Commit 51094a24 authored Dec 23, 2022 by Linus Torvalds

Merge tag 'hardening-v6.2-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull kernel hardening fixes from Kees Cook:

 - Fix CFI failure with KASAN (Sami Tolvanen)

 - Fix LKDTM + CFI under GCC 7 and 8 (Kristina Martsenko)

 - Limit CONFIG_ZERO_CALL_USED_REGS to Clang > 15.0.6 (Nathan
   Chancellor)

 - Ignore "contents" argument in LoadPin's LSM hook handling

 - Fix paste-o in /sys/kernel/warn_count API docs

 - Use READ_ONCE() consistently for oops/warn limit reading

* tag 'hardening-v6.2-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  cfi: Fix CFI failure with KASAN
  exit: Use READ_ONCE() for all oops/warn limit reads
  security: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6
  lkdtm: cfi: Make PAC test work with GCC 7 and 8
  docs: Fix path paste-o for /sys/kernel/warn_count
  LoadPin: Ignore the "contents" argument of the LSM hooks

parents edb23125 cf801640

Documentation/ABI/testing/sysfs-kernel-warn_count

+1 −1

Original line number	Original line	Diff line number	Diff line
	What: /sys/kernel/oops_count		What: /sys/kernel/warn_count
	Date: November 2022		Date: November 2022
	KernelVersion: 6.2.0		KernelVersion: 6.2.0
	Contact: Linux Kernel Hardening List <linux-hardening@vger.kernel.org>		Contact: Linux Kernel Hardening List <linux-hardening@vger.kernel.org>

drivers/misc/lkdtm/cfi.c

+5 −1

Original line number	Original line	Diff line number	Diff line
	@@ -54,7 +54,11 @@ static void lkdtm_CFI_FORWARD_PROTO(void)
	# ifdef CONFIG_ARM64_BTI_KERNEL		# ifdef CONFIG_ARM64_BTI_KERNEL
	# define __no_pac "branch-protection=bti"		# define __no_pac "branch-protection=bti"
	# else		# else
			# ifdef CONFIG_CC_HAS_BRANCH_PROT_PAC_RET
	# define __no_pac "branch-protection=none"		# define __no_pac "branch-protection=none"
			# else
			# define __no_pac "sign-return-address=none"
			# endif
	# endif		# endif
	# define __no_ret_protection __noscs __attribute__((__target__(__no_pac)))		# define __no_ret_protection __noscs __attribute__((__target__(__no_pac)))
	#else		#else

kernel/Makefile

+0 −3

Original line number	Original line	Diff line number	Diff line
	@@ -41,9 +41,6 @@ UBSAN_SANITIZE_kcov.o := n
	KMSAN_SANITIZE_kcov.o := n		KMSAN_SANITIZE_kcov.o := n
	CFLAGS_kcov.o := $(call cc-option, -fno-conserve-stack) -fno-stack-protector		CFLAGS_kcov.o := $(call cc-option, -fno-conserve-stack) -fno-stack-protector

	# Don't instrument error handlers
	CFLAGS_REMOVE_cfi.o := $(CC_FLAGS_CFI)

	obj-y += sched/		obj-y += sched/
	obj-y += locking/		obj-y += locking/
	obj-y += power/		obj-y += power/

kernel/exit.c

+4 −2

Original line number	Original line	Diff line number	Diff line
	@@ -931,6 +931,7 @@ void __noreturn make_task_dead(int signr)
	* Then do everything else.		* Then do everything else.
	*/		*/
	struct task_struct *tsk = current;		struct task_struct *tsk = current;
			unsigned int limit;

	if (unlikely(in_interrupt()))		if (unlikely(in_interrupt()))
	panic("Aiee, killing interrupt handler!");		panic("Aiee, killing interrupt handler!");
	@@ -954,8 +955,9 @@ void __noreturn make_task_dead(int signr)
	* To make sure this can't happen, place an upper bound on how often the		* To make sure this can't happen, place an upper bound on how often the
	* kernel may oops without panic().		* kernel may oops without panic().
	*/		*/
	if (atomic_inc_return(&oops_count) >= READ_ONCE(oops_limit) && oops_limit)		limit = READ_ONCE(oops_limit);
	panic("Oopsed too often (kernel.oops_limit is %d)", oops_limit);		if (atomic_inc_return(&oops_count) >= limit && limit)
			panic("Oopsed too often (kernel.oops_limit is %d)", limit);

	/*		/*
	* We're taking recursive faults here in make_task_dead. Safest is to just		* We're taking recursive faults here in make_task_dead. Safest is to just

kernel/panic.c

+5 −2

Original line number	Original line	Diff line number	Diff line
	@@ -232,12 +232,15 @@ static void panic_print_sys_info(bool console_flush)

	void check_panic_on_warn(const char *origin)		void check_panic_on_warn(const char *origin)
	{		{
			unsigned int limit;

	if (panic_on_warn)		if (panic_on_warn)
	panic("%s: panic_on_warn set ...\n", origin);		panic("%s: panic_on_warn set ...\n", origin);

	if (atomic_inc_return(&warn_count) >= READ_ONCE(warn_limit) && warn_limit)		limit = READ_ONCE(warn_limit);
			if (atomic_inc_return(&warn_count) >= limit && limit)
	panic("%s: system warned too often (kernel.warn_limit is %d)",		panic("%s: system warned too often (kernel.warn_limit is %d)",
	origin, warn_limit);		origin, limit);
	}		}

	/**		/**