1. May 17, 2022
  2. May 16, 2022
  3. May 15, 2022
    • Aditya Garg's avatar
      efi: Do not import certificates from UEFI Secure Boot for T2 Macs · 155ca952
      Aditya Garg authored
      
      
      On Apple T2 Macs, when Linux attempts to read the db and dbx efi variables
      at early boot to load UEFI Secure Boot certificates, a page fault occurs
      in Apple firmware code and EFI runtime services are disabled with the
      following logs:
      
      [Firmware Bug]: Page fault caused by firmware at PA: 0xffffb1edc0068000
      WARNING: CPU: 3 PID: 104 at arch/x86/platform/efi/quirks.c:735 efi_crash_gracefully_on_page_fault+0x50/0xf0
      (Removed some logs from here)
      Call Trace:
       <TASK>
       page_fault_oops+0x4f/0x2c0
       ? search_bpf_extables+0x6b/0x80
       ? search_module_extables+0x50/0x80
       ? search_exception_tables+0x5b/0x60
       kernelmode_fixup_or_oops+0x9e/0x110
       __bad_area_nosemaphore+0x155/0x190
       bad_area_nosemaphore+0x16/0x20
       do_kern_addr_fault+0x8c/0xa0
       exc_page_fault+0xd8/0x180
       asm_exc_page_fault+0x1e/0x30
      (Removed some logs from here)
       ? __efi_call+0x28/0x30
       ? switch_mm+0x20/0x30
       ? efi_call_rts+0x19a/0x8e0
       ? process_one_work+0x222/0x3f0
       ? worker_thread+0x4a/0x3d0
       ? kthread+0x17a/0x1a0
       ? process_one_work+0x3f0/0x3f0
       ? set_kthread_struct+0x40/0x40
       ? ret_from_fork+0x22/0x30
       </TASK>
      ---[ end trace 1f82023595a5927f ]---
      efi: Froze efi_rts_wq and disabled EFI Runtime Services
      integrity: Couldn't get size: 0x8000000000000015
      integrity: MODSIGN: Couldn't get UEFI db list
      efi: EFI Runtime Services are disabled!
      integrity: Couldn't get size: 0x8000000000000015
      integrity: Couldn't get UEFI dbx list
      integrity: Couldn't get size: 0x8000000000000015
      integrity: Couldn't get mokx list
      integrity: Couldn't get size: 0x80000000
      
      So we avoid reading these UEFI variables and thus prevent the crash.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarAditya Garg <gargaditya08@live.com>
      Reviewed-by: default avatarMimi Zohar <zohar@linux.ibm.com>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
      155ca952
  4. May 13, 2022
  5. May 06, 2022
    • Mimi Zohar's avatar
      ima: support fs-verity file digest based version 3 signatures · 398c42e2
      Mimi Zohar authored
      IMA may verify a file's integrity against a "good" value stored in the
      'security.ima' xattr or as an appended signature, based on policy.  When
      the "good value" is stored in the xattr, the xattr may contain a file
      hash or signature.  In either case, the "good" value is preceded by a
      header.  The first byte of the xattr header indicates the type of data
      - hash, signature - stored in the xattr.  To support storing fs-verity
      signatures in the 'security.ima' xattr requires further differentiating
      the fs-verity signature from the existing IMA signature.
      
      In addition the signatures stored in 'security.ima' xattr, need to be
      disambiguated.  Instead of directly signing the fs-verity digest, a new
      signature format version 3 is defined as the hash of the ima_file_id
      structure, which identifies the type of signature and the digest.
      
      The IMA policy defines "which" files are to be measured, verified, and/or
      audited.  For those files being verified, the poli...
      398c42e2
  6. May 05, 2022
    • Mimi Zohar's avatar
      ima: permit fsverity's file digests in the IMA measurement list · 54f03916
      Mimi Zohar authored
      
      
      Permit fsverity's file digest (a hash of struct fsverity_descriptor) to
      be included in the IMA measurement list, based on the new measurement
      policy rule 'digest_type=verity' option.
      
      To differentiate between a regular IMA file hash from an fsverity's
      file digest, use the new d-ngv2 format field included in the ima-ngv2
      template.
      
      The following policy rule requires fsverity file digests and specifies
      the new 'ima-ngv2' template, which contains the new 'd-ngv2' field.  The
      policy rule may be constrained, for example based on a fsuuid or LSM
      label.
      
      measure func=FILE_CHECK digest_type=verity template=ima-ngv2
      
      Acked-by: default avatarStefan Berger <stefanb@linux.ibm.com>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
      54f03916
    • Mimi Zohar's avatar
      ima: define a new template field named 'd-ngv2' and templates · 989dc725
      Mimi Zohar authored
      
      
      In preparation to differentiate between unsigned regular IMA file
      hashes and fs-verity's file digests in the IMA measurement list,
      define a new template field named 'd-ngv2'.
      
      Also define two new templates named 'ima-ngv2' and 'ima-sigv2', which
      include the new 'd-ngv2' field.
      
      Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
      989dc725
  7. May 02, 2022
    • Mimi Zohar's avatar
      fs-verity: define a function to return the integrity protected file digest · 246d9216
      Mimi Zohar authored
      
      
      Define a function named fsverity_get_digest() to return the verity file
      digest and the associated hash algorithm (enum hash_algo).
      
      This assumes that before calling fsverity_get_digest() the file must have
      been opened, which is even true for the IMA measure/appraise on file
      open policy rule use case (func=FILE_CHECK).  do_open() calls vfs_open()
      immediately prior to ima_file_check().
      
      Acked-by: default avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
      246d9216
    • Mimi Zohar's avatar
      ima: use IMA default hash algorithm for integrity violations · 09091c44
      Mimi Zohar authored
      
      
      Integrity file violations - ToM/ToU, open writers - are recorded in the IMA
      measurement list, containing 0x00's in both the template data and file data
      hash fields, but 0xFF's are actually extended into TPM PCRs.  Although the
      original 'ima' template data field ('d') is limited to 20 bytes, the 'd-ng'
      template digest field is not.
      
      The violation file data hash template field ('d-ng') is unnecessarily hard
      coded to SHA1.  Instead of simply replacing the hard coded SHA1 hash
      algorithm with a larger hash algorithm, use the hash algorithm as defined
      in "ima_hash_algo".  ima_hash_algo is set to either the Kconfig IMA default
      hash algorithm or as defined on the boot command line (ima_hash=).
      
      Including a non-SHA1 file data hash algorithm in the 'd-ng' field of
      violations is a cosmetic change.  The template data hash field, which is
      extended into the TPM PCRs, is not affected by this change and should not
      affect attestation of the IMA measurement list.
      
      Tested-by: default avatarStefan Berger <stefanb@linux.ibm.com>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
      09091c44
    • Mimi Zohar's avatar
      ima: fix 'd-ng' comments and documentation · 64466462
      Mimi Zohar authored
      Initially the 'd-ng' template field did not prefix the digest with either
      "md5" or "sha1" hash algorithms.  Prior to being upstreamed this changed,
      but the comments and documentation were not updated.  Fix the comments
      and documentation.
      
      Fixes: 4d7aeee7
      
       ("ima: define new template ima-ng and template fields d-ng and n-ng")
      Reported-by: default avatarEric Biggers <ebiggers@kernel.org>
      Reviewed-by: default avatarStefan Berger <stefanb@linux.ibm.com>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
      64466462
  8. Apr 07, 2022
    • GUO Zihua's avatar
      ima: remove the IMA_TEMPLATE Kconfig option · 891163ad
      GUO Zihua authored
      The original 'ima' measurement list template contains a hash, defined
      as 20 bytes, and a null terminated pathname, limited to 255
      characters.  Other measurement list templates permit both larger hashes
      and longer pathnames.  When the "ima" template is configured as the
      default, a new measurement list template (ima_template=) must be
      specified before specifying a larger hash algorithm (ima_hash=) on the
      boot command line.
      
      To avoid this boot command line ordering issue, remove the legacy "ima"
      template configuration option, allowing it to still be specified on the
      boot command line.
      
      The root cause of this issue is that during the processing of ima_hash,
      we would try to check whether the hash algorithm is compatible with the
      template. If the template is not set at the moment we do the check, we
      check the algorithm against the configured default template. If the
      default template is "ima", then we reject any hash algorithm other than
      sha1 and md5.
      
      For example, if the compiled default template is "ima", and the default
      algorithm is sha1 (which is the current default). In the cmdline, we put
      in "ima_hash=sha256 ima_template=ima-ng". The expected behavior would be
      that ima starts with ima-ng as the template and sha256 as the hash
      algorithm. However, during the processing of "ima_hash=",
      "ima_template=" has not been processed yet, and hash_setup would check
      the configured hash algorithm against the compiled default: ima, and
      reject sha256. So at the end, the hash algorithm that is actually used
      will be sha1.
      
      With template "ima" removed from the configured default, we ensure that
      the default tempalte would at least be "ima-ng" which allows for
      basically any hash algorithm.
      
      This change would not break the algorithm compatibility checks for IMA.
      
      Fixes: 4286587d
      
       ("ima: add Kconfig default measurement list template")
      Signed-off-by: default avatarGUO Zihua <guozihua@huawei.com>
      Cc: <Stable@vger.kernel.org>
      Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
      891163ad
  9. Apr 05, 2022
  10. Apr 04, 2022
    • Linus Torvalds's avatar
      Linux 5.18-rc1 · 31231092
      Linus Torvalds authored
      31231092
    • Linus Torvalds's avatar
      Merge tag 'trace-v5.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · 09bb8856
      Linus Torvalds authored
      Pull more tracing updates from Steven Rostedt:
      
       - Rename the staging files to give them some meaning. Just
         stage1,stag2,etc, does not show what they are for
      
       - Check for NULL from allocation in bootconfig
      
       - Hold event mutex for dyn_event call in user events
      
       - Mark user events to broken (to work on the API)
      
       - Remove eBPF updates from user events
      
       - Remove user events from uapi header to keep it from being installed.
      
