From: Sasha Levin <sashal@kernel.org>
Date: Thu, 24 Jun 2021 12:02:23 +0000 (-0400)
Subject: Fixes for 4.19
X-Git-Tag: v5.12.14~60
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4b733d5dbb608cfd9e4c0f965351bb9e4c343c1b;p=thirdparty%2Fkernel%2Fstable-queue.git

Fixes for 4.19

Signed-off-by: Sasha Levin <sashal@kernel.org>
---

diff --git a/queue-4.19/module-limit-enabling-module.sig_enforce.patch b/queue-4.19/module-limit-enabling-module.sig_enforce.patch
new file mode 100644
index 00000000000..c2827684c05
--- /dev/null
+++ b/queue-4.19/module-limit-enabling-module.sig_enforce.patch
@@ -0,0 +1,54 @@
+From 4a98bb468dade4799de46521ed77c02364a3b92c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jun 2021 13:36:41 +0200
+Subject: module: limit enabling module.sig_enforce
+
+From: Mimi Zohar <zohar@linux.ibm.com>
+
+[ Upstream commit 0c18f29aae7ce3dadd26d8ee3505d07cc982df75 ]
+
+Irrespective as to whether CONFIG_MODULE_SIG is configured, specifying
+"module.sig_enforce=1" on the boot command line sets "sig_enforce".
+Only allow "sig_enforce" to be set when CONFIG_MODULE_SIG is configured.
+
+This patch makes the presence of /sys/module/module/parameters/sig_enforce
+dependent on CONFIG_MODULE_SIG=y.
+
+Fixes: fda784e50aac ("module: export module signature enforcement status")
+Reported-by: Nayna Jain <nayna@linux.ibm.com>
+Tested-by: Mimi Zohar <zohar@linux.ibm.com>
+Tested-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/module.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/kernel/module.c b/kernel/module.c
+index 92d8610742c7..68637e661d75 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -268,9 +268,18 @@ static void module_assert_mutex_or_preempt(void)
+ #endif
+ }
+ 
++#ifdef CONFIG_MODULE_SIG
+ static bool sig_enforce = IS_ENABLED(CONFIG_MODULE_SIG_FORCE);
+ module_param(sig_enforce, bool_enable_only, 0644);
+ 
++void set_module_sig_enforced(void)
++{
++	sig_enforce = true;
++}
++#else
++#define sig_enforce false
++#endif
++
+ /*
+  * Export sig_enforce kernel cmdline parameter to allow other subsystems rely
+  * on that instead of directly to CONFIG_MODULE_SIG_FORCE config.
+-- 
+2.30.2
+
diff --git a/queue-4.19/series b/queue-4.19/series
index 036051e8c30..a9377295a48 100644
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -80,3 +80,4 @@ inet-use-bigger-hash-table-for-ip-id-generation.patch
 usb-dwc3-debugfs-add-and-remove-endpoint-dirs-dynamically.patch
 usb-dwc3-core-fix-kernel-panic-when-do-reboot.patch
 x86-fpu-reset-state-for-all-signal-restore-failures.patch
+module-limit-enabling-module.sig_enforce.patch