Commit 216532e1 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'hardening-v6.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux 

Pull hardening updates from Kees Cook:
 "As is pretty normal for this tree, there are changes all over the
  place, especially for small fixes, selftest improvements, and improved
  macro usability.

  Some header changes ended up landing via this tree as they depended on
  the string header cleanups. Also, a notable set of changes is the work
  for the reintroduction of the UBSAN signed integer overflow sanitizer
  so that we can continue to make improvements on the compiler side to
  make this sanitizer a more viable future security hardening option.

  Summary:

   - string.h and related header cleanups (Tanzir Hasan, Andy
     Shevchenko)

   - VMCI memcpy() usage and struct_size() cleanups (Vasiliy Kovalev,
     Harshit Mogalapalli)

   - selftests/powerpc: Fix load_unaligned_zeropad build failure
     (Michael Ellerman)

   - hardened Kconfig fragment updates (Marco Elver, Lukas Bulwahn)

   - Handle tail call optimization better in LKDTM (Douglas Anderson)

   - Use long form types in overflow.h (Andy Shevchenko)

   - Add flags param to string_get_size() (Andy Shevchenko)

   - Add Coccinelle script for potential struct_size() use (Jacob
     Keller)

   - Fix objtool corner case under KCFI (Josh Poimboeuf)

   - Drop 13 year old backward compat CAP_SYS_ADMIN check (Jingzi Meng)

   - Add str_plural() helper (Michal Wajdeczko, Kees Cook)

   - Ignore relocations in .notes section

   - Add comments to explain how __is_constexpr() works

   - Fix m68k stack alignment expectations in stackinit Kunit test

   - Convert string selftests to KUnit

   - Add KUnit tests for fortified string functions

   - Improve reporting during fortified string warnings

   - Allow non-type arg to type_max() and type_min()

   - Allow strscpy() to be called with only 2 arguments

   - Add binary mode to leaking_addresses scanner

   - Various small cleanups to leaking_addresses scanner

   - Adding wrapping_*() arithmetic helper

   - Annotate initial signed integer wrap-around in refcount_t

   - Add explicit UBSAN section to MAINTAINERS

   - Fix UBSAN self-test warnings

   - Simplify UBSAN build via removal of CONFIG_UBSAN_SANITIZE_ALL

   - Reintroduce UBSAN's signed overflow sanitizer"

* tag 'hardening-v6.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (51 commits)
  selftests/powerpc: Fix load_unaligned_zeropad build failure
  string: Convert helpers selftest to KUnit
  string: Convert selftest to KUnit
  sh: Fix build with CONFIG_UBSAN=y
  compiler.h: Explain how __is_constexpr() works
  overflow: Allow non-type arg to type_max() and type_min()
  VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler()
  lib/string_helpers: Add flags param to string_get_size()
  x86, relocs: Ignore relocations in .notes section
  objtool: Fix UNWIND_HINT_{SAVE,RESTORE} across basic blocks
  overflow: Use POD in check_shl_overflow()
  lib: stackinit: Adjust target string to 8 bytes for m68k
  sparc: vdso: Disable UBSAN instrumentation
  kernel.h: Move lib/cmdline.c prototypes to string.h
  leaking_addresses: Provide mechanism to scan binary files
  leaking_addresses: Ignore input device status lines
  leaking_addresses: Use File::Temp for /tmp files
  MAINTAINERS: Update LEAKING_ADDRESSES details
  fortify: Improve buffer overflow reporting
  fortify: Add KUnit tests for runtime overflows
  ...
parents b32273ee 3fe1eb4d

Documentation/dev-tools/ubsan.rst

+8 −20
Original line number Diff line number Diff line
@@ -49,34 +49,22 @@ Report example 
Usage

-----



To enable UBSAN configure kernel with::

To enable UBSAN, configure the kernel with::



  CONFIG_UBSAN=y



and to check the entire kernel::



        CONFIG_UBSAN_SANITIZE_ALL=y



To enable instrumentation for specific files or directories, add a line

similar to the following to the respective kernel Makefile:



- For a single file (e.g. main.o)::



    UBSAN_SANITIZE_main.o := y



- For all files in one directory::



    UBSAN_SANITIZE := y



To exclude files from being instrumented even if

``CONFIG_UBSAN_SANITIZE_ALL=y``, use::

To exclude files from being instrumented use::



  UBSAN_SANITIZE_main.o := n



and::

and to exclude all targets in one directory use::



