linux

iv/linux

History

Gustavo A. R. Silva 68a8f64457 ima: Add __counted_by for struct modsig and use struct_size()

Prepare for the coming implementation by GCC and Clang of the __counted_by
attribute. Flexible array members annotated with __counted_by can have
their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for
array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family
functions).

Also, relocate `hdr->raw_pkcs7_len = sig_len;` so that the __counted_by
annotation has effect, and flex-array member `raw_pkcs7` can be properly
bounds-checked at run-time.

While there, use struct_size() helper, instead of the open-coded
version, to calculate the size for the allocation of the whole
flexible structure, including of course, the flexible-array member.

This code was found with the help of Coccinelle, and audited and
fixed manually.

Signed-off-by: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/ZSRaDcJNARUUWUwS@work
Signed-off-by: Kees Cook <keescook@chromium.org>

2023-10-20 10:52:41 -07:00

apparmor

lsm/stable-6.6 PR 20230829

2023-08-30 09:07:09 -07:00

bpf

selinux: remove the runtime disable functionality

2023-03-20 12:34:23 -04:00

integrity

ima: Add __counted_by for struct modsig and use struct_size()

2023-10-20 10:52:41 -07:00

keys

KEYS: Replace all non-returning strlcpy with strscpy