/meta-fsl-ppc/recipes-kernel/linux/linux-qoriq_3.12.bb
+++ b/meta-fsl-ppc/recipes-kernel/linux/linux-qoriq_3.12.bb
@@ -29,6 +29,7 @@ SRC_URI = "git://git.freescale.com/ppc/sdk/linux.git;nobranch=1 \
     file://sctp-CVE-2014-7841.patch \
     file://0001-ALSA-CVE-2014-4656.patch \
     file://0002-ALSA-CVE-2014-4656.patch \
+    file://target-CVE-2014-4027.patch \
 "
 SRCREV = "6619b8b55796cdf0cec04b66a71288edd3057229"