       - Move ftrace_graph_is_dead() into inline as it is called from hot
         paths and also convert it into a static branch.
      
      * tag 'trace-v5.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing: Move user_events.h temporarily out of include/uapi
        ftrace: Make ftrace_graph_is_dead() a static branch
        tracing: Set user_events to BROKEN
        tracing/user_events: Remove eBPF interfaces
        tracing/user_events: Hold event_mutex during dyn_event_add
        proc: bootconfig: Add null pointer check
        tracing: Rename the staging files for trace_events
      09bb8856
    • Linus Torvalds's avatar
      Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux · 34a53ff9
      Linus Torvalds authored
      Pull clk fix from Stephen Boyd:
       "A single revert to fix a boot regression seen when clk_put() started
        dropping rate range requests. It's best to keep various systems
        booting so we'll kick this out and try again next time"
      
      * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
        Revert "clk: Drop the rate range on clk_put()"
      34a53ff9
    • Linus Torvalds's avatar
      Merge tag 'x86-urgent-2022-04-03' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 8b5656bc
      Linus Torvalds authored
      Pull x86 fixes from Thomas Gleixner:
       "A set of x86 fixes and updates:
      
         - Make the prctl() for enabling dynamic XSTATE components correct so
           it adds the newly requested feature to the permission bitmap
           instead of overwriting it. Add a selftest which validates that.
      
         - Unroll string MMIO for encrypted SEV guests as the hypervisor
           cannot emulate it.
      
         - Handle supervisor states correctly in the FPU/XSTATE code so it
           takes the feature set of the fpstate buffer into account. The
           feature sets can differ between host and guest buffers. Guest
           buffers do not contain supervisor states. So far this was not an
           issue, but with enabling PASID it needs to be handled in the buffer
           offset calculation and in the permission bitmaps.
      
         - Avoid a gazillion of repeated CPUID invocations in by caching the
           values early in the FPU/XSTATE code.
      
         - Enable CONFIG_WERROR in x86 defconfig.
      
         - Make the X86 defconfigs more useful by adapting them to Y2022
           reality"
      
      * tag 'x86-urgent-2022-04-03' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/fpu/xstate: Consolidate size calculations
        x86/fpu/xstate: Handle supervisor states in XSTATE permissions
        x86/fpu/xsave: Handle compacted offsets correctly with supervisor states
        x86/fpu: Cache xfeature flags from CPUID
        x86/fpu/xsave: Initialize offset/size cache early
        x86/fpu: Remove unused supervisor only offsets
        x86/fpu: Remove redundant XCOMP_BV initialization
        x86/sev: Unroll string mmio with CC_ATTR_GUEST_UNROLL_STRING_IO
        x86/config: Make the x86 defconfigs a bit more usable
        x86/defconfig: Enable WERROR
        selftests/x86/amx: Update the ARCH_REQ_XCOMP_PERM test
        x86/fpu/xstate: Fix the ARCH_REQ_XCOMP_PERM implementation
      8b5656bc
    • Linus Torvalds's avatar
      Merge tag 'core-urgent-2022-04-03' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · e235f419
      Linus Torvalds authored
      Pull RT signal fix from Thomas Gleixner:
       "Revert the RT related signal changes. They need to be reworked and
        generalized"
      
      * tag 'core-urgent-2022-04-03' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        Revert "signal, x86: Delay calling signals in atomic on RT enabled kernels"
      e235f419
    • Linus Torvalds's avatar
      Merge tag 'dma-mapping-5.18-1' of git://git.infradead.org/users/hch/dma-mapping · 63d12cc3
      Linus Torvalds authored
      Pull more dma-mapping updates from Christoph Hellwig:
      
       - fix a regression in dma remap handling vs AMD memory encryption (me)
      
       - finally kill off the legacy PCI DMA API (Christophe JAILLET)
      
      * tag 'dma-mapping-5.18-1' of git://git.infradead.org/users/hch/dma-mapping:
        dma-mapping: move pgprot_decrypted out of dma_pgprot
        PCI/doc: cleanup references to the legacy PCI DMA API
        PCI: Remove the deprecated "pci-dma-compat.h" API
      63d12cc3
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm · 5dee8721
      Linus Torvalds authored
      Pull ARM fixes from Russell King:
      
       - avoid unnecessary rebuilds for library objects
      
       - fix return value of __setup handlers
      
       - fix invalid input check for "crashkernel=" kernel option
      
       - silence KASAN warnings in unwind_frame
      
      * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm:
        ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame()
        ARM: 9190/1: kdump: add invalid input check for 'crashkernel=0'
        ARM: 9187/1: JIVE: fix return value of __setup handler
        ARM: 9189/1: decompressor: fix unneeded rebuilds of library objects
      5dee8721
  11. Apr 03, 2022
  12. Apr 02, 2022