Commit 0bf13a84 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'kernel-hardening-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux 

Pull kernel hardening updates from Kees Cook:

 - usercopy hardening expanded to check other allocation types (Matthew
   Wilcox, Yuanzheng Song)

 - arm64 stackleak behavioral improvements (Mark Rutland)

 - arm64 CFI code gen improvement (Sami Tolvanen)

 - LoadPin LSM block dev API adjustment (Christoph Hellwig)

 - Clang randstruct support (Bill Wendling, Kees Cook)

* tag 'kernel-hardening-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (34 commits)
  loadpin: stop using bdevname
  mm: usercopy: move the virt_addr_valid() below the is_vmalloc_addr()
  gcc-plugins: randstruct: Remove cast exception handling
  af_unix: Silence randstruct GCC plugin warning
  niu: Silence randstruct warnings
  big_keys: Use struct for internal payload
  gcc-plugins: Change all version strings match kernel
  randomize_kstack: Improve docs on requirements/rationale
  lkdtm/stackleak: fix CONFIG_GCC_PLUGIN_STACKLEAK=n
  arm64: entry: use stackleak_erase_on_task_stack()
  stackleak: add on/off stack variants
  lkdtm/stackleak: check stack boundaries
  lkdtm/stackleak: prevent unexpected stack usage
  lkdtm/stackleak: rework boundary management
  lkdtm/stackleak: avoid spurious failure
  stackleak: rework poison scanning
  stackleak: rework stack high bound handling
  stackleak: clarify variable names
  stackleak: rework stack low bound handling
  stackleak: remove redundant check
  ...
parents 51518aa6 ed5edd5a

Documentation/dontdiff

+1 −0
Original line number Diff line number Diff line
@@ -211,6 +211,7 @@ r200_reg_safe.h 
r300_reg_safe.h

r420_reg_safe.h

r600_reg_safe.h

randstruct.seed

randomize_layout_hash.h

randomize_layout_seed.h

recordmcount

Documentation/kbuild/reproducible-builds.rst

+4 −4
Original line number Diff line number Diff line
@@ -99,10 +99,10 @@ unreproducible parts can be treated as sources: 
Structure randomisation

-----------------------



If you enable ``CONFIG_GCC_PLUGIN_RANDSTRUCT``, you will need to

pre-generate the random seed in

``scripts/gcc-plugins/randomize_layout_seed.h`` so the same value

is used in rebuilds.

If you enable ``CONFIG_RANDSTRUCT``, you will need to pre-generate

the random seed in ``scripts/basic/randstruct.seed`` so the same

value is used by each build. See ``scripts/gen-randstruct-seed.sh``

for details.



Debug info conflicts

--------------------

Makefile

+1 −0
Original line number Diff line number Diff line
@@ -1011,6 +1011,7 @@ include-$(CONFIG_KASAN) += scripts/Makefile.kasan 
include-$(CONFIG_KCSAN)		+= scripts/Makefile.kcsan

include-$(CONFIG_UBSAN)		+= scripts/Makefile.ubsan

include-$(CONFIG_KCOV)		+= scripts/Makefile.kcov

include-$(CONFIG_RANDSTRUCT)	+= scripts/Makefile.randstruct

include-$(CONFIG_GCC_PLUGINS)	+= scripts/Makefile.gcc-plugins



include $(addprefix $(srctree)/, $(include-y))

arch/Kconfig

+1 −4
Original line number Diff line number Diff line
@@ -732,10 +732,7 @@ config ARCH_SUPPORTS_CFI_CLANG 
config CFI_CLANG

	bool "Use Clang's Control Flow Integrity (CFI)"

	depends on LTO_CLANG && ARCH_SUPPORTS_CFI_CLANG

	# Clang >= 12:

	# - https://bugs.llvm.org/show_bug.cgi?id=46258

	# - https://bugs.llvm.org/show_bug.cgi?id=47479

	depends on CLANG_VERSION >= 120000

	depends on CLANG_VERSION >= 140000

	select KALLSYMS

	help

	  This option enables Clang’s forward-edge Control Flow Integrity

arch/arm/vdso/Makefile

+1 −1
Original line number Diff line number Diff line
@@ -28,7 +28,7 @@ CPPFLAGS_vdso.lds += -P -C -U$(ARCH) 
CFLAGS_REMOVE_vdso.o = -pg



# Force -O2 to avoid libgcc dependencies

CFLAGS_REMOVE_vgettimeofday.o = -pg -Os $(GCC_PLUGINS_CFLAGS)

CFLAGS_REMOVE_vgettimeofday.o = -pg -Os $(RANDSTRUCT_CFLAGS) $(GCC_PLUGINS_CFLAGS)

ifeq ($(c-gettimeofday-y),)

CFLAGS_vgettimeofday.o = -O2

else