Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'hardening-v6.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull hardening fixes from Kees Cook:
- Correctly disable UBSAN configs in configs/hardening (Nathan
Chancellor)
- Add missing signed integer overflow trap types to arm64 handler
* tag 'hardening-v6.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
ubsan: Add awareness of signed integer overflow traps
configs/hardening: Disable CONFIG_UBSAN_SIGNED_WRAP
configs/hardening: Fix disabling UBSAN configurations
+22
-7
+6
-5
kernel/configs/hardening.config
+6
-5
kernel/configs/hardening.config
···
39
39
CONFIG_UBSAN_TRAP=y
40
40
CONFIG_UBSAN_BOUNDS=y
41
41
# CONFIG_UBSAN_SHIFT is not set
42
-
# CONFIG_UBSAN_DIV_ZERO
43
-
# CONFIG_UBSAN_UNREACHABLE
44
-
# CONFIG_UBSAN_BOOL
45
-
# CONFIG_UBSAN_ENUM
46
-
# CONFIG_UBSAN_ALIGNMENT
42
+
# CONFIG_UBSAN_DIV_ZERO is not set
43
+
# CONFIG_UBSAN_UNREACHABLE is not set
44
+
# CONFIG_UBSAN_SIGNED_WRAP is not set
45
+
# CONFIG_UBSAN_BOOL is not set
46
+
# CONFIG_UBSAN_ENUM is not set
47
+
# CONFIG_UBSAN_ALIGNMENT is not set
47
48
48
49
# Sampling-based heap out-of-bounds and use-after-free detection.
49
50
CONFIG_KFENCE=y
+16
-2
lib/ubsan.c
+16
-2
lib/ubsan.c
···
44
44
case ubsan_shift_out_of_bounds:
45
45
return "UBSAN: shift out of bounds";
46
46
#endif
47
-
#ifdef CONFIG_UBSAN_DIV_ZERO
47
+
#if defined(CONFIG_UBSAN_DIV_ZERO) || defined(CONFIG_UBSAN_SIGNED_WRAP)
48
48
/*
49
-
* SanitizerKind::IntegerDivideByZero emits
49
+
* SanitizerKind::IntegerDivideByZero and
50
+
* SanitizerKind::SignedIntegerOverflow emit
50
51
* SanitizerHandler::DivremOverflow.
51
52
*/
52
53
case ubsan_divrem_overflow:
···
78
77
return "UBSAN: alignment assumption";
79
78
case ubsan_type_mismatch:
80
79
return "UBSAN: type mismatch";
80
+
#endif
81
+
#ifdef CONFIG_UBSAN_SIGNED_WRAP
82
+
/*
83
+
* SanitizerKind::SignedIntegerOverflow emits
84
+
* SanitizerHandler::AddOverflow, SanitizerHandler::SubOverflow,
85
+
* or SanitizerHandler::MulOverflow.
86
+
*/
87
+
case ubsan_add_overflow:
88
+
return "UBSAN: integer addition overflow";
89
+
case ubsan_sub_overflow:
90
+
return "UBSAN: integer subtraction overflow";
91
+
case ubsan_mul_overflow:
92
+
return "UBSAN: integer multiplication overflow";
81
93
#endif
82
94
default:
83
95
return "UBSAN: unrecognized failure code";