API tools faq
paste
Advertisement
Guest User

edited linux-hardened-5.12.19-hardened1.patch

a guest
Aug 19th, 2021
424
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Diff 104.83 KB | None | 0 0
raw download clone embed print report
  1. diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
  2. index c08e174e6ff4..b87e283b5670 100644
  3. --- a/Documentation/admin-guide/kernel-parameters.txt
  4. +++ b/Documentation/admin-guide/kernel-parameters.txt
  5. @@ -524,17 +524,6 @@
  6.             nosocket -- Disable socket memory accounting.
  7.             nokmem -- Disable kernel memory accounting.
  8.  
  9. -   checkreqprot    [SELINUX] Set initial checkreqprot flag value.
  10. -           Format: { "0" | "1" }
  11. -           See security/selinux/Kconfig help text.
  12. -           0 -- check protection applied by kernel (includes
  13. -               any implied execute protection).
  14. -           1 -- check protection requested by application.
  15. -           Default value is set via a kernel config option.
  16. -           Value can be changed at runtime via
  17. -               /sys/fs/selinux/checkreqprot.
  18. -           Setting checkreqprot to 1 is deprecated.
  19. -
  20.     cio_ignore= [S390]
  21.             See Documentation/s390/common_io.rst for details.
  22.     clk_ignore_unused
  23. @@ -3604,6 +3593,11 @@
  24.             the specified number of seconds.  This is to be used if
  25.             your oopses keep scrolling off the screen.
  26.  
  27. +   extra_latent_entropy
  28. +           Enable a very simple form of latent entropy extraction
  29. +           from the first 4GB of memory as the bootmem allocator
  30. +           passes the memory pages to the buddy allocator.
  31. +
  32.     pcbit=      [HW,ISDN]
  33.  
  34.     pcd.        [PARIDE]
  35. diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst
  36. index 1d56a6b73a4e..59b1ee24aed4 100644
  37. --- a/Documentation/admin-guide/sysctl/kernel.rst
  38. +++ b/Documentation/admin-guide/sysctl/kernel.rst
  39. @@ -860,6 +860,8 @@ with respect to CAP_PERFMON use cases.
  40.  >=1  Disallow CPU event access by users without ``CAP_PERFMON``.
  41.  
  42.  >=2  Disallow kernel profiling by users without ``CAP_PERFMON``.
  43. +
  44. +>=3  Disallow use of any event by users without ``CAP_PERFMON``.
  45.  ===  ==================================================================
  46.  
  47.  
  48. @@ -1383,6 +1385,26 @@ If a value outside of this range is written to ``threads-max`` an
  49.  ``EINVAL`` error occurs.
  50.  
  51.  
  52. +tiocsti_restrict
  53. +================
  54. +
  55. +This toggle indicates whether unprivileged users are prevented from using the
  56. +``TIOCSTI`` ioctl to inject commands into other processes which share a tty
  57. +session.
  58. +
  59. += ============================================================================
  60. +0 No restriction, except the default one of only being able to inject commands
  61. +  into one's own tty.
  62. +1 Users must have ``CAP_SYS_ADMIN`` to use the ``TIOCSTI`` ioctl.
  63. += ============================================================================
  64. +
  65. +When user namespaces are in use, the check for ``CAP_SYS_ADMIN`` is done
  66. +against the user namespace that originally opened the tty.
  67. +
  68. +The kernel config option ``CONFIG_SECURITY_TIOCSTI_RESTRICT`` sets the default
  69. +value of ``tiocsti_restrict``.
  70. +
  71. +
  72.  traceoff_on_warning
  73.  ===================
  74.  
  75. diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
  76. index 3feb5e565b1a..805c656e223a 100644
  77. --- a/Documentation/networking/ip-sysctl.rst
  78. +++ b/Documentation/networking/ip-sysctl.rst
  79. @@ -685,6 +685,24 @@ tcp_comp_sack_nr - INTEGER
  80.  
  81.     Default : 44
  82.  
  83. +tcp_simult_connect - BOOLEAN
  84. +   Enable TCP simultaneous connect that adds a weakness in Linux's strict
  85. +   implementation of TCP that allows two clients to connect to each other
  86. +   without either entering a listening state. The weakness allows an attacker
  87. +   to easily prevent a client from connecting to a known server provided the
  88. +   source port for the connection is guessed correctly.
  89. +
  90. +   As the weakness could be used to prevent an antivirus or IPS from fetching
  91. +   updates, or prevent an SSL gateway from fetching a CRL, it should be
  92. +   eliminated by disabling this option. Though Linux is one of few operating
  93. +   systems supporting simultaneous connect, it has no legitimate use in
  94. +   practice and is rarely supported by firewalls.
  95. +
  96. +   Disabling this may break TCP STUNT which is used by some applications for
  97. +   NAT traversal.
  98. +
  99. +   Default: Value of CONFIG_TCP_SIMULT_CONNECT_DEFAULT_ON
  100. +
  101.  tcp_slow_start_after_idle - BOOLEAN
  102.     If set, provide RFC2861 behavior and time out the congestion
  103.     window after an idle period.  An idle period is defined at
  104. diff --git a/arch/Kconfig b/arch/Kconfig
  105. index ecfd3520b676..0bf7e9464665 100644
  106. --- a/arch/Kconfig
  107. +++ b/arch/Kconfig
  108. @@ -865,7 +865,7 @@ config ARCH_MMAP_RND_BITS
  109.     int "Number of bits to use for ASLR of mmap base address" if EXPERT
  110.     range ARCH_MMAP_RND_BITS_MIN ARCH_MMAP_RND_BITS_MAX
  111.     default ARCH_MMAP_RND_BITS_DEFAULT if ARCH_MMAP_RND_BITS_DEFAULT
  112. -   default ARCH_MMAP_RND_BITS_MIN
  113. +   default ARCH_MMAP_RND_BITS_MAX
  114.     depends on HAVE_ARCH_MMAP_RND_BITS
  115.     help
  116.       This value can be used to select the number of bits to use to
  117. @@ -899,7 +899,7 @@ config ARCH_MMAP_RND_COMPAT_BITS
  118.     int "Number of bits to use for ASLR of mmap base address for compatible applications" if EXPERT
  119.     range ARCH_MMAP_RND_COMPAT_BITS_MIN ARCH_MMAP_RND_COMPAT_BITS_MAX
  120.     default ARCH_MMAP_RND_COMPAT_BITS_DEFAULT if ARCH_MMAP_RND_COMPAT_BITS_DEFAULT
  121. -   default ARCH_MMAP_RND_COMPAT_BITS_MIN
  122. +   default ARCH_MMAP_RND_COMPAT_BITS_MAX
  123.     depends on HAVE_ARCH_MMAP_RND_COMPAT_BITS
  124.     help
  125.       This value can be used to select the number of bits to use to
  126. diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
  127. index dfdc3e0af5e1..ae1cf0385cb5 100644
  128. --- a/arch/arm64/Kconfig
  129. +++ b/arch/arm64/Kconfig
  130. @@ -1214,6 +1214,7 @@ config RODATA_FULL_DEFAULT_ENABLED
  131.  
  132.  config ARM64_SW_TTBR0_PAN
  133.     bool "Emulate Privileged Access Never using TTBR0_EL1 switching"
  134. +   default y
  135.     help
  136.       Enabling this option prevents the kernel from accessing
  137.       user-space memory directly by pointing TTBR0_EL1 to a reserved
  138. @@ -1795,6 +1796,7 @@ config RANDOMIZE_BASE
  139.     bool "Randomize the address of the kernel image"
  140.     select ARM64_MODULE_PLTS if MODULES
  141.     select RELOCATABLE
  142. +   default y
  143.     help
  144.       Randomizes the virtual address at which the kernel image is
  145.       loaded, as a security feature that deters exploit attempts
  146. diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
  147. index d612f633b771..e9d6d250224b 100644
  148. --- a/arch/arm64/configs/defconfig
  149. +++ b/arch/arm64/configs/defconfig
  150. @@ -1,4 +1,3 @@
  151. -CONFIG_SYSVIPC=y
  152.  CONFIG_POSIX_MQUEUE=y
  153.  CONFIG_AUDIT=y
  154.  CONFIG_NO_HZ_IDLE=y
  155. diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
  156. index 8d1c8dcb87fd..32c1609a1158 100644
  157. --- a/arch/arm64/include/asm/elf.h
  158. +++ b/arch/arm64/include/asm/elf.h
  159. @@ -124,14 +124,10 @@
  160.  
  161.  /*
  162.   * This is the base location for PIE (ET_DYN with INTERP) loads. On
  163. - * 64-bit, this is above 4GB to leave the entire 32-bit address
  164. + * 64-bit, this is raised to 4GB to leave the entire 32-bit address
  165.   * space open for things that want to use the area for 32-bit pointers.
  166.   */
  167. -#ifdef CONFIG_ARM64_FORCE_52BIT
  168. -#define ELF_ET_DYN_BASE        (2 * TASK_SIZE_64 / 3)
  169. -#else
  170. -#define ELF_ET_DYN_BASE        (2 * DEFAULT_MAP_WINDOW_64 / 3)
  171. -#endif /* CONFIG_ARM64_FORCE_52BIT */
  172. +#define ELF_ET_DYN_BASE        0x100000000UL
  173.  
  174.  #ifndef __ASSEMBLY__
  175.  
  176. @@ -189,10 +185,10 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
  177.  /* 1GB of VA */
  178.  #ifdef CONFIG_COMPAT
  179.  #define STACK_RND_MASK         (test_thread_flag(TIF_32BIT) ? \
  180. -                       0x7ff >> (PAGE_SHIFT - 12) : \
  181. -                       0x3ffff >> (PAGE_SHIFT - 12))
  182. +                       ((1UL << mmap_rnd_compat_bits) - 1) >> (PAGE_SHIFT - 12) : \
  183. +                       ((1UL << mmap_rnd_bits) - 1) >> (PAGE_SHIFT - 12))
  184.  #else
  185. -#define STACK_RND_MASK         (0x3ffff >> (PAGE_SHIFT - 12))
  186. +#define STACK_RND_MASK         (((1UL << mmap_rnd_bits) - 1) >> (PAGE_SHIFT - 12))
  187.  #endif
  188.  
  189.  #ifdef __AARCH64EB__
  190. diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
  191. index 861b1b794697..e4f9dc676bc8 100644
  192. --- a/arch/x86/Kconfig
  193. +++ b/arch/x86/Kconfig
  194. @@ -1187,8 +1187,7 @@ config VM86
  195.     default X86_LEGACY_VM86
  196.  
  197.  config X86_16BIT
  198. -   bool "Enable support for 16-bit segments" if EXPERT
  199. -   default y
  200. +   bool "Enable support for 16-bit segments"
  201.     depends on MODIFY_LDT_SYSCALL
  202.     help
  203.       This option is required by programs like Wine to run 16-bit
  204. @@ -2307,7 +2306,7 @@ config COMPAT_VDSO
  205.  choice
  206.     prompt "vsyscall table for legacy applications"
  207.     depends on X86_64
  208. -   default LEGACY_VSYSCALL_XONLY
  209. +   default LEGACY_VSYSCALL_NONE
  210.     help
  211.       Legacy user code that does not know how to find the vDSO expects
  212.       to be able to issue three syscalls by calling fixed addresses in
  213. @@ -2403,8 +2402,7 @@ config CMDLINE_OVERRIDE
  214.       be set to 'N' under normal conditions.
  215.  
