MIRRORS/linux-yocto
1
0
Fork 0
mirror of git://git.yoctoproject.org/linux-yocto.git synced 2025-10-23 07:23:12 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

hardening updates for v6.14-rc1

Browse Source 
- stackleak: Use str_enabled_disabled() helper (Thorsten Blum)
 
 - Document GCC INIT_STACK_ALL_PATTERN behavior (Geert Uytterhoeven)
 
 - Add task_prctl_unknown tracepoint (Marco Elver)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRSPkdeREjth1dHnSE2KwveOeQkuwUCZ4hR6QAKCRA2KwveOeQk
 uyYrAP90cNcedNxKCIC/XfIEyS5bWqgAcEcOdLwsPQ8X130M7wEAwadkKaO7PwrF
 8T3ynXxUd4z5OyuXjKQvfvPAgaxhbg4=
 =OoiS
 -----END PGP SIGNATURE-----

Merge tag 'hardening-v6.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull hardening updates from Kees Cook:

 - stackleak: Use str_enabled_disabled() helper (Thorsten Blum)

 - Document GCC INIT_STACK_ALL_PATTERN behavior (Geert Uytterhoeven)

 - Add task_prctl_unknown tracepoint (Marco Elver)

* tag 'hardening-v6.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  hardening: Document INIT_STACK_ALL_PATTERN behavior with GCC
  stackleak: Use str_enabled_disabled() helper in stack_erasing_sysctl()
  tracing: Remove pid in task_rename tracing output
  tracing: Add task_prctl_unknown tracepoint
This commit is contained in:
Linus Torvalds 2025-01-22 20:29:53 -08:00
commit 5ab889facc
4 changed files with 45 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
include/trace/events/task.h
View File

@ -38,22 +38,56 @@ TRACE_EVENT(task_rename,
TP_ARGS(task, comm),
TP_STRUCT__entry(
__field( pid_t, pid)
__array( char, oldcomm, TASK_COMM_LEN)
__array( char, newcomm, TASK_COMM_LEN)
__field( short, oom_score_adj)
),
TP_fast_assign(
__entry->pid = task->pid;
memcpy(entry->oldcomm, task->comm, TASK_COMM_LEN);
strscpy(entry->newcomm, comm, TASK_COMM_LEN);
__entry->oom_score_adj = task->signal->oom_score_adj;
),
TP_printk("pid=%d oldcomm=%s newcomm=%s oom_score_adj=%hd",
__entry->pid, __entry->oldcomm,
__entry->newcomm, __entry->oom_score_adj)
TP_printk("oldcomm=%s newcomm=%s oom_score_adj=%hd",
__entry->oldcomm, __entry->newcomm, __entry->oom_score_adj)
);
/**
* task_prctl_unknown - called on unknown prctl() option
* @option: option passed
* @arg2: arg2 passed
* @arg3: arg3 passed
* @arg4: arg4 passed
* @arg5: arg5 passed
*
* Called on an unknown prctl() option.
*/
TRACE_EVENT(task_prctl_unknown,
TP_PROTO(int option, unsigned long arg2, unsigned long arg3,
unsigned long arg4, unsigned long arg5),
TP_ARGS(option, arg2, arg3, arg4, arg5),
TP_STRUCT__entry(
__field( int, option)
__field( unsigned long, arg2)
__field( unsigned long, arg3)
__field( unsigned long, arg4)
__field( unsigned long, arg5)
),
TP_fast_assign(
__entry->option = option;
__entry->arg2 = arg2;
__entry->arg3 = arg3;
__entry->arg4 = arg4;
__entry->arg5 = arg5;
),
TP_printk("option=%d arg2=%ld arg3=%ld arg4=%ld arg5=%ld",
__entry->option, __entry->arg2, __entry->arg3, __entry->arg4, __entry->arg5)
);
#endif

3
kernel/stackleak.c
View File

@ -15,6 +15,7 @@
#ifdef CONFIG_STACKLEAK_RUNTIME_DISABLE
#include <linux/jump_label.h>
#include <linux/string_choices.h>
#include <linux/sysctl.h>
#include <linux/init.h>
@ -41,7 +42,7 @@ static int stack_erasing_sysctl(const struct ctl_table *table, int write,
static_branch_enable(&stack_erasing_bypass);
pr_warn("stackleak: kernel stack erasing is %s\n",
state ? "enabled" : "disabled");
str_enabled_disabled(state));
return ret;
}
static struct ctl_table stackleak_sysctls[] = {

3
kernel/sys.c
View File

@ -75,6 +75,8 @@
#include <asm/io.h>
#include <asm/unistd.h>
#include <trace/events/task.h>
#include "uid16.h"
#ifndef SET_UNALIGN_CTL
@ -2810,6 +2812,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
error = arch_lock_shadow_stack_status(me, arg2);
break;
default:
trace_task_prctl_unknown(option, arg2, arg3, arg4, arg5);
error = -EINVAL;
break;
}

1
security/Kconfig.hardening
View File

@ -127,6 +127,7 @@ choice
repeating for all types and padding except float and double
which use 0xFF repeating (-NaN). Clang on 32-bit uses 0xFF
repeating for all types and padding.
GCC uses 0xFE repeating for all types, and zero for padding.
config INIT_STACK_ALL_ZERO
bool "zero-init everything (strongest and safest)"