Commit befaa609 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'hardening-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux 

Pull hardening updates from Kees Cook:
 "One of the more voluminous set of changes is for adding the new
  __counted_by annotation[1] to gain run-time bounds checking of
  dynamically sized arrays with UBSan.

   - Add LKDTM test for stuck CPUs (Mark Rutland)

   - Improve LKDTM selftest behavior under UBSan (Ricardo Cañuelo)

   - Refactor more 1-element arrays into flexible arrays (Gustavo A. R.
     Silva)

   - Analyze and replace strlcpy and strncpy uses (Justin Stitt, Azeem
     Shaikh)

   - Convert group_info.usage to refcount_t (Elena Reshetova)

   - Add __counted_by annotations (Kees Cook, Gustavo A. R. Silva)

   - Add Kconfig fragment for basic hardening options (Kees Cook, Lukas
     Bulwahn)

   - Fix randstruct GCC plugin performance mode to stay in groups (Kees
     Cook)

   - Fix strtomem() compile-time check for small sources (Kees Cook)"

* tag 'hardening-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (56 commits)
  hwmon: (acpi_power_meter) replace open-coded kmemdup_nul
  reset: Annotate struct reset_control_array with __counted_by
  kexec: Annotate struct crash_mem with __counted_by
  virtio_console: Annotate struct port_buffer with __counted_by
  ima: Add __counted_by for struct modsig and use struct_size()
  MAINTAINERS: Include stackleak paths in hardening entry
  string: Adjust strtomem() logic to allow for smaller sources
  hardening: x86: drop reference to removed config AMD_IOMMU_V2
  randstruct: Fix gcc-plugin performance mode to stay in group
  mailbox: zynqmp: Annotate struct zynqmp_ipi_pdata with __counted_by
  drivers: thermal: tsens: Annotate struct tsens_priv with __counted_by
  irqchip/imx-intmux: Annotate struct intmux_data with __counted_by
  KVM: Annotate struct kvm_irq_routing_table with __counted_by
  virt: acrn: Annotate struct vm_memory_region_batch with __counted_by
  hwmon: Annotate struct gsc_hwmon_platform_data with __counted_by
  sparc: Annotate struct cpuinfo_tree with __counted_by
  isdn: kcapi: replace deprecated strncpy with strscpy_pad
  isdn: replace deprecated strncpy with strscpy
  NFS/flexfiles: Annotate struct nfs4_ff_layout_segment with __counted_by
  nfs41: Annotate struct nfs4_file_layout_dsaddr with __counted_by
  ...
parents fdce8bd3 9cca73d7

MAINTAINERS

+6 −0
Original line number Diff line number Diff line
@@ -8649,6 +8649,8 @@ L: linux-hardening@vger.kernel.org 
S:	Maintained

T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening

F:	Documentation/kbuild/gcc-plugins.rst

F:	include/linux/stackleak.h

F:	kernel/stackleak.c

F:	scripts/Makefile.gcc-plugins

F:	scripts/gcc-plugins/








@@ -11415,16 +11417,20 @@ F:	usr/















KERNEL HARDENING (not covered by other areas)









M:	Kees Cook <keescook@chromium.org>









R:	Gustavo A. R. Silva <gustavoars@kernel.org>









L:	linux-hardening@vger.kernel.org









S:	Supported









T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening









F:	Documentation/ABI/testing/sysfs-kernel-oops_count









F:	Documentation/ABI/testing/sysfs-kernel-warn_count









F:	arch/*/configs/hardening.config









F:	include/linux/overflow.h









F:	include/linux/randomize_kstack.h









F:	kernel/configs/hardening.config









F:	mm/usercopy.c









K:	\b(add|choose)_random_kstack_offset\b









K:	\b__check_(object_size|heap_object)\b









K:	\b__counted_by\b

















KERNEL JANITORS









L:	kernel-janitors@vger.kernel.org
































arch/arm/configs/hardening.config
0 → 100644



+7
−0






























Original line number
Diff line number
Diff line









# Basic kernel hardening options (specific to arm)



















# Make sure PXN/PAN emulation is enabled.









CONFIG_CPU_SW_DOMAIN_PAN=y



















# Dangerous; old interfaces and needless additional attack surface.









# CONFIG_OABI_COMPAT is not set
























arch/arm64/configs/hardening.config
0 → 100644



+22
−0






























Original line number
Diff line number
Diff line









# Basic kernel hardening options (specific to arm64)



















# Make sure PAN emulation is enabled.









CONFIG_ARM64_SW_TTBR0_PAN=y



















# Software Shadow Stack or PAC









CONFIG_SHADOW_CALL_STACK=y



















# Pointer authentication (ARMv8.3 and later). If hardware actually supports









# it, one can turn off CONFIG_STACKPROTECTOR_STRONG with this enabled.









CONFIG_ARM64_PTR_AUTH=y









CONFIG_ARM64_PTR_AUTH_KERNEL=y



















# Available in ARMv8.5 and later.









CONFIG_ARM64_BTI=y









CONFIG_ARM64_BTI_KERNEL=y









CONFIG_ARM64_MTE=y









CONFIG_KASAN_HW_TAGS=y









CONFIG_ARM64_E0PD=y



















# Available in ARMv8.7 and later.









CONFIG_ARM64_EPAN=y
























arch/powerpc/configs/hardening.config
0 → 100644



+10
−0






























Original line number
Diff line number
Diff line









# PowerPC specific hardening options



















# Block kernel from unexpectedly reading userspace memory.









CONFIG_PPC_KUAP=y



















# Attack surface reduction.









# CONFIG_SCOM_DEBUGFS is not set



















# Disable internal kernel debugger.









# CONFIG_XMON is not set
























arch/sparc/kernel/cpumap.c



+1
−1






























Original line number
Diff line number
Diff line







@@ -50,7 +50,7 @@ struct cpuinfo_tree {

















	/* Offsets into nodes[] for each level of the tree */









	struct cpuinfo_level level[CPUINFO_LVL_MAX];









	struct cpuinfo_node  nodes[];









	struct cpuinfo_node  nodes[] __counted_by(total_nodes);









};