  216.  config MODIFY_LDT_SYSCALL
  217. -   bool "Enable the LDT (local descriptor table)" if EXPERT
  218. -   default y
  219. +   bool "Enable the LDT (local descriptor table)"
  220.     help
  221.       Linux can allow user programs to install a per-process x86
  222.       Local Descriptor Table (LDT) using the modify_ldt(2) system
  223. diff --git a/arch/x86/configs/x86_64_defconfig b/arch/x86/configs/x86_64_defconfig
  224. index b60bd2d86034..e1102b8e7653 100644
  225. --- a/arch/x86/configs/x86_64_defconfig
  226. +++ b/arch/x86/configs/x86_64_defconfig
  227. @@ -1,5 +1,4 @@
  228.  # CONFIG_LOCALVERSION_AUTO is not set
  229. -CONFIG_SYSVIPC=y
  230.  CONFIG_POSIX_MQUEUE=y
  231.  CONFIG_AUDIT=y
  232.  CONFIG_NO_HZ=y
  233. diff --git a/arch/x86/entry/vdso/vma.c b/arch/x86/entry/vdso/vma.c
  234. index 825e829ffff1..e51496cc2a70 100644
  235. --- a/arch/x86/entry/vdso/vma.c
  236. +++ b/arch/x86/entry/vdso/vma.c
  237. @@ -298,55 +298,9 @@ static int map_vdso(const struct vdso_image *image, unsigned long addr)
  238.  }
  239.  
  240.  #ifdef CONFIG_X86_64
  241. -/*
  242. - * Put the vdso above the (randomized) stack with another randomized
  243. - * offset.  This way there is no hole in the middle of address space.
  244. - * To save memory make sure it is still in the same PTE as the stack
  245. - * top.  This doesn't give that many random bits.
  246. - *
  247. - * Note that this algorithm is imperfect: the distribution of the vdso
  248. - * start address within a PMD is biased toward the end.
  249. - *
  250. - * Only used for the 64-bit and x32 vdsos.
  251. - */
  252. -static unsigned long vdso_addr(unsigned long start, unsigned len)
  253. -{
  254. -   unsigned long addr, end;
  255. -   unsigned offset;
  256. -
  257. -   /*
  258. -    * Round up the start address.  It can start out unaligned as a result
  259. -    * of stack start randomization.
  260. -    */
  261. -   start = PAGE_ALIGN(start);
  262. -
  263. -   /* Round the lowest possible end address up to a PMD boundary. */
  264. -   end = (start + len + PMD_SIZE - 1) & PMD_MASK;
  265. -   if (end >= TASK_SIZE_MAX)
  266. -       end = TASK_SIZE_MAX;
  267. -   end -= len;
  268. -
  269. -   if (end > start) {
  270. -       offset = get_random_int() % (((end - start) >> PAGE_SHIFT) + 1);
  271. -       addr = start + (offset << PAGE_SHIFT);
  272. -   } else {
  273. -       addr = start;
  274. -   }
  275. -
  276. -   /*
  277. -    * Forcibly align the final address in case we have a hardware
  278. -    * issue that requires alignment for performance reasons.
  279. -    */
  280. -   addr = align_vdso_addr(addr);
  281. -
  282. -   return addr;
  283. -}
  284. -
  285.  static int map_vdso_randomized(const struct vdso_image *image)
  286.  {
  287. -   unsigned long addr = vdso_addr(current->mm->start_stack, image->size-image->sym_vvar_start);
  288. -
  289. -   return map_vdso(image, addr);
  290. +   return map_vdso(image, 0);
  291.  }
  292.  #endif
  293.  
  294. diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
  295. index 9224d40cdefe..b944f0d8551a 100644
  296. --- a/arch/x86/include/asm/elf.h
  297. +++ b/arch/x86/include/asm/elf.h
  298. @@ -247,11 +247,11 @@ extern int force_personality32;
  299.  
  300.  /*
  301.   * This is the base location for PIE (ET_DYN with INTERP) loads. On
  302. - * 64-bit, this is above 4GB to leave the entire 32-bit address
  303. + * 64-bit, this is raised to 4GB to leave the entire 32-bit address
  304.   * space open for things that want to use the area for 32-bit pointers.
  305.   */
  306.  #define ELF_ET_DYN_BASE        (mmap_is_ia32() ? 0x000400000UL : \
  307. -                         (DEFAULT_MAP_WINDOW / 3 * 2))
  308. +                         0x100000000UL)
  309.  
  310.  /* This yields a mask that user programs can use to figure out what
  311.     instruction set this CPU supports.  This could be done in user space,
  312. @@ -331,8 +331,8 @@ extern bool mmap_address_hint_valid(unsigned long addr, unsigned long len);
  313.  
  314.  #ifdef CONFIG_X86_32
  315.  
  316. -#define __STACK_RND_MASK(is32bit) (0x7ff)
  317. -#define STACK_RND_MASK (0x7ff)
  318. +#define __STACK_RND_MASK(is32bit) ((1UL << mmap_rnd_bits) - 1)
  319. +#define STACK_RND_MASK ((1UL << mmap_rnd_bits) - 1)
  320.  
  321.  #define ARCH_DLINFO        ARCH_DLINFO_IA32
  322.  
  323. @@ -341,7 +341,11 @@ extern bool mmap_address_hint_valid(unsigned long addr, unsigned long len);
  324.  #else /* CONFIG_X86_32 */
  325.  
  326.  /* 1GB for 64bit, 8MB for 32bit */
  327. -#define __STACK_RND_MASK(is32bit) ((is32bit) ? 0x7ff : 0x3fffff)
  328. +#ifdef CONFIG_COMPAT
  329. +#define __STACK_RND_MASK(is32bit) ((is32bit) ? (1UL << mmap_rnd_compat_bits) - 1 : (1UL << mmap_rnd_bits) - 1)
  330. +#else
  331. +#define __STACK_RND_MASK(is32bit) ((1UL << mmap_rnd_bits) - 1)
  332. +#endif
  333.  #define STACK_RND_MASK __STACK_RND_MASK(mmap_is_ia32())
  334.  
  335.  #define ARCH_DLINFO                            \
  336. @@ -403,5 +407,4 @@ struct va_alignment {
  337.  } ____cacheline_aligned;
  338.  
  339.  extern struct va_alignment va_align;
  340. -extern unsigned long align_vdso_addr(unsigned long);
  341.  #endif /* _ASM_X86_ELF_H */
  342. diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
  343. index 1e576cc831c1..a99597869bc8 100644
  344. --- a/arch/x86/kernel/cpu/common.c
  345. +++ b/arch/x86/kernel/cpu/common.c
  346. @@ -399,6 +399,7 @@ EXPORT_SYMBOL_GPL(native_write_cr4);
  347.  void cr4_update_irqsoff(unsigned long set, unsigned long clear)
  348.  {
  349.     unsigned long newval, cr4 = this_cpu_read(cpu_tlbstate.cr4);
  350. +   BUG_ON(cr4 != __read_cr4());
  351.  
  352.     lockdep_assert_irqs_disabled();
  353.  
  354. diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
  355. index 9c214d7085a4..629151fe58b5 100644
  356. --- a/arch/x86/kernel/process.c
  357. +++ b/arch/x86/kernel/process.c
  358. @@ -43,6 +43,8 @@
  359.  #include <asm/io_bitmap.h>
  360.  #include <asm/proto.h>
  361.  #include <asm/frame.h>
  362. +#include <asm/elf.h>
  363. +#include <linux/sizes.h>
  364.  
  365.  #include "process.h"
  366.  
  367. @@ -596,6 +598,7 @@ void speculation_ctrl_update_current(void)
  368.  static inline void cr4_toggle_bits_irqsoff(unsigned long mask)
  369.  {
  370.     unsigned long newval, cr4 = this_cpu_read(cpu_tlbstate.cr4);
  371. +   BUG_ON(cr4 != __read_cr4());
  372.  
  373.     newval = cr4 ^ mask;
  374.     if (newval != cr4) {
  375. @@ -905,7 +908,10 @@ unsigned long arch_align_stack(unsigned long sp)
  376.  
  377.  unsigned long arch_randomize_brk(struct mm_struct *mm)
  378.  {
  379. -   return randomize_page(mm->brk, 0x02000000);
  380. +   if (mmap_is_ia32())
  381. +       return mm->brk + get_random_long() % SZ_32M + PAGE_SIZE;
  382. +   else
  383. +       return mm->brk + get_random_long() % SZ_1G + PAGE_SIZE;
  384.  }
  385.  
  386.  /*
  387. diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
  388. index 660b78827638..abf366019da6 100644
  389. --- a/arch/x86/kernel/sys_x86_64.c
  390. +++ b/arch/x86/kernel/sys_x86_64.c
  391. @@ -52,13 +52,6 @@ static unsigned long get_align_bits(void)
  392.     return va_align.bits & get_align_mask();
  393.  }
  394.  
  395. -unsigned long align_vdso_addr(unsigned long addr)
  396. -{
  397. -   unsigned long align_mask = get_align_mask();
  398. -   addr = (addr + align_mask) & ~align_mask;
  399. -   return addr | get_align_bits();
  400. -}
  401. -
  402.  static int __init control_va_addr_alignment(char *str)
  403.  {
  404.     /* guard against enabling this on other CPU families */
  405. @@ -116,10 +109,7 @@ static void find_start_end(unsigned long addr, unsigned long flags,
  406.     }
  407.  
  408.     *begin  = get_mmap_base(1);
  409. -   if (in_32bit_syscall())
  410. -       *end = task_size_32bit();
  411. -   else
  412. -       *end = task_size_64bit(addr > DEFAULT_MAP_WINDOW);
  413. +   *end    = get_mmap_base(0);
  414.  }
  415.  
  416.  unsigned long
  417. @@ -196,7 +186,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
  418.  
  419.     info.flags = VM_UNMAPPED_AREA_TOPDOWN;
  420.     info.length = len;
  421. -   info.low_limit = PAGE_SIZE;
  422. +   info.low_limit = get_mmap_base(1);
  423.     info.high_limit = get_mmap_base(0);
  424.  
  425.     /*
  426. diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
  427. index da31c2635ee4..ae05197fd7c6 100644
  428. --- a/arch/x86/mm/init_32.c
  429. +++ b/arch/x86/mm/init_32.c
  430. @@ -533,9 +533,9 @@ static void __init pagetable_init(void)
  431.  
  432.  #define DEFAULT_PTE_MASK ~(_PAGE_NX | _PAGE_GLOBAL)
  433.  /* Bits supported by the hardware: */
  434. -pteval_t __supported_pte_mask __read_mostly = DEFAULT_PTE_MASK;
  435. +pteval_t __supported_pte_mask __ro_after_init = DEFAULT_PTE_MASK;
  436.  /* Bits allowed in normal kernel mappings: */
  437. -pteval_t __default_kernel_pte_mask __read_mostly = DEFAULT_PTE_MASK;
  438. +pteval_t __default_kernel_pte_mask __ro_after_init = DEFAULT_PTE_MASK;
  439.  EXPORT_SYMBOL_GPL(__supported_pte_mask);
  440.  /* Used in PAGE_KERNEL_* macros which are reasonably used out-of-tree: */
  441.  EXPORT_SYMBOL(__default_kernel_pte_mask);
  442. diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
  443. index b5a3fa4033d3..c3d771ffc178 100644
  444. --- a/arch/x86/mm/init_64.c
  445. +++ b/arch/x86/mm/init_64.c
  446. @@ -97,9 +97,9 @@ DEFINE_ENTRY(pte, pte, init)
  447.   */
  448.  
