Commit 6991a564 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'hardening-v5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux 

Pull hardening updates from Kees Cook:

 - Fix Sparse warnings with randomizd kstack (GONG, Ruiqi)

 - Replace uintptr_t with unsigned long in usercopy (Jason A. Donenfeld)

 - Fix Clang -Wforward warning in LKDTM (Justin Stitt)

 - Fix comment to correctly refer to STRICT_DEVMEM (Lukas Bulwahn)

 - Introduce dm-verity binding logic to LoadPin LSM (Matthias Kaehlcke)

 - Clean up warnings and overflow and KASAN tests (Kees Cook)

* tag 'hardening-v5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  dm: verity-loadpin: Drop use of dm_table_get_num_targets()
  kasan: test: Silence GCC 12 warnings
  drivers: lkdtm: fix clang -Wformat warning
  x86: mm: refer to the intended config STRICT_DEVMEM in a comment
  dm: verity-loadpin: Use CONFIG_SECURITY_LOADPIN_VERITY for conditional compilation
  LoadPin: Enable loading from trusted dm-verity devices
  dm: Add verity helpers for LoadPin
  stack: Declare {randomize_,}kstack_offset to fix Sparse warnings
  lib: overflow: Do not define 64-bit tests on 32-bit
  MAINTAINERS: Add a general "kernel hardening" section
  usercopy: use unsigned long instead of uintptr_t
parents d7b767b5 27603a60

MAINTAINERS

+17 −4
Original line number Diff line number Diff line
@@ -4998,7 +4998,7 @@ R: Nick Desaulniers <ndesaulniers@google.com> 
L:	llvm@lists.linux.dev

S:	Supported

B:	https://github.com/ClangBuiltLinux/linux/issues

T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/clang/features

T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening

F:	include/linux/cfi.h

F:	kernel/cfi.c








@@ -7909,6 +7909,7 @@ FORTIFY_SOURCE







M:	Kees Cook <keescook@chromium.org>









L:	linux-hardening@vger.kernel.org









S:	Supported









T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening









F:	include/linux/fortify-string.h









F:	lib/test_fortify/*









F:	scripts/test_fortify.sh








@@ -8351,6 +8352,7 @@ GCC PLUGINS







M:	Kees Cook <keescook@chromium.org>









L:	linux-hardening@vger.kernel.org









S:	Maintained









T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening









F:	Documentation/kbuild/gcc-plugins.rst









F:	scripts/Makefile.gcc-plugins









F:	scripts/gcc-plugins/








@@ -10878,6 +10880,17 @@ F:	scripts/mk*







F:	scripts/mod/









F:	scripts/package/

















KERNEL HARDENING (not covered by other areas)









M:	Kees Cook <keescook@chromium.org>









L:	linux-hardening@vger.kernel.org









S:	Supported









T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening









F:	include/linux/overflow.h









F:	include/linux/randomize_kstack.h









F:	mm/usercopy.c









K:	\b(add|choose)_random_kstack_offset\b









K:	\b__check_(object_size|heap_object)\b

















KERNEL JANITORS









L:	kernel-janitors@vger.kernel.org









S:	Odd Fixes








@@ -11688,7 +11701,7 @@ F:	drivers/media/usb/dvb-usb-v2/lmedm04*







LOADPIN SECURITY MODULE









M:	Kees Cook <keescook@chromium.org>









S:	Supported









T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git lsm/loadpin









T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening









F:	Documentation/admin-guide/LSM/LoadPin.rst









F:	security/loadpin/
















@@ -18026,7 +18039,7 @@ M:	Kees Cook <keescook@chromium.org>







R:	Andy Lutomirski <luto@amacapital.net>









R:	Will Drewry <wad@chromium.org>









S:	Supported









T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git seccomp









T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/seccomp









F:	Documentation/userspace-api/seccomp_filter.rst









F:	include/linux/seccomp.h









F:	include/uapi/linux/seccomp.h








@@ -22174,7 +22187,7 @@ F:	include/linux/yam.h







YAMA SECURITY MODULE









M:	Kees Cook <keescook@chromium.org>









S:	Supported









T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git yama/tip









T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening









F:	Documentation/admin-guide/LSM/Yama.rst









F:	security/yama/

































drivers/md/Makefile



+1
−0






























Original line number
Diff line number
Diff line







@@ -83,6 +83,7 @@ obj-$(CONFIG_DM_LOG_WRITES)	+= dm-log-writes.o







obj-$(CONFIG_DM_INTEGRITY)	+= dm-integrity.o









obj-$(CONFIG_DM_ZONED)		+= dm-zoned.o









obj-$(CONFIG_DM_WRITECACHE)	+= dm-writecache.o









obj-$(CONFIG_SECURITY_LOADPIN_VERITY)	+= dm-verity-loadpin.o



















ifeq ($(CONFIG_DM_INIT),y)









dm-mod-objs			+= dm-init.o
































drivers/md/dm-verity-loadpin.c
0 → 100644



+75
−0






























Original line number
Diff line number
Diff line









// SPDX-License-Identifier: GPL-2.0-only



















#include <linux/list.h>









#include <linux/kernel.h>









#include <linux/dm-verity-loadpin.h>



















#include "dm.h"









