From cb7433555848cf56a74cdbc0da53af07f4d7d12a Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 19 Nov 2021 13:52:27 +0100 Subject: [PATCH] 5.4-stable patches added patches: fortify-explicitly-disable-clang-support.patch --- ...ify-explicitly-disable-clang-support.patch | 47 +++++++++++++++++++ queue-5.4/series | 1 + 2 files changed, 48 insertions(+) create mode 100644 queue-5.4/fortify-explicitly-disable-clang-support.patch diff --git a/queue-5.4/fortify-explicitly-disable-clang-support.patch b/queue-5.4/fortify-explicitly-disable-clang-support.patch new file mode 100644 index 00000000000..f9d85018529 --- /dev/null +++ b/queue-5.4/fortify-explicitly-disable-clang-support.patch @@ -0,0 +1,47 @@ +From a52f8a59aef46b59753e583bf4b28fccb069ce64 Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Wed, 12 May 2021 21:51:10 -0700 +Subject: fortify: Explicitly disable Clang support + +From: Kees Cook + +commit a52f8a59aef46b59753e583bf4b28fccb069ce64 upstream. + +Clang has never correctly compiled the FORTIFY_SOURCE defenses due to +a couple bugs: + + Eliding inlines with matching __builtin_* names + https://bugs.llvm.org/show_bug.cgi?id=50322 + + Incorrect __builtin_constant_p() of some globals + https://bugs.llvm.org/show_bug.cgi?id=41459 + +In the process of making improvements to the FORTIFY_SOURCE defenses, the +first (silent) bug (coincidentally) becomes worked around, but exposes +the latter which breaks the build. As such, Clang must not be used with +CONFIG_FORTIFY_SOURCE until at least latter bug is fixed (in Clang 13), +and the fortify routines have been rearranged. + +Update the Kconfig to reflect the reality of the current situation. + +Signed-off-by: Kees Cook +Acked-by: Nick Desaulniers +Link: https://lore.kernel.org/lkml/CAKwvOd=A+ueGV2ihdy5GtgR2fQbcXjjAtVxv3=cPjffpebZB7A@mail.gmail.com +Cc: Nathan Chancellor +Signed-off-by: Greg Kroah-Hartman +--- + security/Kconfig | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/security/Kconfig ++++ b/security/Kconfig +@@ -191,6 +191,9 @@ config HARDENED_USERCOPY_PAGESPAN + config FORTIFY_SOURCE + bool "Harden common str/mem functions against buffer overflows" + depends on ARCH_HAS_FORTIFY_SOURCE ++ # https://bugs.llvm.org/show_bug.cgi?id=50322 ++ # https://bugs.llvm.org/show_bug.cgi?id=41459 ++ depends on !CC_IS_CLANG + help + Detect overflows of buffers in common string and memory functions + where the compiler can determine and validate the buffer sizes. diff --git a/queue-5.4/series b/queue-5.4/series index 32436f2db1c..66d6c9ab6e4 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -3,3 +3,4 @@ scsi-ufs-fix-interrupt-error-message-for-shared-interrupts.patch mips-fix-assembly-error-from-mipsr2-code-used-within-mips_isa_arch_level.patch ext4-fix-lazy-initialization-next-schedule-time-computation-in-more-granular-unit.patch scsi-ufs-fix-tm-request-when-non-fatal-error-happens.patch +fortify-explicitly-disable-clang-support.patch -- 2.47.2