Fixes for 4.19

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-4.19/module-limit-enabling-module.sig_enforce.patch b/queue-4.19/module-limit-enabling-module.sig_enforce.patch
new file mode 100644 (file)
index 0000000..c282768
--- /dev/null
+++ b/queue-4.19/module-limit-enabling-module.sig_enforce.patch
@@ -0,0 +1,54 @@
+From 4a98bb468dade4799de46521ed77c02364a3b92c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jun 2021 13:36:41 +0200
+Subject: module: limit enabling module.sig_enforce
+
+From: Mimi Zohar <zohar@linux.ibm.com>
+
+[ Upstream commit 0c18f29aae7ce3dadd26d8ee3505d07cc982df75 ]
+
+Irrespective as to whether CONFIG_MODULE_SIG is configured, specifying
+"module.sig_enforce=1" on the boot command line sets "sig_enforce".
+Only allow "sig_enforce" to be set when CONFIG_MODULE_SIG is configured.
+
+This patch makes the presence of /sys/module/module/parameters/sig_enforce
+dependent on CONFIG_MODULE_SIG=y.
+
+Fixes: fda784e50aac ("module: export module signature enforcement status")
+Reported-by: Nayna Jain <nayna@linux.ibm.com>
+Tested-by: Mimi Zohar <zohar@linux.ibm.com>
+Tested-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/module.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/kernel/module.c b/kernel/module.c
+index 92d8610742c7..68637e661d75 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -268,9 +268,18 @@ static void module_assert_mutex_or_preempt(void)
+ #endif
+ }
+ 
++#ifdef CONFIG_MODULE_SIG
+ static bool sig_enforce = IS_ENABLED(CONFIG_MODULE_SIG_FORCE);
+ module_param(sig_enforce, bool_enable_only, 0644);
+ 
++void set_module_sig_enforced(void)
++{
++      sig_enforce = true;
++}
++#else
++#define sig_enforce false
++#endif
++
+ /*
+  * Export sig_enforce kernel cmdline parameter to allow other subsystems rely
+  * on that instead of directly to CONFIG_MODULE_SIG_FORCE config.
+-- 
+2.30.2
+

diff --git a/queue-4.19/series b/queue-4.19/series
index 036051e8c30ebc97c7719286367ca2e1359f3d60..a9377295a4865d9cb15ba0e127b4917aad0196be 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -80,3 +80,4 @@ inet-use-bigger-hash-table-for-ip-id-generation.patch
 usb-dwc3-debugfs-add-and-remove-endpoint-dirs-dynamically.patch
 usb-dwc3-core-fix-kernel-panic-when-do-reboot.patch
 x86-fpu-reset-state-for-all-signal-restore-failures.patch
+module-limit-enabling-module.sig_enforce.patch