  449.  /* Bits supported by the hardware: */
  450. -pteval_t __supported_pte_mask __read_mostly = ~0;
  451. +pteval_t __supported_pte_mask __ro_after_init = ~0;
  452.  /* Bits allowed in normal kernel mappings: */
  453. -pteval_t __default_kernel_pte_mask __read_mostly = ~0;
  454. +pteval_t __default_kernel_pte_mask __ro_after_init = ~0;
  455.  EXPORT_SYMBOL_GPL(__supported_pte_mask);
  456.  /* Used in PAGE_KERNEL_* macros which are reasonably used out-of-tree: */
  457.  EXPORT_SYMBOL(__default_kernel_pte_mask);
  458. diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
  459. index 569ac1d57f55..044d88da4aee 100644
  460. --- a/arch/x86/mm/tlb.c
  461. +++ b/arch/x86/mm/tlb.c
  462. @@ -1066,6 +1066,7 @@ STATIC_NOPV void native_flush_tlb_global(void)
  463.     raw_local_irq_save(flags);
  464.  
  465.     cr4 = this_cpu_read(cpu_tlbstate.cr4);
  466. +   BUG_ON(cr4 != __read_cr4());
  467.     /* toggle PGE */
  468.     native_write_cr4(cr4 ^ X86_CR4_PGE);
  469.     /* write old PGE again and flush TLBs */
  470. diff --git a/block/blk-mq.c b/block/blk-mq.c
  471. index 6a982a277176..a9b18a0dcdd2 100644
  472. --- a/block/blk-mq.c
  473. +++ b/block/blk-mq.c
  474. @@ -576,7 +576,7 @@ static void blk_complete_reqs(struct llist_head *list)
  475.         rq->q->mq_ops->complete(rq);
  476.  }
  477.  
  478. -static __latent_entropy void blk_done_softirq(struct softirq_action *h)
  479. +static __latent_entropy void blk_done_softirq(void)
  480.  {
  481.     blk_complete_reqs(this_cpu_ptr(&blk_cpu_done));
  482.  }
  483. diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
  484. index 61c762961ca8..02a83039c25b 100644
  485. --- a/drivers/ata/libata-core.c
  486. +++ b/drivers/ata/libata-core.c
  487. @@ -4540,7 +4540,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
  488.     struct ata_port *ap;
  489.     unsigned int tag;
  490.  
  491. -   WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
  492. +   BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
  493.     ap = qc->ap;
  494.  
  495.     qc->flags = 0;
  496. @@ -4557,7 +4557,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
  497.     struct ata_port *ap;
  498.     struct ata_link *link;
  499.  
  500. -   WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
  501. +   BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
  502.     WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
  503.     ap = qc->ap;
  504.     link = qc->dev->link;
  505. diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
  506. index d229a2d0c017..2fd45f01e7a2 100644
  507. --- a/drivers/char/Kconfig
  508. +++ b/drivers/char/Kconfig
  509. @@ -327,7 +327,6 @@ config NSC_GPIO
  510.  
  511.  config DEVMEM
  512.     bool "/dev/mem virtual device support"
  513. -   default y
  514.     help
  515.       Say Y here if you want to support the /dev/mem device.
  516.       The /dev/mem device is used to access areas of physical
  517. @@ -391,7 +390,6 @@ config MAX_RAW_DEVS
  518.  config DEVPORT
  519.     bool "/dev/port character device"
  520.     depends on ISA || PCI
  521. -   default y
  522.     help
  523.       Say Y here if you want to support the /dev/port device. The /dev/port
  524.       device is similar to /dev/mem, but for I/O ports.
  525. diff --git a/drivers/tty/Kconfig b/drivers/tty/Kconfig
  526. index e15cd6b5bb99..930be8d5d81d 100644
  527. --- a/drivers/tty/Kconfig
  528. +++ b/drivers/tty/Kconfig
  529. @@ -122,7 +122,6 @@ config UNIX98_PTYS
  530.  
  531.  config LEGACY_PTYS
  532.     bool "Legacy (BSD) PTY support"
  533. -   default y
  534.     help
  535.       A pseudo terminal (PTY) is a software device consisting of two
  536.       halves: a master and a slave. The slave device behaves identical to
  537. diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
  538. index adbcbfa11b29..b9a698fe4ee8 100644
  539. --- a/drivers/tty/tty_io.c
  540. +++ b/drivers/tty/tty_io.c
  541. @@ -171,6 +171,7 @@ static void free_tty_struct(struct tty_struct *tty)
  542.     put_device(tty->dev);
  543.     kfree(tty->write_buf);
  544.     tty->magic = 0xDEADDEAD;
  545. +   put_user_ns(tty->owner_user_ns);
  546.     kfree(tty);
  547.  }
  548.  
  549. @@ -2299,11 +2300,19 @@ static int tty_fasync(int fd, struct file *filp, int on)
  550.   * FIXME: may race normal receive processing
  551.   */
  552.  
  553. +int tiocsti_restrict = IS_ENABLED(CONFIG_SECURITY_TIOCSTI_RESTRICT);
  554. +
  555.  static int tiocsti(struct tty_struct *tty, char __user *p)
  556.  {
  557.     char ch, mbz = 0;
  558.     struct tty_ldisc *ld;
  559.  
  560. +   if (tiocsti_restrict &&
  561. +       !ns_capable(tty->owner_user_ns, CAP_SYS_ADMIN)) {
  562. +       dev_warn_ratelimited(tty->dev,
  563. +           "Denied TIOCSTI ioctl for non-privileged process\n");
  564. +       return -EPERM;
  565. +   }
  566.     if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
  567.         return -EPERM;
  568.     if (get_user(ch, p))
  569. @@ -3159,6 +3168,7 @@ struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx)
  570.     tty->index = idx;
  571.     tty_line_name(driver, idx, tty->name);
  572.     tty->dev = tty_get_device(tty);
  573. +   tty->owner_user_ns = get_user_ns(current_user_ns());
  574.  
  575.     return tty;
  576.  }
  577. diff --git a/drivers/usb/core/Makefile b/drivers/usb/core/Makefile
  578. index 18e874b0441e..fc7a3a9aa72a 100644
  579. --- a/drivers/usb/core/Makefile
  580. +++ b/drivers/usb/core/Makefile
  581. @@ -11,6 +11,7 @@ usbcore-y += phy.o port.o
  582.  usbcore-$(CONFIG_OF)       += of.o
  583.  usbcore-$(CONFIG_USB_PCI)      += hcd-pci.o
  584.  usbcore-$(CONFIG_ACPI)     += usb-acpi.o
  585. +usbcore-$(CONFIG_SYSCTL)       += sysctl.o
  586.  
  587.  obj-$(CONFIG_USB)      += usbcore.o
  588.  
  589. diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
  590. index 6ebb8bd92e9d..90ce433cb277 100644
  591. --- a/drivers/usb/core/hub.c
  592. +++ b/drivers/usb/core/hub.c
  593. @@ -5117,6 +5117,12 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
  594.             goto done;
  595.         return;
  596.     }
  597. +
  598. +   if (deny_new_usb) {
  599. +       dev_err(&port_dev->dev, "denied insert of USB device on port %d\n", port1);
  600. +       goto done;
  601. +   }
  602. +
  603.     if (hub_is_superspeed(hub->hdev))
  604.         unit_load = 150;
  605.     else
  606. diff --git a/drivers/usb/core/sysctl.c b/drivers/usb/core/sysctl.c
  607. new file mode 100644
  608. index 000000000000..3fa188ac8f67
  609. --- /dev/null
  610. +++ b/drivers/usb/core/sysctl.c
  611. @@ -0,0 +1,44 @@
  612. +#include <linux/errno.h>
  613. +#include <linux/init.h>
  614. +#include <linux/kmemleak.h>
  615. +#include <linux/sysctl.h>
  616. +#include <linux/usb.h>
  617. +
  618. +static struct ctl_table usb_table[] = {
  619. +   {
  620. +       .procname   = "deny_new_usb",
  621. +       .data       = &deny_new_usb,
  622. +       .maxlen     = sizeof(int),
  623. +       .mode       = 0644,
  624. +       .proc_handler   = proc_dointvec_minmax_sysadmin,
  625. +       .extra1     = SYSCTL_ZERO,
  626. +       .extra2     = SYSCTL_ONE,
  627. +   },
  628. +   { }
  629. +};
  630. +
  631. +static struct ctl_table usb_root_table[] = {
  632. +   { .procname = "kernel",
  633. +     .mode     = 0555,
  634. +     .child    = usb_table },
  635. +   { }
  636. +};
  637. +
  638. +static struct ctl_table_header *usb_table_header;
  639. +
  640. +int __init usb_init_sysctl(void)
  641. +{
  642. +   usb_table_header = register_sysctl_table(usb_root_table);
  643. +   if (!usb_table_header) {
  644. +       pr_warn("usb: sysctl registration failed\n");
  645. +       return -ENOMEM;
  646. +   }
  647. +
  648. +   kmemleak_not_leak(usb_table_header);
  649. +   return 0;
  650. +}
  651. +
  652. +void usb_exit_sysctl(void)
  653. +{
  654. +   unregister_sysctl_table(usb_table_header);
  655. +}
  656. diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
  657. index a566bb494e24..b305e25d94f8 100644
  658. --- a/drivers/usb/core/usb.c
  659. +++ b/drivers/usb/core/usb.c
  660. @@ -71,6 +71,9 @@ MODULE_PARM_DESC(autosuspend, "default autosuspend delay");
  661.  #define usb_autosuspend_delay      0
  662.  #endif
  663.  
  664. +int deny_new_usb __read_mostly = 0;
  665. +EXPORT_SYMBOL(deny_new_usb);
  666. +
  667.  static bool match_endpoint(struct usb_endpoint_descriptor *epd,
  668.         struct usb_endpoint_descriptor **bulk_in,
  669.         struct usb_endpoint_descriptor **bulk_out,
  670. @@ -1010,6 +1013,9 @@ static int __init usb_init(void)
  671.     usb_debugfs_init();
  672.  
  673.     usb_acpi_register();
  674. +   retval = usb_init_sysctl();
  675. +   if (retval)
  676. +       goto sysctl_init_failed;
  677.     retval = bus_register(&usb_bus_type);
  678.     if (retval)
  679.         goto bus_register_failed;
  680. @@ -1044,6 +1050,8 @@ static int __init usb_init(void)
  681.  bus_notifier_failed:
  682.     bus_unregister(&usb_bus_type);
  683.  bus_register_failed:
  684. +   usb_exit_sysctl();
  685. +sysctl_init_failed:
  686.     usb_acpi_unregister();
  687.     usb_debugfs_cleanup();
  688.  out:
  689. @@ -1067,6 +1075,7 @@ static void __exit usb_exit(void)
  690.     usb_hub_cleanup();
  691.     bus_unregister_notifier(&usb_bus_type, &usb_bus_nb);
  692.     bus_unregister(&usb_bus_type);
  693. +   usb_exit_sysctl();
  694.     usb_acpi_unregister();
  695.     usb_debugfs_cleanup();
  696.     idr_destroy(&usb_bus_idr);
  697. diff --git a/fs/exec.c b/fs/exec.c
  698. index d7c4187ca023..505427f7bc4f 100644
  699. --- a/fs/exec.c
  700. +++ b/fs/exec.c
  701. @@ -34,6 +34,7 @@
  702.  #include <linux/swap.h>
  703.  #include <linux/string.h>
  704.  #include <linux/init.h>
  705. +#include <linux/sched.h>
  706.  #include <linux/sched/mm.h>
  707.  #include <linux/sched/coredump.h>
  708.  #include <linux/sched/signal.h>
  709. @@ -65,6 +66,7 @@
  710.  #include <linux/vmalloc.h>
  711.  #include <linux/io_uring.h>
  712.  #include <linux/syscall_user_dispatch.h>
  713. +#include <linux/random.h>
  714.  
