Fixes for 5.10

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-5.10/module-limit-enabling-module.sig_enforce.patch b/queue-5.10/module-limit-enabling-module.sig_enforce.patch
new file mode 100644 (file)
index 0000000..0a5fc76
--- /dev/null
+++ b/queue-5.10/module-limit-enabling-module.sig_enforce.patch
@@ -0,0 +1,66 @@
+From 02c7ac259282d02edca0b36f2ad4894477f3ed09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jun 2021 13:36:41 +0200
+Subject: module: limit enabling module.sig_enforce
+
+From: Mimi Zohar <zohar@linux.ibm.com>
+
+[ Upstream commit 0c18f29aae7ce3dadd26d8ee3505d07cc982df75 ]
+
+Irrespective as to whether CONFIG_MODULE_SIG is configured, specifying
+"module.sig_enforce=1" on the boot command line sets "sig_enforce".
+Only allow "sig_enforce" to be set when CONFIG_MODULE_SIG is configured.
+
+This patch makes the presence of /sys/module/module/parameters/sig_enforce
+dependent on CONFIG_MODULE_SIG=y.
+
+Fixes: fda784e50aac ("module: export module signature enforcement status")
+Reported-by: Nayna Jain <nayna@linux.ibm.com>
+Tested-by: Mimi Zohar <zohar@linux.ibm.com>
+Tested-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/module.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/module.c b/kernel/module.c
+index 908d46abe165..185b2655bc20 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -272,9 +272,18 @@ static void module_assert_mutex_or_preempt(void)
+ #endif
+ }
+ 
++#ifdef CONFIG_MODULE_SIG
+ static bool sig_enforce = IS_ENABLED(CONFIG_MODULE_SIG_FORCE);
+ module_param(sig_enforce, bool_enable_only, 0644);
+ 
++void set_module_sig_enforced(void)
++{
++      sig_enforce = true;
++}
++#else
++#define sig_enforce false
++#endif
++
+ /*
+  * Export sig_enforce kernel cmdline parameter to allow other subsystems rely
+  * on that instead of directly to CONFIG_MODULE_SIG_FORCE config.
+@@ -285,11 +294,6 @@ bool is_module_sig_enforced(void)
+ }
+ EXPORT_SYMBOL(is_module_sig_enforced);
+ 
+-void set_module_sig_enforced(void)
+-{
+-      sig_enforce = true;
+-}
+-
+ /* Block module loading/unloading? */
+ int modules_disabled = 0;
+ core_param(nomodule, modules_disabled, bint, 0);
+-- 
+2.30.2
+

diff --git a/queue-5.10/series b/queue-5.10/series
new file mode 100644 (file)
index 0000000..794e880
--- /dev/null
+++ b/queue-5.10/series
@@ -0,0 +1 @@
+module-limit-enabling-module.sig_enforce.patch