#include "dm-core.h"









#include "dm-verity.h"



















#define DM_MSG_PREFIX	"verity-loadpin"



















LIST_HEAD(dm_verity_loadpin_trusted_root_digests);



















static bool is_trusted_verity_target(struct dm_target *ti)









{









	u8 *root_digest;









	unsigned int digest_size;









	struct dm_verity_loadpin_trusted_root_digest *trd;









	bool trusted = false;



















	if (!dm_is_verity_target(ti))









		return false;



















	if (dm_verity_get_root_digest(ti, &root_digest, &digest_size))









		return false;



















	list_for_each_entry(trd, &dm_verity_loadpin_trusted_root_digests, node) {









		if ((trd->len == digest_size) &&









		    !memcmp(trd->data, root_digest, digest_size)) {









			trusted = true;









			break;









		}









	}



















	kfree(root_digest);



















	return trusted;









}



















/*









 * Determines whether the file system of a superblock is located on









 * a verity device that is trusted by LoadPin.









 */









bool dm_verity_loadpin_is_bdev_trusted(struct block_device *bdev)









{









	struct mapped_device *md;









	struct dm_table *table;









	struct dm_target *ti;









	int srcu_idx;









	bool trusted = false;



















	if (list_empty(&dm_verity_loadpin_trusted_root_digests))









		return false;



















	md = dm_get_md(bdev->bd_dev);









	if (!md)









		return false;



















	table = dm_get_live_table(md, &srcu_idx);



















	if (table->num_targets != 1)









		goto out;



















	ti = dm_table_get_target(table, 0);



















	if (is_trusted_verity_target(ti))









		trusted = true;



















out:









	dm_put_live_table(md, srcu_idx);









	dm_put(md);



















	return trusted;









}
























drivers/md/dm-verity-target.c



+32
−1






























Original line number
Diff line number
Diff line







@@ -19,6 +19,7 @@







#include <linux/module.h>









#include <linux/reboot.h>









#include <linux/scatterlist.h>









#include <linux/string.h>



















#define DM_MSG_PREFIX			"verity"


















@@ -1309,10 +1310,40 @@ static int verity_ctr(struct dm_target *ti, unsigned argc, char **argv)







	return r;









}



















/*









 * Check whether a DM target is a verity target.









 */









bool dm_is_verity_target(struct dm_target *ti)









{









	return ti->type->module == THIS_MODULE;









}



















/*









 * Get the root digest of a verity target.









 *









 * Returns a copy of the root digest, the caller is responsible for









 * freeing the memory of the digest.









 */









int dm_verity_get_root_digest(struct dm_target *ti, u8 **root_digest, unsigned int *digest_size)









{









	struct dm_verity *v = ti->private;



















	if (!dm_is_verity_target(ti))









		return -EINVAL;



















	*root_digest = kmemdup(v->root_digest, v->digest_size, GFP_KERNEL);









	if (*root_digest == NULL)









		return -ENOMEM;



















	*digest_size = v->digest_size;



















	return 0;









}



















static struct target_type verity_target = {









	.name		= "verity",









	.features	= DM_TARGET_IMMUTABLE,









	.version	= {1, 8, 0},









	.version	= {1, 8, 1},









	.module		= THIS_MODULE,









	.ctr		= verity_ctr,









	.dtr		= verity_dtr,
































drivers/md/dm-verity.h



+4
−0






























Original line number
Diff line number
Diff line







@@ -129,4 +129,8 @@ extern int verity_hash(struct dm_verity *v, struct ahash_request *req,







extern int verity_hash_for_block(struct dm_verity *v, struct dm_verity_io *io,









				 sector_t block, u8 *digest, bool *is_zero);



















extern bool dm_is_verity_target(struct dm_target *ti);









extern int dm_verity_get_root_digest(struct dm_target *ti, u8 **root_digest,









				     unsigned int *digest_size);



















#endif /* DM_VERITY_H */