  715.  #include <linux/uaccess.h>
  716.  #include <asm/mmu_context.h>
  717. @@ -281,6 +283,8 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
  718.     mm->stack_vm = mm->total_vm = 1;
  719.     mmap_write_unlock(mm);
  720.     bprm->p = vma->vm_end - sizeof(void *);
  721. +   if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
  722. +       bprm->p ^= get_random_int() & ~PAGE_MASK;
  723.     return 0;
  724.  err:
  725.     mmap_write_unlock(mm);
  726. diff --git a/fs/inode.c b/fs/inode.c
  727. index a047ab306f9a..c60c118da90f 100644
  728. --- a/fs/inode.c
  729. +++ b/fs/inode.c
  730. @@ -116,6 +116,10 @@ int proc_nr_inodes(struct ctl_table *table, int write,
  731.  }
  732.  #endif
  733.  
  734. +/* sysctl */
  735. +int device_sidechannel_restrict __read_mostly = 1;
  736. +EXPORT_SYMBOL(device_sidechannel_restrict);
  737. +
  738.  static int no_open(struct inode *inode, struct file *file)
  739.  {
  740.     return -ENXIO;
  741. diff --git a/fs/namei.c b/fs/namei.c
  742. index 48a2f288e802..4426e7b2bd4d 100644
  743. --- a/fs/namei.c
  744. +++ b/fs/namei.c
  745. @@ -992,10 +992,10 @@ static inline void put_link(struct nameidata *nd)
  746.         path_put(&last->link);
  747.  }
  748.  
  749. -int sysctl_protected_symlinks __read_mostly = 0;
  750. -int sysctl_protected_hardlinks __read_mostly = 0;
  751. -int sysctl_protected_fifos __read_mostly;
  752. -int sysctl_protected_regular __read_mostly;
  753. +int sysctl_protected_symlinks __read_mostly = 1;
  754. +int sysctl_protected_hardlinks __read_mostly = 1;
  755. +int sysctl_protected_fifos __read_mostly = 2;
  756. +int sysctl_protected_regular __read_mostly = 2;
  757.  
  758.  /**
  759.   * may_follow_link - Check symlink following for unsafe situations
  760. diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig
  761. index 14a72224b657..080a8027c6b1 100644
  762. --- a/fs/nfs/Kconfig
  763. +++ b/fs/nfs/Kconfig
  764. @@ -195,7 +195,6 @@ config NFS_DEBUG
  765.     bool
  766.     depends on NFS_FS && SUNRPC_DEBUG
  767.     select CRC32
  768. -   default y
  769.  
  770.  config NFS_DISABLE_UDP_SUPPORT
  771.         bool "NFS: Disable NFS UDP protocol support"
  772. diff --git a/fs/overlayfs/Kconfig b/fs/overlayfs/Kconfig
  773. index dd188c7996b3..f1f14808bc8f 100644
  774. --- a/fs/overlayfs/Kconfig
  775. +++ b/fs/overlayfs/Kconfig
  776. @@ -124,3 +124,19 @@ config OVERLAY_FS_METACOPY
  777.       that doesn't support this feature will have unexpected results.
  778.  
  779.       If unsure, say N.
  780. +
  781. +config OVERLAY_FS_UNPRIVILEGED
  782. +   bool "Overlayfs: turn on unprivileged user namespace mounts"
  783. +   default n
  784. +   depends on OVERLAY_FS
  785. +   help
  786. +     When disabled, unprivileged users will not be able to create
  787. +     new overlayfs mounts. This cuts the attack surface if no
  788. +     unprivileged user namespace mounts are required like for
  789. +     running rootless containers.
  790. +
  791. +     Overlayfs has been part of several recent local privilege
  792. +     escalation exploits, so if you are security-conscious
  793. +     you want to disable this.
  794. +
  795. +     If unsure, say N.
  796. diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
  797. index 787ce7c38fba..9eff43cc6482 100644
  798. --- a/fs/overlayfs/super.c
  799. +++ b/fs/overlayfs/super.c
  800. @@ -2133,7 +2133,9 @@ static struct dentry *ovl_mount(struct file_system_type *fs_type, int flags,
  801.  static struct file_system_type ovl_fs_type = {
  802.     .owner      = THIS_MODULE,
  803.     .name       = "overlay",
  804. +#ifdef CONFIG_OVERLAY_FS_UNPRIVILEGED
  805.     .fs_flags   = FS_USERNS_MOUNT,
  806. +#endif
  807.     .mount      = ovl_mount,
  808.     .kill_sb    = kill_anon_super,
  809.  };
  810. diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig
  811. index c930001056f9..6a0a51b3f593 100644
  812. --- a/fs/proc/Kconfig
  813. +++ b/fs/proc/Kconfig
  814. @@ -41,7 +41,6 @@ config PROC_KCORE
  815.  config PROC_VMCORE
  816.     bool "/proc/vmcore support"
  817.     depends on PROC_FS && CRASH_DUMP
  818. -   default y
  819.     help
  820.       Exports the dump image of crashed kernel in ELF format.
  821.  
  822. diff --git a/fs/stat.c b/fs/stat.c
  823. index 1fa38bdec1a6..cac8d4d0cfd9 100644
  824. --- a/fs/stat.c
  825. +++ b/fs/stat.c
  826. @@ -51,8 +51,13 @@ void generic_fillattr(struct user_namespace *mnt_userns, struct inode *inode,
  827.     stat->gid = i_gid_into_mnt(mnt_userns, inode);
  828.     stat->rdev = inode->i_rdev;
  829.     stat->size = i_size_read(inode);
  830. -   stat->atime = inode->i_atime;
  831. -   stat->mtime = inode->i_mtime;
  832. +   if (is_sidechannel_device(inode) && !capable_noaudit(CAP_MKNOD)) {
  833. +       stat->atime = inode->i_ctime;
  834. +       stat->mtime = inode->i_ctime;
  835. +   } else {
  836. +       stat->atime = inode->i_atime;
  837. +       stat->mtime = inode->i_mtime;
  838. +   }
  839.     stat->ctime = inode->i_ctime;
  840.     stat->blksize = i_blocksize(inode);
  841.     stat->blocks = inode->i_blocks;
  842. @@ -101,9 +106,14 @@ int vfs_getattr_nosec(const struct path *path, struct kstat *stat,
  843.                   STATX_ATTR_DAX);
  844.  
  845.     mnt_userns = mnt_user_ns(path->mnt);
  846. -   if (inode->i_op->getattr)
  847. -       return inode->i_op->getattr(mnt_userns, path, stat,
  848. -                       request_mask, query_flags);
  849. +   if (inode->i_op->getattr) {
  850. +       int retval = inode->i_op->getattr(mnt_userns, path, stat, request_mask, query_flags);
  851. +       if (!retval && is_sidechannel_device(inode) && !capable_noaudit(CAP_MKNOD)) {
  852. +           stat->atime = stat->ctime;
  853. +           stat->mtime = stat->ctime;
  854. +       }
  855. +       return retval;
  856. +   }
  857.  
  858.     generic_fillattr(mnt_userns, inode, stat);
  859.     return 0;
  860. diff --git a/include/linux/cache.h b/include/linux/cache.h
  861. index d742c57eaee5..f0222c070458 100644
  862. --- a/include/linux/cache.h
  863. +++ b/include/linux/cache.h
  864. @@ -37,6 +37,8 @@
  865.  #define __ro_after_init __section(".data..ro_after_init")
  866.  #endif
  867.  
  868. +#define __read_only __ro_after_init
  869. +
  870.  #ifndef ____cacheline_aligned
  871.  #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
  872.  #endif
  873. diff --git a/include/linux/capability.h b/include/linux/capability.h
  874. index 65efb74c3585..7fca4dd7f3b1 100644
  875. --- a/include/linux/capability.h
  876. +++ b/include/linux/capability.h
  877. @@ -208,6 +208,7 @@ extern bool has_capability_noaudit(struct task_struct *t, int cap);
  878.  extern bool has_ns_capability_noaudit(struct task_struct *t,
  879.                       struct user_namespace *ns, int cap);
  880.  extern bool capable(int cap);
  881. +extern bool capable_noaudit(int cap);
  882.  extern bool ns_capable(struct user_namespace *ns, int cap);
  883.  extern bool ns_capable_noaudit(struct user_namespace *ns, int cap);
  884.  extern bool ns_capable_setid(struct user_namespace *ns, int cap);
  885. @@ -234,6 +235,10 @@ static inline bool capable(int cap)
  886.  {
  887.     return true;
  888.  }
  889. +static inline bool capable_noaudit(int cap)
  890. +{
  891. +   return true;
  892. +}
  893.  static inline bool ns_capable(struct user_namespace *ns, int cap)
  894.  {
  895.     return true;
  896. diff --git a/include/linux/fs.h b/include/linux/fs.h
  897. index ec8f3ddf4a6a..6c00f06d962c 100644
  898. --- a/include/linux/fs.h
  899. +++ b/include/linux/fs.h
  900. @@ -3590,4 +3590,15 @@ static inline int inode_drain_writes(struct inode *inode)
  901.     return filemap_write_and_wait(inode->i_mapping);
  902.  }
  903.  
  904. +extern int device_sidechannel_restrict;
  905. +
  906. +static inline bool is_sidechannel_device(const struct inode *inode)
  907. +{
  908. +   umode_t mode;
  909. +   if (!device_sidechannel_restrict)
  910. +       return false;
  911. +   mode = inode->i_mode;
  912. +   return ((S_ISCHR(mode) || S_ISBLK(mode)) && (mode & (S_IROTH | S_IWOTH)));
  913. +}
  914. +
  915.  #endif /* _LINUX_FS_H */
  916. diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
  917. index f8acddcf54fb..7b109980327f 100644
  918. --- a/include/linux/fsnotify.h
  919. +++ b/include/linux/fsnotify.h
  920. @@ -83,10 +83,14 @@ static inline void fsnotify_dentry(struct dentry *dentry, __u32 mask)
  921.  static inline int fsnotify_file(struct file *file, __u32 mask)
  922.  {
  923.     const struct path *path = &file->f_path;
  924. +   struct inode *inode = file_inode(file);
  925.  
  926.     if (file->f_mode & FMODE_NONOTIFY)
  927.         return 0;
  928.  
  929. +   if (mask & (FS_ACCESS | FS_MODIFY) && is_sidechannel_device(inode))
  930. +       return 0;
  931. +
  932.     return fsnotify_parent(path->dentry, mask, path, FSNOTIFY_EVENT_PATH);
  933.  }
  934.  
  935. diff --git a/include/linux/gfp.h b/include/linux/gfp.h
  936. index 8572a1474e16..703d25523e1d 100644
  937. --- a/include/linux/gfp.h
  938. +++ b/include/linux/gfp.h
  939. @@ -582,9 +582,9 @@ static inline struct page *alloc_pages(gfp_t gfp_mask, unsigned int order)
  940.  extern unsigned long __get_free_pages(gfp_t gfp_mask, unsigned int order);
  941.  extern unsigned long get_zeroed_page(gfp_t gfp_mask);
  942.  
