Commit 4a7d37e8 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'hardening-v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux 

Pull hardening updates from Kees Cook:
 "Beyond some specific LoadPin, UBSAN, and fortify features, there are
  other fixes scattered around in various subsystems where maintainers
  were okay with me carrying them in my tree or were non-responsive but
  the patches were reviewed by others:

   - Replace 0-length and 1-element arrays with flexible arrays in
     various subsystems (Paulo Miguel Almeida, Stephen Rothwell, Kees
     Cook)

   - randstruct: Disable Clang 15 support (Eric Biggers)

   - GCC plugins: Drop -std=gnu++11 flag (Sam James)

   - strpbrk(): Refactor to use strchr() (Andy Shevchenko)

   - LoadPin LSM: Allow root filesystem switching when non-enforcing

   - fortify: Use dynamic object size hints when available

   - ext4: Fix CFI function prototype mismatch

   - Nouveau: Fix DP buffer size arguments

   - hisilicon: Wipe entire crypto DMA pool on error

   - coda: Fully allocate sig_inputArgs

   - UBSAN: Improve arm64 trap code reporting

   - copy_struct_from_user(): Add minimum bounds check on kernel buffer
     size"

* tag 'hardening-v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  randstruct: disable Clang 15 support
  uaccess: Add minimum bounds check on kernel buffer size
  arm64: Support Clang UBSAN trap codes for better reporting
  coda: Avoid partial allocation of sig_inputArgs
  gcc-plugins: drop -std=gnu++11 to fix GCC 13 build
  lib/string: Use strchr() in strpbrk()
  crypto: hisilicon: Wipe entire pool on error
  net/i40e: Replace 0-length array with flexible array
  io_uring: Replace 0-length array with flexible array
  ext4: Fix function prototype mismatch for ext4_feat_ktype
  i915/gvt: Replace one-element array with flexible-array member
  drm/nouveau/disp: Fix nvif_outp_acquire_dp() argument size
  LoadPin: Allow filesystem switch when not enforcing
  LoadPin: Move pin reporting cleanly out of locking
  LoadPin: Refactor sysctl initialization
  LoadPin: Refactor read-only check into a helper
  ARM: ixp4xx: Replace 0-length arrays with flexible arrays
  fortify: Use __builtin_dynamic_object_size() when available
  rxrpc: replace zero-lenth array with DECLARE_FLEX_ARRAY() helper
parents 902d9fcd 78f7a3fd

arch/arm64/include/asm/brk-imm.h

+3 −0
Original line number Diff line number Diff line
@@ -17,6 +17,7 @@ 
 * 0x401: for compile time BRK instruction

 * 0x800: kernel-mode BUG() and WARN() traps

 * 0x9xx: tag-based KASAN trap (allowed values 0x900 - 0x9ff)

 * 0x55xx: Undefined Behavior Sanitizer traps ('U' << 8)

 * 0x8xxx: Control-Flow Integrity traps

 */

#define KPROBES_BRK_IMM			0x004
@@ -28,6 +29,8 @@ 
#define BUG_BRK_IMM			0x800

#define KASAN_BRK_IMM			0x900

#define KASAN_BRK_MASK			0x0ff

#define UBSAN_BRK_IMM			0x5500

#define UBSAN_BRK_MASK			0x00ff



#define CFI_BRK_IMM_TARGET		GENMASK(4, 0)

#define CFI_BRK_IMM_TYPE		GENMASK(9, 5)

arch/arm64/kernel/traps.c

+21 −0
Original line number Diff line number Diff line
@@ -26,6 +26,7 @@ 
#include <linux/syscalls.h>

#include <linux/mm_types.h>

#include <linux/kasan.h>

#include <linux/ubsan.h>

#include <linux/cfi.h>



#include <asm/atomic.h>
@@ -1074,6 +1075,19 @@ static struct break_hook kasan_break_hook = { 
};

#endif



#ifdef CONFIG_UBSAN_TRAP

static int ubsan_handler(struct pt_regs *regs, unsigned long esr)

{

	die(report_ubsan_failure(regs, esr & UBSAN_BRK_MASK), regs, esr);

	return DBG_HOOK_HANDLED;

