From: Sasha Levin <sashal@kernel.org>
Date: Thu, 24 Jun 2021 12:02:22 +0000 (-0400)
Subject: Fixes for 5.4
X-Git-Tag: v5.12.14~61
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6ad8f06b4871937d2d91ee1ab9d592028efc889e;p=thirdparty%2Fkernel%2Fstable-queue.git

Fixes for 5.4

Signed-off-by: Sasha Levin <sashal@kernel.org>
---

diff --git a/queue-5.4/module-limit-enabling-module.sig_enforce.patch b/queue-5.4/module-limit-enabling-module.sig_enforce.patch
new file mode 100644
index 00000000000..247c0299e96
--- /dev/null
+++ b/queue-5.4/module-limit-enabling-module.sig_enforce.patch
@@ -0,0 +1,66 @@
+From dbb692678c44d8a226759750d49977524735cba0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jun 2021 13:36:41 +0200
+Subject: module: limit enabling module.sig_enforce
+
+From: Mimi Zohar <zohar@linux.ibm.com>
+
+[ Upstream commit 0c18f29aae7ce3dadd26d8ee3505d07cc982df75 ]
+
+Irrespective as to whether CONFIG_MODULE_SIG is configured, specifying
+"module.sig_enforce=1" on the boot command line sets "sig_enforce".
+Only allow "sig_enforce" to be set when CONFIG_MODULE_SIG is configured.
+
+This patch makes the presence of /sys/module/module/parameters/sig_enforce
+dependent on CONFIG_MODULE_SIG=y.
+
+Fixes: fda784e50aac ("module: export module signature enforcement status")
+Reported-by: Nayna Jain <nayna@linux.ibm.com>
+Tested-by: Mimi Zohar <zohar@linux.ibm.com>
+Tested-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/module.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/module.c b/kernel/module.c
+index 88a6a9e04f8d..59d487b8d8da 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -268,9 +268,18 @@ static void module_assert_mutex_or_preempt(void)
+ #endif
+ }
+ 
++#ifdef CONFIG_MODULE_SIG
+ static bool sig_enforce = IS_ENABLED(CONFIG_MODULE_SIG_FORCE);
+ module_param(sig_enforce, bool_enable_only, 0644);
+ 
++void set_module_sig_enforced(void)
++{
++	sig_enforce = true;
++}
++#else
++#define sig_enforce false
++#endif
++
+ /*
+  * Export sig_enforce kernel cmdline parameter to allow other subsystems rely
+  * on that instead of directly to CONFIG_MODULE_SIG_FORCE config.
+@@ -281,11 +290,6 @@ bool is_module_sig_enforced(void)
+ }
+ EXPORT_SYMBOL(is_module_sig_enforced);
+ 
+-void set_module_sig_enforced(void)
+-{
+-	sig_enforce = true;
+-}
+-
+ /* Block module loading/unloading? */
+ int modules_disabled = 0;
+ core_param(nomodule, modules_disabled, bint, 0);
+-- 
+2.30.2
+
diff --git a/queue-5.4/series b/queue-5.4/series
new file mode 100644
index 00000000000..794e880604f
--- /dev/null
+++ b/queue-5.4/series
@@ -0,0 +1 @@
+module-limit-enabling-module.sig_enforce.patch