  943. -void *alloc_pages_exact(size_t size, gfp_t gfp_mask);
  944. +void *alloc_pages_exact(size_t size, gfp_t gfp_mask) __attribute__((alloc_size(1)));
  945.  void free_pages_exact(void *virt, size_t size);
  946. -void * __meminit alloc_pages_exact_nid(int nid, size_t size, gfp_t gfp_mask);
  947. +void * __meminit alloc_pages_exact_nid(int nid, size_t size, gfp_t gfp_mask) __attribute__((alloc_size(2)));
  948.  
  949.  #define __get_free_page(gfp_mask) \
  950.         __get_free_pages((gfp_mask), 0)
  951. diff --git a/include/linux/highmem.h b/include/linux/highmem.h
  952. index 44170f312ae7..7f149ca78988 100644
  953. --- a/include/linux/highmem.h
  954. +++ b/include/linux/highmem.h
  955. @@ -204,6 +204,13 @@ static inline void clear_highpage(struct page *page)
  956.     kunmap_atomic(kaddr);
  957.  }
  958.  
  959. +static inline void verify_zero_highpage(struct page *page)
  960. +{
  961. +   void *kaddr = kmap_atomic(page);
  962. +   BUG_ON(memchr_inv(kaddr, 0, PAGE_SIZE));
  963. +   kunmap_atomic(kaddr);
  964. +}
  965. +
  966.  /*
  967.   * If we pass in a base or tail page, we can zero up to PAGE_SIZE.
  968.   * If we pass in a head page, we can zero up to the size of the compound page.
  969. diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
  970. index 967e25767153..8bd848becd73 100644
  971. --- a/include/linux/interrupt.h
  972. +++ b/include/linux/interrupt.h
  973. @@ -563,13 +563,13 @@ extern const char * const softirq_to_name[NR_SOFTIRQS];
  974.  
  975.  struct softirq_action
  976.  {
  977. -   void    (*action)(struct softirq_action *);
  978. +   void    (*action)(void);
  979.  };
  980.  
  981.  asmlinkage void do_softirq(void);
  982.  asmlinkage void __do_softirq(void);
  983.  
  984. -extern void open_softirq(int nr, void (*action)(struct softirq_action *));
  985. +extern void __init open_softirq(int nr, void (*action)(void));
  986.  extern void softirq_init(void);
  987.  extern void __raise_softirq_irqoff(unsigned int nr);
  988.  
  989. diff --git a/include/linux/kobject_ns.h b/include/linux/kobject_ns.h
  990. index 2b5b64256cf4..8cdce21dce0f 100644
  991. --- a/include/linux/kobject_ns.h
  992. +++ b/include/linux/kobject_ns.h
  993. @@ -45,7 +45,7 @@ struct kobj_ns_type_operations {
  994.     void (*drop_ns)(void *);
  995.  };
  996.  
  997. -int kobj_ns_type_register(const struct kobj_ns_type_operations *ops);
  998. +int __init kobj_ns_type_register(const struct kobj_ns_type_operations *ops);
  999.  int kobj_ns_type_registered(enum kobj_ns_type type);
  1000.  const struct kobj_ns_type_operations *kobj_child_ns_ops(struct kobject *parent);
  1001.  const struct kobj_ns_type_operations *kobj_ns_ops(struct kobject *kobj);
  1002. diff --git a/include/linux/mm.h b/include/linux/mm.h
  1003. index 18b8373b1474..257b7ec62322 100644
  1004. --- a/include/linux/mm.h
  1005. +++ b/include/linux/mm.h
  1006. @@ -779,7 +779,7 @@ static inline int is_vmalloc_or_module_addr(const void *x)
  1007.  }
  1008.  #endif
  1009.  
  1010. -extern void *kvmalloc_node(size_t size, gfp_t flags, int node);
  1011. +extern void *kvmalloc_node(size_t size, gfp_t flags, int node) __attribute__((alloc_size(1)));
  1012.  static inline void *kvmalloc(size_t size, gfp_t flags)
  1013.  {
  1014.     return kvmalloc_node(size, flags, NUMA_NO_NODE);
  1015. @@ -914,10 +914,15 @@ static inline void set_compound_page_dtor(struct page *page,
  1016.     page[1].compound_dtor = compound_dtor;
  1017.  }
  1018.  
  1019. -static inline void destroy_compound_page(struct page *page)
  1020. +static inline compound_page_dtor *get_compound_page_dtor(struct page *page)
  1021.  {
  1022.     VM_BUG_ON_PAGE(page[1].compound_dtor >= NR_COMPOUND_DTORS, page);
  1023. -   compound_page_dtors[page[1].compound_dtor](page);
  1024. +   return compound_page_dtors[page[1].compound_dtor];
  1025. +}
  1026. +
  1027. +static inline void destroy_compound_page(struct page *page)
  1028. +{
  1029. +   (*get_compound_page_dtor(page))(page);
  1030.  }
  1031.  
  1032.  static inline unsigned int compound_order(struct page *page)
  1033. diff --git a/include/linux/percpu.h b/include/linux/percpu.h
  1034. index 5e76af742c80..9a6c682ec127 100644
  1035. --- a/include/linux/percpu.h
  1036. +++ b/include/linux/percpu.h
  1037. @@ -123,7 +123,7 @@ extern int __init pcpu_page_first_chunk(size_t reserved_size,
  1038.                 pcpu_fc_populate_pte_fn_t populate_pte_fn);
  1039.  #endif
  1040.  
  1041. -extern void __percpu *__alloc_reserved_percpu(size_t size, size_t align);
  1042. +extern void __percpu *__alloc_reserved_percpu(size_t size, size_t align) __attribute__((alloc_size(1)));
  1043.  extern bool __is_kernel_percpu_address(unsigned long addr, unsigned long *can_addr);
  1044.  extern bool is_kernel_percpu_address(unsigned long addr);
  1045.  
  1046. @@ -131,8 +131,8 @@ extern bool is_kernel_percpu_address(unsigned long addr);
  1047.  extern void __init setup_per_cpu_areas(void);
  1048.  #endif
  1049.  
  1050. -extern void __percpu *__alloc_percpu_gfp(size_t size, size_t align, gfp_t gfp);
  1051. -extern void __percpu *__alloc_percpu(size_t size, size_t align);
  1052. +extern void __percpu *__alloc_percpu_gfp(size_t size, size_t align, gfp_t gfp) __attribute__((alloc_size(1)));
  1053. +extern void __percpu *__alloc_percpu(size_t size, size_t align) __attribute__((alloc_size(1)));
  1054.  extern void free_percpu(void __percpu *__pdata);
  1055.  extern phys_addr_t per_cpu_ptr_to_phys(void *addr);
  1056.  
  1057. diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
  1058. index 3d478abf411c..576ce489d5e7 100644
  1059. --- a/include/linux/perf_event.h
  1060. +++ b/include/linux/perf_event.h
  1061. @@ -1317,6 +1317,14 @@ static inline int perf_is_paranoid(void)
  1062.     return sysctl_perf_event_paranoid > -1;
  1063.  }
  1064.  
  1065. +static inline int perf_allow_open(struct perf_event_attr *attr)
  1066. +{
  1067. +   if (sysctl_perf_event_paranoid > 2 && !perfmon_capable())
  1068. +       return -EACCES;
  1069. +
  1070. +   return security_perf_event_open(attr, PERF_SECURITY_OPEN);
  1071. +}
  1072. +
  1073.  static inline int perf_allow_kernel(struct perf_event_attr *attr)
  1074.  {
  1075.     if (sysctl_perf_event_paranoid > 1 && !perfmon_capable())
  1076. diff --git a/include/linux/slab.h b/include/linux/slab.h
  1077. index 7ae604076767..56c3a5b432fb 100644
  1078. --- a/include/linux/slab.h
  1079. +++ b/include/linux/slab.h
  1080. @@ -181,7 +181,7 @@ int kmem_cache_shrink(struct kmem_cache *);
  1081.  /*
  1082.   * Common kmalloc functions provided by all allocators
  1083.   */
  1084. -void * __must_check krealloc(const void *, size_t, gfp_t);
  1085. +void * __must_check krealloc(const void *, size_t, gfp_t) __attribute((alloc_size(2)));
  1086.  void kfree(const void *);
  1087.  void kfree_sensitive(const void *);
  1088.  size_t __ksize(const void *);
  1089. @@ -388,7 +388,7 @@ static __always_inline unsigned int kmalloc_index(size_t size)
  1090.  }
  1091.  #endif /* !CONFIG_SLOB */
  1092.  
  1093. -void *__kmalloc(size_t size, gfp_t flags) __assume_kmalloc_alignment __malloc;
  1094. +void *__kmalloc(size_t size, gfp_t flags) __assume_kmalloc_alignment __malloc __attribute__((alloc_size(1)));
  1095.  void *kmem_cache_alloc(struct kmem_cache *, gfp_t flags) __assume_slab_alignment __malloc;
  1096.  void kmem_cache_free(struct kmem_cache *, void *);
  1097.  
  1098. @@ -412,7 +412,7 @@ static __always_inline void kfree_bulk(size_t size, void **p)
  1099.  }
  1100.  
  1101.  #ifdef CONFIG_NUMA
  1102. -void *__kmalloc_node(size_t size, gfp_t flags, int node) __assume_kmalloc_alignment __malloc;
  1103. +void *__kmalloc_node(size_t size, gfp_t flags, int node) __assume_kmalloc_alignment __malloc __attribute__((alloc_size(1)));
  1104.  void *kmem_cache_alloc_node(struct kmem_cache *, gfp_t flags, int node) __assume_slab_alignment __malloc;
  1105.  #else
  1106.  static __always_inline void *__kmalloc_node(size_t size, gfp_t flags, int node)
  1107. @@ -537,7 +537,7 @@ static __always_inline void *kmalloc_large(size_t size, gfp_t flags)
  1108.   * Try really hard to succeed the allocation but fail
  1109.   * eventually.
  1110.   */
  1111. -static __always_inline void *kmalloc(size_t size, gfp_t flags)
  1112. +static __always_inline __attribute__((alloc_size(1))) void *kmalloc(size_t size, gfp_t flags)
  1113.  {
  1114.     if (__builtin_constant_p(size)) {
  1115.  #ifndef CONFIG_SLOB
  1116. @@ -559,7 +559,7 @@ static __always_inline void *kmalloc(size_t size, gfp_t flags)
  1117.     return __kmalloc(size, flags);
  1118.  }
  1119.  
  1120. -static __always_inline void *kmalloc_node(size_t size, gfp_t flags, int node)
  1121. +static __always_inline __attribute__((alloc_size(1))) void *kmalloc_node(size_t size, gfp_t flags, int node)
  1122.  {
  1123.  #ifndef CONFIG_SLOB
  1124.     if (__builtin_constant_p(size) &&
  1125. diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
  1126. index dcde82a4434c..6cf113695267 100644
  1127. --- a/include/linux/slub_def.h
  1128. +++ b/include/linux/slub_def.h
  1129. @@ -114,6 +114,11 @@ struct kmem_cache {
  1130.     unsigned long random;
  1131.  #endif
  1132.  
  1133. +#ifdef CONFIG_SLAB_CANARY
  1134. +   unsigned long random_active;
  1135. +   unsigned long random_inactive;
  1136. +#endif
  1137. +
  1138.  #ifdef CONFIG_NUMA
  1139.     /*
  1140.      * Defragmentation by allocating from a remote node.