}



static struct break_hook ubsan_break_hook = {

	.fn	= ubsan_handler,

	.imm	= UBSAN_BRK_IMM,

	.mask	= UBSAN_BRK_MASK,

};

#endif



#define esr_comment(esr) ((esr) & ESR_ELx_BRK64_ISS_COMMENT_MASK)
@@ -1091,6 +1105,10 @@ int __init early_brk64(unsigned long addr, unsigned long esr, 
#ifdef CONFIG_KASAN_SW_TAGS

	if ((esr_comment(esr) & ~KASAN_BRK_MASK) == KASAN_BRK_IMM)

		return kasan_handler(regs, esr) != DBG_HOOK_HANDLED;

#endif

#ifdef CONFIG_UBSAN_TRAP

	if ((esr_comment(esr) & ~UBSAN_BRK_MASK) == UBSAN_BRK_IMM)

		return ubsan_handler(regs, esr) != DBG_HOOK_HANDLED;

#endif

	return bug_handler(regs, esr) != DBG_HOOK_HANDLED;

}
@@ -1104,6 +1122,9 @@ void __init trap_init(void) 
	register_kernel_break_hook(&fault_break_hook);

#ifdef CONFIG_KASAN_SW_TAGS

	register_kernel_break_hook(&kasan_break_hook);

#endif

#ifdef CONFIG_UBSAN_TRAP

	register_kernel_break_hook(&ubsan_break_hook);

#endif

	debug_traps_init();

}

drivers/crypto/hisilicon/sgl.c

+1 −2
Original line number Diff line number Diff line
@@ -124,9 +124,8 @@ struct hisi_acc_sgl_pool *hisi_acc_create_sgl_pool(struct device *dev, 
	for (j = 0; j < i; j++) {

		dma_free_coherent(dev, block_size, block[j].sgl,

				  block[j].sgl_dma);

		memset(block + j, 0, sizeof(*block));

	}

	kfree(pool);

	kfree_sensitive(pool);

	return ERR_PTR(-ENOMEM);

}

EXPORT_SYMBOL_GPL(hisi_acc_create_sgl_pool);

drivers/gpu/drm/i915/gvt/firmware.c

+2 −2
Original line number Diff line number Diff line
@@ -45,7 +45,7 @@ struct gvt_firmware_header { 
	u64 cfg_space_offset;	/* offset in the file */

	u64 mmio_size;

	u64 mmio_offset;	/* offset in the file */

	unsigned char data[1];

	unsigned char data[];

};



#define dev_to_drm_minor(d) dev_get_drvdata((d))
@@ -77,7 +77,7 @@ static int expose_firmware_sysfs(struct intel_gvt *gvt) 
	unsigned long size, crc32_start;

	int ret;



	size = sizeof(*h) + info->mmio_size + info->cfg_space_size;

	size = offsetof(struct gvt_firmware_header, data) + info->mmio_size + info->cfg_space_size;

	firmware = vzalloc(size);

	if (!firmware)

		return -ENOMEM;

drivers/gpu/drm/nouveau/include/nvif/outp.h

+2 −1
Original line number Diff line number Diff line
@@ -3,6 +3,7 @@ 
#define __NVIF_OUTP_H__

#include <nvif/object.h>

#include <nvif/if0012.h>

#include <drm/display/drm_dp.h>

struct nvif_disp;



struct nvif_outp {
@@ -21,7 +22,7 @@ int nvif_outp_acquire_rgb_crt(struct nvif_outp *); 
int nvif_outp_acquire_tmds(struct nvif_outp *, int head,

			   bool hdmi, u8 max_ac_packet, u8 rekey, u8 scdc, bool hda);

int nvif_outp_acquire_lvds(struct nvif_outp *, bool dual, bool bpc8);

int nvif_outp_acquire_dp(struct nvif_outp *, u8 dpcd[16],

int nvif_outp_acquire_dp(struct nvif_outp *outp, u8 dpcd[DP_RECEIVER_CAP_SIZE],

			 int link_nr, int link_bw, bool hda, bool mst);

void nvif_outp_release(struct nvif_outp *);

int nvif_outp_infoframe(struct nvif_outp *, u8 type, struct nvif_outp_infoframe_v0 *, u32 size);