mbox series

[GIT,PULL] kernel hardening fixes for v6.1-rc1

Message ID	202212231009.EC864645D8@keescook
State	New
Headers	Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Date: Fri, 23 Dec 2022 10:10:19 -0800 From: Kees Cook <keescook@chromium.org> To: Linus Torvalds <torvalds@linux-foundation.org> Cc: linux-kernel@vger.kernel.org, Andrew Morton <akpm@linux-foundation.org>, Arnd Bergmann <arnd@arndb.de>, Daniel =?iso-8859-1?q?D=EDaz?= <daniel.diaz@linaro.org>, "Eric W. Biederman" <ebiederm@xmission.com>, James Morris <jmorris@namei.org>, Jann Horn <jannh@google.com>, Kees Cook <keescook@chromium.org>, kernel test robot <lkp@intel.com>, Kristina Martsenko <kristina.martsenko@arm.com>, linux-hardening@vger.kernel.org, linux-security-module@vger.kernel.org, Luis Chamberlain <mcgrof@kernel.org>, Marco Elver <elver@google.com>, Mark Rutland <mark.rutland@arm.com>, Nathan Chancellor <nathan@kernel.org>, Paul Moore <paul@paul-moore.com>, Peter Zijlstra <peterz@infradead.org>, Petr Mladek <pmladek@suse.com>, Ping-Ke Shih <pkshih@realtek.com>, Sami Tolvanen <samitolvanen@google.com>, Sebastian Andrzej Siewior <bigeasy@linutronix.de>, "Serge E. Hallyn" <serge@hallyn.com>, tangmeng <tangmeng@uniontech.com>, Tiezhu Yang <yangtiezhu@loongson.cn> Subject: [GIT PULL] kernel hardening fixes for v6.1-rc1 Message-ID: <202212231009.EC864645D8@keescook> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Precedence: bulk
Series	[GIT,PULL] kernel hardening fixes for v6.1-rc1 \| [GIT,PULL] kernel hardening fixes for v6.1-rc1

Pull-request

https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git tags/hardening-v6.1-rc1-fixes

Message

Kees Cook Dec. 23, 2022, 6:10 p.m. UTC

  Hi Linus,

Please pull these kernel hardening fixes for v6.1-rc1, collected over the
last week.

Thanks!

-Kees

The following changes since commit d272e01fa0a2f15c5c331a37cd99c6875c7b7186:

  ksmbd: replace one-element arrays with flexible-array members (2022-12-02 13:14:29 -0800)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git tags/hardening-v6.1-rc1-fixes

for you to fetch changes up to cf8016408d880afe9c5dc495af40dc2932874e77:

  cfi: Fix CFI failure with KASAN (2022-12-23 10:04:31 -0800)

----------------------------------------------------------------
kernel hardening fixes for v6.1-rc1

- Fix CFI failure with KASAN (Sami Tolvanen)

- Fix LKDTM + CFI under GCC 7 and 8 (Kristina Martsenko)

- Limit CONFIG_ZERO_CALL_USED_REGS to Clang > 15.0.6 (Nathan Chancellor)

- Ignore "contents" argument in LoadPin's LSM hook handling

- Fix paste-o in /sys/kernel/warn_count API docs

- Use READ_ONCE() consistently for oops/warn limit reading

----------------------------------------------------------------
Kees Cook (3):
      LoadPin: Ignore the "contents" argument of the LSM hooks
      docs: Fix path paste-o for /sys/kernel/warn_count
      exit: Use READ_ONCE() for all oops/warn limit reads

Kristina Martsenko (1):
      lkdtm: cfi: Make PAC test work with GCC 7 and 8

Nathan Chancellor (1):
      security: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6

Sami Tolvanen (1):
      cfi: Fix CFI failure with KASAN

 Documentation/ABI/testing/sysfs-kernel-warn_count |  2 +-
 drivers/misc/lkdtm/cfi.c                          |  6 ++++-
 kernel/Makefile                                   |  3 ---
 kernel/exit.c                                     |  6 +++--
 kernel/panic.c                                    |  7 ++++--
 security/Kconfig.hardening                        |  3 +++
 security/loadpin/loadpin.c                        | 30 ++++++++++++++---------
 7 files changed, 36 insertions(+), 21 deletions(-)

Comments

Kees Cook Dec. 23, 2022, 6:41 p.m. UTC | #1

On Fri, Dec 23, 2022 at 10:10:19AM -0800, Kees Cook wrote:
> Please pull these kernel hardening fixes for v6.1-rc1, collected over the
> last week.

Ugh. I mistyped the version obviously. This should be v6.2-rc1. I've
sent another PR with the tag fixed. Sorry about the noise.