  1141. diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
  1142. index 51298a4f4623..b835c57330f2 100644
  1143. --- a/include/linux/sysctl.h
  1144. +++ b/include/linux/sysctl.h
  1145. @@ -53,6 +53,8 @@ int proc_douintvec(struct ctl_table *, int, void *, size_t *, loff_t *);
  1146.  int proc_dointvec_minmax(struct ctl_table *, int, void *, size_t *, loff_t *);
  1147.  int proc_douintvec_minmax(struct ctl_table *table, int write, void *buffer,
  1148.         size_t *lenp, loff_t *ppos);
  1149. +int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
  1150. +                 void *buffer, size_t *lenp, loff_t *ppos);
  1151.  int proc_dointvec_jiffies(struct ctl_table *, int, void *, size_t *, loff_t *);
  1152.  int proc_dointvec_userhz_jiffies(struct ctl_table *, int, void *, size_t *,
  1153.         loff_t *);
  1154. diff --git a/include/linux/tty.h b/include/linux/tty.h
  1155. index 95fc2f100f12..b5f4d9cd20a0 100644
  1156. --- a/include/linux/tty.h
  1157. +++ b/include/linux/tty.h
  1158. @@ -14,6 +14,7 @@
  1159.  #include <uapi/linux/tty.h>
  1160.  #include <linux/rwsem.h>
  1161.  #include <linux/llist.h>
  1162. +#include <linux/user_namespace.h>
  1163.  
  1164.  
  1165.  /*
  1166. @@ -340,6 +341,7 @@ struct tty_struct {
  1167.     /* If the tty has a pending do_SAK, queue it here - akpm */
  1168.     struct work_struct SAK_work;
  1169.     struct tty_port *port;
  1170. +   struct user_namespace *owner_user_ns;
  1171.  } __randomize_layout;
  1172.  
  1173.  /* Each of a tty's open files has private_data pointing to tty_file_private */
  1174. @@ -349,6 +351,8 @@ struct tty_file_private {
  1175.     struct list_head list;
  1176.  };
  1177.  
  1178. +extern int tiocsti_restrict;
  1179. +
  1180.  /* tty magic number */
  1181.  #define TTY_MAGIC      0x5401
  1182.  
  1183. diff --git a/include/linux/usb.h b/include/linux/usb.h
  1184. index d6a41841b93e..f7f3d138b4e6 100644
  1185. --- a/include/linux/usb.h
  1186. +++ b/include/linux/usb.h
  1187. @@ -2037,6 +2037,17 @@ extern void usb_led_activity(enum usb_led_event ev);
  1188.  static inline void usb_led_activity(enum usb_led_event ev) {}
  1189.  #endif
  1190.  
  1191. +/* sysctl.c */
  1192. +extern int deny_new_usb;
  1193. +#ifdef CONFIG_SYSCTL
  1194. +extern int usb_init_sysctl(void);
  1195. +extern void usb_exit_sysctl(void);
  1196. +#else
  1197. +static inline int usb_init_sysctl(void) { return 0; }
  1198. +static inline void usb_exit_sysctl(void) { }
  1199. +#endif /* CONFIG_SYSCTL */
  1200. +
  1201. +
  1202.  #endif  /* __KERNEL__ */
  1203.  
  1204.  #endif
  1205. diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
  1206. index df92211cf771..52f9134e1d13 100644
  1207. --- a/include/linux/vmalloc.h
  1208. +++ b/include/linux/vmalloc.h
  1209. @@ -95,18 +95,18 @@ static inline void vmalloc_init(void)
  1210.  static inline unsigned long vmalloc_nr_pages(void) { return 0; }
  1211.  #endif
  1212.  
  1213. -extern void *vmalloc(unsigned long size);
  1214. -extern void *vzalloc(unsigned long size);
  1215. -extern void *vmalloc_user(unsigned long size);
  1216. -extern void *vmalloc_node(unsigned long size, int node);
  1217. -extern void *vzalloc_node(unsigned long size, int node);
  1218. -extern void *vmalloc_32(unsigned long size);
  1219. -extern void *vmalloc_32_user(unsigned long size);
  1220. -extern void *__vmalloc(unsigned long size, gfp_t gfp_mask);
  1221. +extern void *vmalloc(unsigned long size) __attribute__((alloc_size(1)));
  1222. +extern void *vzalloc(unsigned long size) __attribute__((alloc_size(1)));
  1223. +extern void *vmalloc_user(unsigned long size) __attribute__((alloc_size(1)));
  1224. +extern void *vmalloc_node(unsigned long size, int node) __attribute__((alloc_size(1)));
  1225. +extern void *vzalloc_node(unsigned long size, int node) __attribute__((alloc_size(1)));
  1226. +extern void *vmalloc_32(unsigned long size) __attribute__((alloc_size(1)));
  1227. +extern void *vmalloc_32_user(unsigned long size) __attribute__((alloc_size(1)));
  1228. +extern void *__vmalloc(unsigned long size, gfp_t gfp_mask) __attribute__((alloc_size(1)));
  1229.  extern void *__vmalloc_node_range(unsigned long size, unsigned long align,
  1230.             unsigned long start, unsigned long end, gfp_t gfp_mask,
  1231.             pgprot_t prot, unsigned long vm_flags, int node,
  1232. -           const void *caller);
  1233. +           const void *caller) __attribute__((alloc_size(1)));
  1234.  void *__vmalloc_node(unsigned long size, unsigned long align, gfp_t gfp_mask,
  1235.         int node, const void *caller);
  1236.  
  1237. diff --git a/include/net/tcp.h b/include/net/tcp.h
  1238. index 963cd86d12dd..06c953fa4701 100644
  1239. --- a/include/net/tcp.h
  1240. +++ b/include/net/tcp.h
  1241. @@ -245,6 +245,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo);
  1242.  /* sysctl variables for tcp */
  1243.  extern int sysctl_tcp_max_orphans;
  1244.  extern long sysctl_tcp_mem[3];
  1245. +extern int sysctl_tcp_simult_connect;
  1246.  
  1247.  #define TCP_RACK_LOSS_DETECTION  0x1 /* Use RACK to detect losses */
  1248.  #define TCP_RACK_STATIC_REO_WND  0x2 /* Use static RACK reo wnd */
  1249. diff --git a/init/Kconfig b/init/Kconfig
  1250. index 5f5c776ef192..70786b32d6a6 100644
  1251. --- a/init/Kconfig
  1252. +++ b/init/Kconfig
  1253. @@ -423,6 +423,7 @@ config USELIB
  1254.  config AUDIT
  1255.     bool "Auditing support"
  1256.     depends on NET
  1257. +   default y
  1258.     help
  1259.       Enable auditing infrastructure that can be used with another
  1260.       kernel subsystem, such as SELinux (which requires this for
  1261. @@ -1177,6 +1178,22 @@ config USER_NS
  1262.  
  1263.       If unsure, say N.
  1264.  
  1265. +config USER_NS_UNPRIVILEGED
  1266. +   bool "Allow unprivileged users to create namespaces"
  1267. +   depends on USER_NS
  1268. +   default n
  1269. +   help
  1270. +     When disabled, unprivileged users will not be able to create
  1271. +     new namespaces. Allowing users to create their own namespaces
  1272. +     has been part of several recent local privilege escalation
  1273. +     exploits, so if you need user namespaces but are
  1274. +     paranoid^Wsecurity-conscious you want to disable this.
  1275. +
  1276. +     This setting can be overridden at runtime via the
  1277. +     kernel.unprivileged_userns_clone sysctl.
  1278. +
  1279. +     If unsure, say N.
  1280. +
  1281.  config PID_NS
  1282.     bool "PID Namespaces"
  1283.     default y
  1284. @@ -1407,9 +1424,8 @@ menuconfig EXPERT
  1285.       Only use this if you really know what you are doing.
  1286.  
  1287.  config UID16
  1288. -   bool "Enable 16-bit UID system calls" if EXPERT
  1289. +   bool "Enable 16-bit UID system calls"
  1290.     depends on HAVE_UID16 && MULTIUSER
  1291. -   default y
  1292.     help
  1293.       This enables the legacy 16-bit UID syscall wrappers.
  1294.  
  1295. @@ -1438,14 +1454,13 @@ config SGETMASK_SYSCALL
  1296.       If unsure, leave the default option here.
  1297.  
  1298.  config SYSFS_SYSCALL
  1299. -   bool "Sysfs syscall support" if EXPERT
  1300. -   default y
  1301. +   bool "Sysfs syscall support"
  1302.     help
  1303.       sys_sysfs is an obsolete system call no longer supported in libc.
  1304.       Note that disabling this option is more secure but might break
  1305.       compatibility with some systems.
  1306.  
  1307. -     If unsure say Y here.
  1308. +     If unsure say N here.
  1309.  
  1310.  config FHANDLE
  1311.     bool "open by fhandle syscalls" if EXPERT
  1312. @@ -1596,8 +1611,7 @@ config SHMEM
  1313.       which may be appropriate on small systems without swap.
  1314.  
  1315.  config AIO
  1316. -   bool "Enable AIO support" if EXPERT
  1317. -   default y
  1318. +   bool "Enable AIO support"
  1319.     help
  1320.       This option enables POSIX asynchronous I/O which may by used
  1321.       by some high performance threaded applications. Disabling
  1322. @@ -1858,7 +1872,7 @@ config VM_EVENT_COUNTERS
  1323.  
  1324.  config SLUB_DEBUG
  1325.     default y
  1326. -   bool "Enable SLUB debugging support" if EXPERT
  1327. +   bool "Enable SLUB debugging support"
  1328.     depends on SLUB && SYSFS
  1329.     help
  1330.       SLUB has extensive debug support features. Disabling these can
  1331. @@ -1868,7 +1882,6 @@ config SLUB_DEBUG
  1332.  
  1333.  config COMPAT_BRK
  1334.     bool "Disable heap randomization"
  1335. -   default y
  1336.     help
  1337.       Randomizing heap placement makes heap exploits harder, but it
  1338.       also breaks ancient binaries (including anything libc5 based).
  1339. @@ -1915,7 +1928,6 @@ endchoice
  1340.  
  1341.  config SLAB_MERGE_DEFAULT
  1342.     bool "Allow slab caches to be merged"
  1343. -   default y
  1344.     help
  1345.       For reduced kernel memory fragmentation, slab caches can be
  1346.       merged when they share the same size and other characteristics.
  1347. @@ -1930,6 +1942,7 @@ config SLAB_MERGE_DEFAULT
  1348.  config SLAB_FREELIST_RANDOM
  1349.     bool "Randomize slab freelist"
  1350.     depends on SLAB || SLUB
  1351. +   default y
  1352.     help
  1353.       Randomizes the freelist order used on creating new pages. This
  1354.       security feature reduces the predictability of the kernel slab
  1355. @@ -1938,6 +1951,7 @@ config SLAB_FREELIST_RANDOM
  1356.  config SLAB_FREELIST_HARDENED
  1357.     bool "Harden slab freelist metadata"
  1358.     depends on SLAB || SLUB
  1359. +   default y
  1360.     help
  1361.       Many kernel heap attacks try to target slab cache metadata and
  1362.       other infrastructure. This options makes minor performance
  1363. @@ -1946,6 +1960,23 @@ config SLAB_FREELIST_HARDENED
  1364.       sanity-checking than others. This option is most effective with
  1365.       CONFIG_SLUB.
  1366.  
  1367. +config SLAB_CANARY
  1368. +   depends on SLUB
  1369. +   depends on !SLAB_MERGE_DEFAULT
  1370. +   bool "SLAB canaries"
  1371. +   default y
  1372. +   help
  1373. +     Place canaries at the end of kernel slab allocations, sacrificing
  1374. +     some performance and memory usage for security.
  1375. +
  1376. +     Canaries can detect some forms of heap corruption when allocations
  1377. +     are freed and as part of the HARDENED_USERCOPY feature. It provides
  1378. +     basic use-after-free detection for HARDENED_USERCOPY.
