From: Greg Kroah-Hartman Date: Fri, 19 Nov 2021 12:52:11 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v5.4.161~29 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fdd017c05e9420956ea23629ce478dfe818fa376;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: fortify-explicitly-disable-clang-support.patch --- diff --git a/queue-4.19/fortify-explicitly-disable-clang-support.patch b/queue-4.19/fortify-explicitly-disable-clang-support.patch new file mode 100644 index 00000000000..f9d85018529 --- /dev/null +++ b/queue-4.19/fortify-explicitly-disable-clang-support.patch @@ -0,0 +1,47 @@ +From a52f8a59aef46b59753e583bf4b28fccb069ce64 Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Wed, 12 May 2021 21:51:10 -0700 +Subject: fortify: Explicitly disable Clang support + +From: Kees Cook + +commit a52f8a59aef46b59753e583bf4b28fccb069ce64 upstream. + +Clang has never correctly compiled the FORTIFY_SOURCE defenses due to +a couple bugs: + + Eliding inlines with matching __builtin_* names + https://bugs.llvm.org/show_bug.cgi?id=50322 + + Incorrect __builtin_constant_p() of some globals + https://bugs.llvm.org/show_bug.cgi?id=41459 + +In the process of making improvements to the FORTIFY_SOURCE defenses, the +first (silent) bug (coincidentally) becomes worked around, but exposes +the latter which breaks the build. As such, Clang must not be used with +CONFIG_FORTIFY_SOURCE until at least latter bug is fixed (in Clang 13), +and the fortify routines have been rearranged. + +Update the Kconfig to reflect the reality of the current situation. + +Signed-off-by: Kees Cook +Acked-by: Nick Desaulniers +Link: https://lore.kernel.org/lkml/CAKwvOd=A+ueGV2ihdy5GtgR2fQbcXjjAtVxv3=cPjffpebZB7A@mail.gmail.com +Cc: Nathan Chancellor +Signed-off-by: Greg Kroah-Hartman +--- + security/Kconfig | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/security/Kconfig ++++ b/security/Kconfig +@@ -191,6 +191,9 @@ config HARDENED_USERCOPY_PAGESPAN + config FORTIFY_SOURCE + bool "Harden common str/mem functions against buffer overflows" + depends on ARCH_HAS_FORTIFY_SOURCE ++ # https://bugs.llvm.org/show_bug.cgi?id=50322 ++ # https://bugs.llvm.org/show_bug.cgi?id=41459 ++ depends on !CC_IS_CLANG + help + Detect overflows of buffers in common string and memory functions + where the compiler can determine and validate the buffer sizes. diff --git a/queue-4.19/series b/queue-4.19/series index 7c7866b5789..8a64e06d572 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -249,3 +249,4 @@ pci-add-pci_exp_devctl_payload_-macros.patch fuse-truncate-pagecache-on-atomic_o_trunc.patch x86-cpu-fix-migration-safety-with-x86_bug_null_sel.patch ext4-fix-lazy-initialization-next-schedule-time-computation-in-more-granular-unit.patch +fortify-explicitly-disable-clang-support.patch