  UBSAN_SANITIZE := n



When disabled for all targets, specific files can be enabled using::



  UBSAN_SANITIZE_main.o := y



Detection of unaligned accesses controlled through the separate option -

CONFIG_UBSAN_ALIGNMENT. It's off by default on architectures that support

unaligned accesses (CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y). One could

MAINTAINERS

+22 −4
Original line number Diff line number Diff line
@@ -8989,9 +8989,10 @@ F: include/linux/string.h 
F:	include/linux/string_choices.h

F:	include/linux/string_helpers.h

F:	lib/string.c

F:	lib/string_kunit.c

F:	lib/string_helpers.c

F:	lib/test-string_helpers.c

F:	lib/test_string.c

F:	lib/string_helpers_kunit.c

F:	scripts/coccinelle/api/string_choices.cocci









GENERIC UIO DRIVER FOR PCI DEVICES









M:	"Michael S. Tsirkin" <mst@redhat.com>








@@ -12178,11 +12179,11 @@ F:	Documentation/scsi/53c700.rst







F:	drivers/scsi/53c700*

















LEAKING_ADDRESSES









M:	Tobin C. Harding <me@tobin.cc>









M:	Tycho Andersen <tycho@tycho.pizza>









R:	Kees Cook <keescook@chromium.org>









L:	linux-hardening@vger.kernel.org









S:	Maintained









T:	git git://git.kernel.org/pub/scm/linux/kernel/git/tobin/leaks.git









T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening









F:	scripts/leaking_addresses.pl

















LED SUBSYSTEM








@@ -22503,6 +22504,23 @@ F:	Documentation/block/ublk.rst







F:	drivers/block/ublk_drv.c









F:	include/uapi/linux/ublk_cmd.h

















UBSAN









M:	Kees Cook <keescook@chromium.org>









R:	Marco Elver <elver@google.com>









R:	Andrey Konovalov <andreyknvl@gmail.com>









R:	Andrey Ryabinin <ryabinin.a.a@gmail.com>









L:	kasan-dev@googlegroups.com









L:	linux-hardening@vger.kernel.org









S:	Supported









T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening









F:	Documentation/dev-tools/ubsan.rst









F:	include/linux/ubsan.h









F:	lib/Kconfig.ubsan









F:	lib/test_ubsan.c









F:	lib/ubsan.c









F:	scripts/Makefile.ubsan









K:	\bARCH_HAS_UBSAN\b

















UCLINUX (M68KNOMMU AND COLDFIRE)









M:	Greg Ungerer <gerg@linux-m68k.org>









L:	linux-m68k@lists.linux-m68k.org

























arch/arm/Kconfig



+1
−1






























Original line number
Diff line number
Diff line







@@ -29,7 +29,7 @@ config ARM







	select ARCH_HAVE_NMI_SAFE_CMPXCHG if CPU_V7 || CPU_V7M || CPU_V6K









	select ARCH_HAS_GCOV_PROFILE_ALL









	select ARCH_KEEP_MEMBLOCK









	select ARCH_HAS_UBSAN_SANITIZE_ALL









	select ARCH_HAS_UBSAN









	select ARCH_MIGHT_HAVE_PC_PARPORT









	select ARCH_OPTIONAL_KERNEL_RWX if ARCH_HAS_STRICT_KERNEL_RWX









	select ARCH_OPTIONAL_KERNEL_RWX_DEFAULT if CPU_V7
































arch/arm/boot/compressed/misc.c



+1
−1






























Original line number
Diff line number
Diff line







@@ -154,7 +154,7 @@ decompress_kernel(unsigned long output_start, unsigned long free_mem_ptr_p,







		putstr(" done, booting the kernel.\n");









}



















void fortify_panic(const char *name)









void __fortify_panic(const u8 reason, size_t avail, size_t size)









{









	error("detected buffer overflow");









}
























arch/arm/boot/compressed/misc.h



+1
−1






























Original line number
Diff line number
Diff line







@@ -10,7 +10,7 @@ void __div0(void);







void









decompress_kernel(unsigned long output_start, unsigned long free_mem_ptr_p,









		  unsigned long free_mem_ptr_end_p, int arch_id);









void fortify_panic(const char *name);









void __fortify_panic(const u8 reason, size_t avail, size_t size);









int atags_to_fdt(void *atag_list, void *fdt, int total_space);









uint32_t fdt_check_mem_start(uint32_t mem_start, const void *fdt);









int do_decompress(u8 *input, int len, u8 *output, void (*error)(char *x));