  1379. +
  1380. +     Canaries absorb small overflows (rendering them harmless), mitigate
  1381. +     non-NUL terminated C string overflows on 64-bit via a guaranteed zero
  1382. +     byte and provide basic double-free detection.
  1383. +
  1384.  config SHUFFLE_PAGE_ALLOCATOR
  1385.     bool "Page allocator randomization"
  1386.     default SLAB_FREELIST_RANDOM && ACPI_NUMA
  1387. diff --git a/kernel/audit.c b/kernel/audit.c
  1388. index 551a394bc8f4..a01c6f5c2277 100644
  1389. --- a/kernel/audit.c
  1390. +++ b/kernel/audit.c
  1391. @@ -1693,6 +1693,9 @@ static int __init audit_enable(char *str)
  1392.  
  1393.     if (audit_default == AUDIT_OFF)
  1394.         audit_initialized = AUDIT_DISABLED;
  1395. +   else if (!audit_ever_enabled)
  1396. +       audit_initialized = AUDIT_UNINITIALIZED;
  1397. +
  1398.     if (audit_set_enabled(audit_default))
  1399.         pr_err("audit: error setting audit state (%d)\n",
  1400.                audit_default);
  1401. diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
  1402. index 952d98beda63..b17c1043a7fe 100644
  1403. --- a/kernel/bpf/core.c
  1404. +++ b/kernel/bpf/core.c
  1405. @@ -526,7 +526,7 @@ void bpf_prog_kallsyms_del_all(struct bpf_prog *fp)
  1406.  /* All BPF JIT sysctl knobs here. */
  1407.  int bpf_jit_enable   __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
  1408.  int bpf_jit_kallsyms __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
  1409. -int bpf_jit_harden   __read_mostly;
  1410. +int bpf_jit_harden   __read_mostly = 2;
  1411.  long bpf_jit_limit   __read_mostly;
  1412.  
  1413.  static void
  1414. diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
  1415. index 250503482cda..159df7e0a739 100644
  1416. --- a/kernel/bpf/syscall.c
  1417. +++ b/kernel/bpf/syscall.c
  1418. @@ -50,7 +50,7 @@ static DEFINE_SPINLOCK(map_idr_lock);
  1419.  static DEFINE_IDR(link_idr);
  1420.  static DEFINE_SPINLOCK(link_idr_lock);
  1421.  
  1422. -int sysctl_unprivileged_bpf_disabled __read_mostly;
  1423. +int sysctl_unprivileged_bpf_disabled __read_mostly = 1;
  1424.  
  1425.  static const struct bpf_map_ops * const bpf_map_types[] = {
  1426.  #define BPF_PROG_TYPE(_id, _name, prog_ctx_type, kern_ctx_type)
  1427. diff --git a/kernel/capability.c b/kernel/capability.c
  1428. index 46a361dde042..f0c387f421a0 100644
  1429. --- a/kernel/capability.c
  1430. +++ b/kernel/capability.c
  1431. @@ -449,6 +449,12 @@ bool capable(int cap)
  1432.     return ns_capable(&init_user_ns, cap);
  1433.  }
  1434.  EXPORT_SYMBOL(capable);
  1435. +
  1436. +bool capable_noaudit(int cap)
  1437. +{
  1438. +   return ns_capable_noaudit(&init_user_ns, cap);
  1439. +}
  1440. +EXPORT_SYMBOL(capable_noaudit);
  1441.  #endif /* CONFIG_MULTIUSER */
  1442.  
  1443.  /**
  1444. diff --git a/kernel/events/core.c b/kernel/events/core.c
  1445. index 67237fc43923..a1dd11dfbcfe 100644
  1446. --- a/kernel/events/core.c
  1447. +++ b/kernel/events/core.c
  1448. @@ -412,8 +412,13 @@ static cpumask_var_t perf_online_mask;
  1449.   *   0 - disallow raw tracepoint access for unpriv
  1450.   *   1 - disallow cpu events for unpriv
  1451.   *   2 - disallow kernel profiling for unpriv
  1452. + *   3 - disallow all unpriv perf event use
  1453.   */
  1454. +#ifdef CONFIG_SECURITY_PERF_EVENTS_RESTRICT
  1455. +int sysctl_perf_event_paranoid __read_mostly = 3;
  1456. +#else
  1457.  int sysctl_perf_event_paranoid __read_mostly = 2;
  1458. +#endif
  1459.  
  1460.  /* Minimum for 512 kiB + 1 user control page */
  1461.  int sysctl_perf_event_mlock __read_mostly = 512 + (PAGE_SIZE / 1024); /* 'free' kiB per user */
  1462. @@ -11816,7 +11821,7 @@ SYSCALL_DEFINE5(perf_event_open,
  1463.         return -EINVAL;
  1464.  
  1465.     /* Do we allow access to perf_event_open(2) ? */
  1466. -   err = security_perf_event_open(&attr, PERF_SECURITY_OPEN);
  1467. +   err = perf_allow_open(&attr);
  1468.     if (err)
  1469.         return err;
  1470.  
  1471. diff --git a/kernel/fork.c b/kernel/fork.c
  1472. index 0c1d93552137..40d2e65f1e61 100644
  1473. --- a/kernel/fork.c
  1474. +++ b/kernel/fork.c
  1475. @@ -82,6 +82,7 @@
  1476.  #include <linux/perf_event.h>
  1477.  #include <linux/posix-timers.h>
  1478.  #include <linux/user-return-notifier.h>
  1479. +#include <linux/user_namespace.h>
  1480.  #include <linux/oom.h>
  1481.  #include <linux/khugepaged.h>
  1482.  #include <linux/signalfd.h>
  1483. @@ -1872,6 +1873,10 @@ static __latent_entropy struct task_struct *copy_process(
  1484.     if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS))
  1485.         return ERR_PTR(-EINVAL);
  1486.  
  1487. +   if ((clone_flags & CLONE_NEWUSER) && !unprivileged_userns_clone)
  1488. +       if (!capable(CAP_SYS_ADMIN))
  1489. +           return ERR_PTR(-EPERM);
  1490. +
  1491.     /*
  1492.      * Thread groups must share signals as well, and detached threads
  1493.      * can only be started up within the thread group.
  1494. @@ -2971,6 +2976,12 @@ int ksys_unshare(unsigned long unshare_flags)
  1495.     if (unshare_flags & CLONE_NEWNS)
  1496.         unshare_flags |= CLONE_FS;
  1497.  
  1498. +   if ((unshare_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) {
  1499. +       err = -EPERM;
  1500. +       if (!capable(CAP_SYS_ADMIN))
  1501. +           goto bad_unshare_out;
  1502. +   }
  1503. +
  1504.     err = check_unshare_flags(unshare_flags);
  1505.     if (err)
  1506.         goto bad_unshare_out;
  1507. diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
  1508. index aa897c3f2e92..d8976886fd68 100644
  1509. --- a/kernel/rcu/tiny.c
  1510. +++ b/kernel/rcu/tiny.c
  1511. @@ -101,7 +101,7 @@ static inline bool rcu_reclaim_tiny(struct rcu_head *head)
  1512.  }
  1513.  
  1514.  /* Invoke the RCU callbacks whose grace period has elapsed.  */
  1515. -static __latent_entropy void rcu_process_callbacks(struct softirq_action *unused)
  1516. +static __latent_entropy void rcu_process_callbacks(void)
  1517.  {
  1518.     struct rcu_head *next, *list;
  1519.     unsigned long flags;
  1520. diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
  1521. index 33bdbe0629d5..353a04bfaf87 100644
  1522. --- a/kernel/rcu/tree.c
  1523. +++ b/kernel/rcu/tree.c
  1524. @@ -2801,7 +2801,7 @@ static __latent_entropy void rcu_core(void)
  1525.         queue_work_on(rdp->cpu, rcu_gp_wq, &rdp->strict_work);
  1526.  }
  1527.  
  1528. -static void rcu_core_si(struct softirq_action *h)
  1529. +static void rcu_core_si(void)
  1530.  {
  1531.     rcu_core();
  1532.  }
  1533. diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
  1534. index 572f312cc803..04856e3b5328 100644
  1535. --- a/kernel/sched/fair.c
  1536. +++ b/kernel/sched/fair.c
  1537. @@ -10746,7 +10746,7 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf)
  1538.   * run_rebalance_domains is triggered when needed from the scheduler tick.
  1539.   * Also triggered for nohz idle balancing (with nohz_balancing_kick set).
  1540.   */
  1541. -static __latent_entropy void run_rebalance_domains(struct softirq_action *h)
  1542. +static __latent_entropy void run_rebalance_domains(void)
  1543.  {
  1544.     struct rq *this_rq = this_rq();
  1545.     enum cpu_idle_type idle = this_rq->idle_balance ?
  1546. diff --git a/kernel/softirq.c b/kernel/softirq.c
  1547. index 9908ec4a9bfe..2152d09b7b18 100644
  1548. --- a/kernel/softirq.c
  1549. +++ b/kernel/softirq.c
  1550. @@ -54,7 +54,7 @@ DEFINE_PER_CPU_ALIGNED(irq_cpustat_t, irq_stat);
  1551.  EXPORT_PER_CPU_SYMBOL(irq_stat);
  1552.  #endif
  1553.  
  1554. -static struct softirq_action softirq_vec[NR_SOFTIRQS] __cacheline_aligned_in_smp;
  1555. +static struct softirq_action softirq_vec[NR_SOFTIRQS] __ro_after_init __aligned(PAGE_SIZE);
  1556.  
  1557.  DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
  1558.  
  1559. @@ -342,7 +342,7 @@ asmlinkage __visible void __softirq_entry __do_softirq(void)
  1560.         kstat_incr_softirqs_this_cpu(vec_nr);
  1561.  
  1562.         trace_softirq_entry(vec_nr);
  1563. -       h->action(h);
  1564. +       h->action();
  1565.         trace_softirq_exit(vec_nr);
  1566.         if (unlikely(prev_count != preempt_count())) {
  1567.             pr_err("huh, entered softirq %u %s %p with preempt_count %08x, exited with %08x?\n",
  1568. @@ -485,7 +485,7 @@ void __raise_softirq_irqoff(unsigned int nr)
  1569.     or_softirq_pending(1UL << nr);
  1570.  }
  1571.  
  1572. -void open_softirq(int nr, void (*action)(struct softirq_action *))
  1573. +void __init open_softirq(int nr, void (*action)(void))
  1574.  {
  1575.     softirq_vec[nr].action = action;
  1576.  }
  1577. @@ -531,8 +531,7 @@ void __tasklet_hi_schedule(struct tasklet_struct *t)
  1578.  }
  1579.  EXPORT_SYMBOL(__tasklet_hi_schedule);
  1580.  
  1581. -static void tasklet_action_common(struct softirq_action *a,
  1582. -                 struct tasklet_head *tl_head,
  1583. +static void tasklet_action_common(struct tasklet_head *tl_head,
  1584.                   unsigned int softirq_nr)
  1585.  {
  1586.     struct tasklet_struct *list;
  1587. @@ -572,14 +571,14 @@ static void tasklet_action_common(struct softirq_action *a,
  1588.     }
  1589.  }
  1590.  
  1591. -static __latent_entropy void tasklet_action(struct softirq_action *a)
  1592. +static __latent_entropy void tasklet_action(void)
  1593.  {
  1594. -   tasklet_action_common(a, this_cpu_ptr(&tasklet_vec), TASKLET_SOFTIRQ);
  1595. +   tasklet_action_common(this_cpu_ptr(&tasklet_vec), TASKLET_SOFTIRQ);
  1596.  }
  1597.  
