Re: [PATCH] ARM: fault: Implement copy_from_kernel_nofault_allowed()

On Mon, Jan 22, 2024 at 05:12:38PM -0800, Kees Cook wrote: > Under PAN emulation when dumping backtraces from things like the > LKDTM EXEC_USERSPACE test[1], a double fault (which would hang a CPU) > would happen because of dump_instr() attempting to read a userspace > address. Make sure copy_from_

Re: [RFC] arm64: syscall: Direct PRNG kstack randomization

On Tue, Feb 20, 2024 at 08:02:58PM -0600, Jeremy Linton wrote: > The existing arm64 stack randomization uses the kernel rng to acquire > 5 bits of address space randomization. This is problematic because it > creates non determinism in the syscall path when the rng needs to be > generated or reseed

[PATCH] refcount: Annotated intentional signed integer wrap-around

Mark the various refcount_t functions with __signed_wrap, as we depend on the wrapping behavior to detect the overflow and perform saturation. Silences warnings seen with the LKDTM REFCOUNT_* tests: UBSAN: signed-integer-overflow in ../include/linux/refcount.h:189:11 2147483647 + 1 cannot be r

[RFC] arm64: syscall: Direct PRNG kstack randomization

The existing arm64 stack randomization uses the kernel rng to acquire 5 bits of address space randomization. This is problematic because it creates non determinism in the syscall path when the rng needs to be generated or reseeded. This shows up as large tail latencies in some benchmarks and direct

Re: [syzbot] [mm?] [hardening?] BUG: bad usercopy in raw_getsockopt

On Tue, Feb 20, 2024 at 05:28:17PM +0100, Oliver Hartkopp wrote: > The issue has already been fixed with the next commit in net-next: > > https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=c8fba5d6df5e476aa791db4f1f014dad2bb5e904 > > Sorry for the effort - but really g

Re: [syzbot] [mm?] [hardening?] BUG: bad usercopy in raw_getsockopt

The issue has already been fixed with the next commit in net-next: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=c8fba5d6df5e476aa791db4f1f014dad2bb5e904 Sorry for the effort - but really good to see, that the problem has been catched automatically. Good job!

[syzbot] [mm?] [hardening?] BUG: bad usercopy in raw_getsockopt

Hello, syzbot found the following issue on: HEAD commit:74293ea1c4db net: sysfs: Do not create sysfs for non BQL d.. git tree: net-next console+strace: https://syzkaller.appspot.com/x/log.txt?x=13dcc4b418 kernel config: https://syzkaller.appspot.com/x/.config?x=970c7b6c80a096da das

Re: [PATCH] MIPS: Alchemy: Use kcalloc() instead of kzalloc()

On Sat, Jan 20, 2024 at 02:34:43PM +0100, Erick Archer wrote: > As noted in the "Deprecated Interfaces, Language Features, Attributes, > and Conventions" documentation [1], size calculations (especially > multiplication) should not be performed in memory allocator (or similar) > function arguments

Re: [PATCH bpf-next 2/2] bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()

On Sun, Feb 18, 2024 at 11:55 AM Christophe Leroy wrote: > > set_memory_rox() can fail, leaving memory unprotected. > > Check return and bail out when bpf_jit_binary_lock_ro() returns > and error. > > Signed-off-by: Christophe Leroy > --- > Previous patch introduces a dependency on this patch bec

Re: [PATCH 03/10] scsi: NCR5380: Replace snprintf() with the safer scnprintf() variant

On Mon, 19 Feb 2024, James Bottomley wrote: > On Mon, 2024-02-19 at 15:23 +, Lee Jones wrote: > > On Sat, 10 Feb 2024, James Bottomley wrote: > > > > > On Thu, 2024-02-08 at 10:29 +, Lee Jones wrote: > > > > On Thu, 08 Feb 2024, Geert Uytterhoeven wrote: > > > > > > > > > Hi Lee, > > > >

Re: [PATCH 03/10] scsi: NCR5380: Replace snprintf() with the safer scnprintf() variant

On Mon, 19 Feb 2024, Kees Cook wrote: > On Mon, Feb 19, 2024 at 03:23:12PM +, Lee Jones wrote: > > Adding this to checkpatch is a good idea. > > Yeah, please do. You can look at the "strncpy -> strscpy" check that is > already in there for an example. > > > > > What if we also take Kees's s