Commit 48cfc579 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'hardening-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux 

Pull hardening updates from Kees Cook:

 - Update overflow helpers to ease refactoring of on-stack flex array
   instances (Gustavo A. R. Silva, Kees Cook)

 - lkdtm: Use SLAB_NO_MERGE instead of constructors (Harry Yoo)

 - Simplify CONFIG_CC_HAS_COUNTED_BY (Jan Hendrik Farr)

 - Disable u64 usercopy KUnit test on 32-bit SPARC (Thomas Weißschuh)

 - Add missed designated initializers now exposed by fixed randstruct
   (Nathan Chancellor, Kees Cook)

 - Document compilers versions for __builtin_dynamic_object_size

 - Remove ARM_SSP_PER_TASK GCC plugin

 - Fix GCC plugin randstruct, add selftests, and restore COMPILE_TEST
   builds

 - Kbuild: induce full rebuilds when dependencies change with GCC
   plugins, the Clang sanitizer .scl file, or the randstruct seed.

 - Kbuild: Switch from -Wvla to -Wvla-larger-than=1

 - Correct several __nonstring uses for -Wunterminated-string-initialization

* tag 'hardening-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (23 commits)
  Revert "hardening: Disable GCC randstruct for COMPILE_TEST"
  lib/tests: randstruct: Add deep function pointer layout test
  lib/tests: Add randstruct KUnit test
  randstruct: gcc-plugin: Remove bogus void member
  net: qede: Initialize qede_ll_ops with designated initializer
  scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
  md/bcache: Mark __nonstring look-up table
  integer-wrap: Force full rebuild when .scl file changes
  randstruct: Force full rebuild when seed changes
  gcc-plugins: Force full rebuild when plugins change
  kbuild: Switch from -Wvla to -Wvla-larger-than=1
  hardening: simplify CONFIG_CC_HAS_COUNTED_BY
  overflow: Fix direct struct member initialization in _DEFINE_FLEX()
  kunit/overflow: Add tests for STACK_FLEX_ARRAY_SIZE() helper
  overflow: Add STACK_FLEX_ARRAY_SIZE() helper
  input/joystick: magellan: Mark __nonstring look-up table const
  watchdog: exar: Shorten identity name to fit correctly
  mod_devicetable: Enlarge the maximum platform_device_id name length
  overflow: Clarify expectations for getting DEFINE_FLEX variable sizes
  compiler_types: Identify compiler versions for __builtin_dynamic_object_size
  ...
parents 96d40793 f0cd6012

MAINTAINERS

+1 −0
Original line number Diff line number Diff line
@@ -12935,6 +12935,7 @@ F: include/linux/overflow.h 
F:	include/linux/randomize_kstack.h

F:	include/linux/ucopysize.h

F:	kernel/configs/hardening.config

F:	lib/tests/randstruct_kunit.c

F:	lib/tests/usercopy_kunit.c

F:	mm/usercopy.c

F:	security/Kconfig.hardening

arch/arm/Kconfig

+1 −2
Original line number Diff line number Diff line
@@ -1380,8 +1380,7 @@ config CC_HAVE_STACKPROTECTOR_TLS 
config STACKPROTECTOR_PER_TASK

	bool "Use a unique stack canary value for each task"

	depends on STACKPROTECTOR && CURRENT_POINTER_IN_TPIDRURO && !XIP_DEFLATED_DATA

	depends on GCC_PLUGINS || CC_HAVE_STACKPROTECTOR_TLS

	select GCC_PLUGIN_ARM_SSP_PER_TASK if !CC_HAVE_STACKPROTECTOR_TLS

	depends on CC_HAVE_STACKPROTECTOR_TLS

	default y

	help

	  Due to the fact that GCC uses an ordinary symbol reference from

arch/arm/boot/compressed/Makefile

+1 −1
Original line number Diff line number Diff line
@@ -96,7 +96,7 @@ KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING 


ccflags-y := -fpic $(call cc-option,-mno-single-pic-base,) -fno-builtin \

	     -I$(srctree)/scripts/dtc/libfdt -fno-stack-protector \

	     -I$(obj) $(DISABLE_ARM_SSP_PER_TASK_PLUGIN)

	     -I$(obj)

ccflags-remove-$(CONFIG_FUNCTION_TRACER) += -pg

asflags-y := -DZIMAGE

drivers/md/bcache/super.c

+2 −1
Original line number Diff line number Diff line
@@ -545,7 +545,8 @@ static struct uuid_entry *uuid_find(struct cache_set *c, const char *uuid) 


static struct uuid_entry *uuid_find_empty(struct cache_set *c)

{

	static const char zero_uuid[16] = { 0 };

	static const char zero_uuid[16] __nonstring =

		{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };



	return uuid_find(c, zero_uuid);

}

drivers/misc/lkdtm/heap.c

+3 −14
Original line number Diff line number Diff line
@@ -355,23 +355,12 @@ static void lkdtm_SLAB_FREE_PAGE(void) 
	free_page(p);

}



/*

 * We have constructors to keep the caches distinctly separated without

 * needing to boot with "slab_nomerge".

 */

static void ctor_double_free(void *region)

{ }

static void ctor_a(void *region)

{ }

static void ctor_b(void *region)

{ }



void __init lkdtm_heap_init(void)

{

	double_free_cache = kmem_cache_create("lkdtm-heap-double_free",

					      64, 0, 0, ctor_double_free);

	a_cache = kmem_cache_create("lkdtm-heap-a", 64, 0, 0, ctor_a);

	b_cache = kmem_cache_create("lkdtm-heap-b", 64, 0, 0, ctor_b);

					      64, 0, SLAB_NO_MERGE, NULL);

	a_cache = kmem_cache_create("lkdtm-heap-a", 64, 0, SLAB_NO_MERGE, NULL);

	b_cache = kmem_cache_create("lkdtm-heap-b", 64, 0, SLAB_NO_MERGE, NULL);

}



void __exit lkdtm_heap_exit(void)