summaryrefslogtreecommitdiffstats
path: root/debian/patches/bugfix/all/module-disable-matching-missing-version-crc.patch
diff options
context:
space:
mode:
Diffstat (limited to 'debian/patches/bugfix/all/module-disable-matching-missing-version-crc.patch')
-rw-r--r--debian/patches/bugfix/all/module-disable-matching-missing-version-crc.patch23
1 files changed, 23 insertions, 0 deletions
diff --git a/debian/patches/bugfix/all/module-disable-matching-missing-version-crc.patch b/debian/patches/bugfix/all/module-disable-matching-missing-version-crc.patch
new file mode 100644
index 000000000..2ab62688a
--- /dev/null
+++ b/debian/patches/bugfix/all/module-disable-matching-missing-version-crc.patch
@@ -0,0 +1,23 @@
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Fri, 02 Dec 2016 23:06:18 +0000
+Subject: module: Disable matching missing version CRC
+Forwarded: not-needed
+
+This partly reverts commit cd3caefb4663e3811d37cc2afad3cce642d60061.
+We want to fail closed if a symbol version CRC is missing, as the
+alternative may allow subverting module signing.
+---
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -1313,9 +1313,8 @@ static int check_version(const struct lo
+ goto bad_version;
+ }
+
+- /* Broken toolchain. Warn once, then let it go.. */
+- pr_warn_once("%s: no symbol version for %s\n", info->name, symname);
+- return 1;
++ pr_warn("%s: no symbol version for %s\n", info->name, symname);
++ return 0;
+
+ bad_version:
+ pr_warn("%s: disagrees about version of symbol %s\n",