iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge tag 'hardening-v6.10-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Browse Source 
Pull hardening fixes from Kees Cook:

 - loadpin: Prevent SECURITY_LOADPIN_ENFORCE=y without module
   decompression (Stephen Boyd)

 - ubsan: Restore dependency on ARCH_HAS_UBSAN

 - kunit/fortify: Fix memcmp() test to be amplitude agnostic

* tag 'hardening-v6.10-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  kunit/fortify: Fix memcmp() test to be amplitude agnostic
  ubsan: Restore dependency on ARCH_HAS_UBSAN
  loadpin: Prevent SECURITY_LOADPIN_ENFORCE=y without module decompression
This commit is contained in:
Linus Torvalds
2024-05-24 08:33:44 -07:00
parent 0eb03c7e8e ae1a863bcd
commit b0a9ba13ff
3 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
lib/Kconfig.ubsan
View File

@ -4,6 +4,7 @@ config ARCH_HAS_UBSAN
menuconfig UBSAN menuconfig UBSAN
bool "Undefined behaviour sanity checker" bool "Undefined behaviour sanity checker"
depends on ARCH_HAS_UBSAN
help help
This option enables the Undefined Behaviour sanity checker. This option enables the Undefined Behaviour sanity checker.
Compile-time instrumentation is used to detect various undefined Compile-time instrumentation is used to detect various undefined

2
lib/fortify_kunit.c
View File

@ -990,7 +990,7 @@ static void fortify_test_memcmp(struct kunit *test)
KUNIT_ASSERT_EQ(test, memcmp(one, two, one_len), 0); KUNIT_ASSERT_EQ(test, memcmp(one, two, one_len), 0);
KUNIT_EXPECT_EQ(test, fortify_read_overflows, 0); KUNIT_EXPECT_EQ(test, fortify_read_overflows, 0);
/* Still in bounds, but no longer matching. */ /* Still in bounds, but no longer matching. */
KUNIT_ASSERT_EQ(test, memcmp(one, two, one_len + 1), -32); KUNIT_ASSERT_LT(test, memcmp(one, two, one_len + 1), 0);
KUNIT_EXPECT_EQ(test, fortify_read_overflows, 0); KUNIT_EXPECT_EQ(test, fortify_read_overflows, 0);
/* Catch too-large ranges. */ /* Catch too-large ranges. */

3
security/loadpin/Kconfig
View File

@ -14,6 +14,9 @@ config SECURITY_LOADPIN
config SECURITY_LOADPIN_ENFORCE config SECURITY_LOADPIN_ENFORCE
bool "Enforce LoadPin at boot" bool "Enforce LoadPin at boot"
depends on SECURITY_LOADPIN depends on SECURITY_LOADPIN
# Module compression breaks LoadPin unless modules are decompressed in
# the kernel.
depends on !MODULES || (MODULE_COMPRESS_NONE || MODULE_DECOMPRESS)
help help
If selected, LoadPin will enforce pinning at boot. If not If selected, LoadPin will enforce pinning at boot. If not
selected, it can be enabled at boot with the kernel parameter selected, it can be enabled at boot with the kernel parameter