  1598. -static __latent_entropy void tasklet_hi_action(struct softirq_action *a)
  1599. +static __latent_entropy void tasklet_hi_action(void)
  1600.  {
  1601. -   tasklet_action_common(a, this_cpu_ptr(&tasklet_hi_vec), HI_SOFTIRQ);
  1602. +   tasklet_action_common(this_cpu_ptr(&tasklet_hi_vec), HI_SOFTIRQ);
  1603.  }
  1604.  
  1605.  void tasklet_setup(struct tasklet_struct *t,
  1606. diff --git a/kernel/sysctl.c b/kernel/sysctl.c
  1607. index 62fbd09b5dc1..36470990b2e6 100644
  1608. --- a/kernel/sysctl.c
  1609. +++ b/kernel/sysctl.c
  1610. @@ -106,23 +106,26 @@
  1611.  #ifdef CONFIG_USER_NS
  1612.  #include <linux/user_namespace.h>
  1613.  #endif
  1614. +#if defined CONFIG_TTY
  1615. +#include <linux/tty.h>
  1616. +#endif
  1617.  
  1618.  #if defined(CONFIG_SYSCTL)
  1619.  
  1620.  /* Constants used for minimum and  maximum */
  1621.  #ifdef CONFIG_LOCKUP_DETECTOR
  1622. -static int sixty = 60;
  1623. +static int sixty __read_only = 60;
  1624.  #endif
  1625.  
  1626. -static int __maybe_unused neg_one = -1;
  1627. -static int __maybe_unused two = 2;
  1628. -static int __maybe_unused four = 4;
  1629. -static unsigned long zero_ul;
  1630. -static unsigned long one_ul = 1;
  1631. -static unsigned long long_max = LONG_MAX;
  1632. -static int one_hundred = 100;
  1633. -static int two_hundred = 200;
  1634. -static int one_thousand = 1000;
  1635. +static int __maybe_unused neg_one __read_only = -1;
  1636. +static int __maybe_unused two __read_only = 2;
  1637. +static int __maybe_unused four __read_only = 4;
  1638. +static unsigned long zero_ul __read_only;
  1639. +static unsigned long one_ul __read_only = 1;
  1640. +static unsigned long long_max __read_only = LONG_MAX;
  1641. +static int one_hundred __read_only = 100;
  1642. +static int two_hundred __read_only = 200;
  1643. +static int one_thousand __read_only = 1000;
  1644.  #ifdef CONFIG_SCHED_MUQSS
  1645.  static int zero = 0;
  1646.  static int one = 1;
  1647. @@ -134,20 +137,20 @@
  1648.  extern int hrtimeout_min_us;
  1649.  #endif
  1650.  #if defined(CONFIG_PRINTK) || defined(CONFIG_SCHED_MUQSS)
  1651. -static int ten_thousand = 10000;
  1652. +static int ten_thousand __read_only = 10000;
  1653.  #endif
  1654.  #ifdef CONFIG_PERF_EVENTS
  1655. -static int six_hundred_forty_kb = 640 * 1024;
  1656. +static int six_hundred_forty_kb __read_only = 640 * 1024;
  1657.  #endif
  1658.  
  1659.  /* this is needed for the proc_doulongvec_minmax of vm_dirty_bytes */
  1660. -static unsigned long dirty_bytes_min = 2 * PAGE_SIZE;
  1661. +static unsigned long dirty_bytes_min __read_only = 2 * PAGE_SIZE;
  1662.  
  1663.  /* this is needed for the proc_dointvec_minmax for [fs_]overflow UID and GID */
  1664. -static int maxolduid = 65535;
  1665. -static int minolduid;
  1666. +static int maxolduid __read_only = 65535;
  1667. +static int minolduid __read_only;
  1668.  
  1669. -static int ngroups_max = NGROUPS_MAX;
  1670. +static int ngroups_max __read_only = NGROUPS_MAX;
  1671.  static const int cap_last_cap = CAP_LAST_CAP;
  1672.  
  1673.  /*
  1674. @@ -155,7 +158,7 @@
  1675.   * and hung_task_check_interval_secs
  1676.   */
  1677.  #ifdef CONFIG_DETECT_HUNG_TASK
  1678. -static unsigned long hung_task_timeout_max = (LONG_MAX/HZ);
  1679. +static unsigned long hung_task_timeout_max __read_only = (LONG_MAX/HZ);
  1680.  #endif
  1681.  
  1682.  #ifdef CONFIG_INOTIFY_USER
  1683. @@ -198,19 +201,19 @@
  1684.  #endif
  1685.  
  1686.  #if defined(CONFIG_SCHED_DEBUG) && !defined(CONFIG_SCHED_MUQSS)
  1687. -static int min_sched_granularity_ns = 100000;      /* 100 usecs */
  1688. -static int max_sched_granularity_ns = NSEC_PER_SEC;    /* 1 second */
  1689. -static int min_wakeup_granularity_ns;          /* 0 usecs */
  1690. -static int max_wakeup_granularity_ns = NSEC_PER_SEC;   /* 1 second */
  1691. +static int min_sched_granularity_ns __read_only = 100000;      /* 100 usecs */
  1692. +static int max_sched_granularity_ns __read_only = NSEC_PER_SEC;    /* 1 second */
  1693. +static int min_wakeup_granularity_ns __read_only;          /* 0 usecs */
  1694. +static int max_wakeup_granularity_ns __read_only = NSEC_PER_SEC;   /* 1 second */
  1695.  #ifdef CONFIG_SMP
  1696. -static int min_sched_tunable_scaling = SCHED_TUNABLESCALING_NONE;
  1697. -static int max_sched_tunable_scaling = SCHED_TUNABLESCALING_END-1;
  1698. +static int min_sched_tunable_scaling __read_only = SCHED_TUNABLESCALING_NONE;
  1699. +static int max_sched_tunable_scaling __read_only = SCHED_TUNABLESCALING_END-1;
  1700.  #endif /* CONFIG_SMP */
  1701.  #endif /* CONFIG_SCHED_DEBUG && !CONFIG_SCHED_MUQSS */
  1702.  
  1703.  #ifdef CONFIG_COMPACTION
  1704. -static int min_extfrag_threshold;
  1705. -static int max_extfrag_threshold = 1000;
  1706. +static int min_extfrag_threshold __read_only;
  1707. +static int max_extfrag_threshold __read_only = 1000;
  1708.  #endif
  1709.  
  1710.  #endif /* CONFIG_SYSCTL */
  1711. @@ -900,8 +903,27 @@
  1712.     return err;
  1713.  }
  1714.  
  1715. -#ifdef CONFIG_PRINTK
  1716. -static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
  1717. +/**
  1718. + * proc_dointvec_minmax_sysadmin - read a vector of integers with min/max values
  1719. + * checking CAP_SYS_ADMIN on write
  1720. + * @table: the sysctl table
  1721. + * @write: %TRUE if this is a write to the sysctl file
  1722. + * @buffer: the user buffer
  1723. + * @lenp: the size of the user buffer
  1724. + * @ppos: file position
  1725. + *
  1726. + * Reads/writes up to table->maxlen/sizeof(unsigned int) integer
  1727. + * values from/to the user buffer, treated as an ASCII string.
  1728. + *
  1729. + * This routine will ensure the values are within the range specified by
  1730. + * table->extra1 (min) and table->extra2 (max).
  1731. + *
  1732. + * Writing is only allowed when root has CAP_SYS_ADMIN.
  1733. + *
  1734. + * Returns 0 on success, -EPERM on permission failure or -EINVAL on write
  1735. + * when the range check fails.
  1736. + */
  1737. +int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
  1738.                 void *buffer, size_t *lenp, loff_t *ppos)
  1739.  {
  1740.     if (write && !capable(CAP_SYS_ADMIN))
  1741. @@ -909,7 +931,6 @@
  1742.  
  1743.     return proc_dointvec_minmax(table, write, buffer, lenp, ppos);
  1744.  }
  1745. -#endif
  1746.  
  1747.  /**
  1748.   * struct do_proc_dointvec_minmax_conv_param - proc_dointvec_minmax() range checking structure
  1749. @@ -1595,6 +1616,12 @@
  1750.     return -ENOSYS;
  1751.  }
  1752.  
  1753. +int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
  1754. +                 void *buffer, size_t *lenp, loff_t *ppos)
  1755. +{
  1756. +   return -ENOSYS;
  1757. +}
  1758. +
  1759.  int proc_dointvec_jiffies(struct ctl_table *table, int write,
  1760.             void *buffer, size_t *lenp, loff_t *ppos)
  1761.  {
  1762. @@ -1992,6 +2019,15 @@
  1763.         .proc_handler   = proc_dointvec,
  1764.     },
  1765.  #endif
  1766. +#ifdef CONFIG_USER_NS
  1767. +   {
  1768. +       .procname   = "unprivileged_userns_clone",
  1769. +       .data       = &unprivileged_userns_clone,
  1770. +       .maxlen     = sizeof(int),
  1771. +       .mode       = 0644,
  1772. +       .proc_handler   = proc_dointvec,
  1773. +   },
  1774. +#endif
  1775.  #ifdef CONFIG_PROC_SYSCTL
  1776.     {
  1777.         .procname   = "tainted",
  1778. @@ -2350,6 +2386,26 @@
  1779.         .extra2     = &two,
  1780.     },
  1781.  #endif
  1782. +#if defined CONFIG_TTY
  1783. +   {
  1784. +       .procname   = "tiocsti_restrict",
  1785. +       .data       = &tiocsti_restrict,
  1786. +       .maxlen     = sizeof(int),
  1787. +       .mode       = 0644,
  1788. +       .proc_handler   = proc_dointvec_minmax_sysadmin,
  1789. +       .extra1     = SYSCTL_ZERO,
  1790. +       .extra2     = SYSCTL_ONE,
  1791. +   },
  1792. +#endif
  1793. +   {
  1794. +       .procname   = "device_sidechannel_restrict",
  1795. +       .data       = &device_sidechannel_restrict,
  1796. +       .maxlen     = sizeof(int),
  1797. +       .mode       = 0644,
  1798. +       .proc_handler   = proc_dointvec_minmax_sysadmin,
  1799. +       .extra1     = SYSCTL_ZERO,
  1800. +       .extra2     = SYSCTL_ONE,
  1801. +   },
  1802.     {
  1803.         .procname   = "ngroups_max",
  1804.         .data       = &ngroups_max,
  1805. @@ -3530,6 +3586,7 @@
  1806.  EXPORT_SYMBOL(proc_dointvec_jiffies);
  1807.  EXPORT_SYMBOL(proc_dointvec_minmax);
  1808.  EXPORT_SYMBOL_GPL(proc_douintvec_minmax);
  1809. +EXPORT_SYMBOL(proc_dointvec_minmax_sysadmin);
  1810.  EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
  1811.  EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
  1812.  EXPORT_SYMBOL(proc_dostring);
  1813. diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
  1814. index 5c9d968187ae..80156280360f 100644
  1815. --- a/kernel/time/hrtimer.c
  1816. +++ b/kernel/time/hrtimer.c
  1817. @@ -1605,7 +1605,7 @@ static void __hrtimer_run_queues(struct hrtimer_cpu_base *cpu_base, ktime_t now,
  1818.     }
  1819.  }
  1820.  
  1821. -static __latent_entropy void hrtimer_run_softirq(struct softirq_action *h)
  1822. +static __latent_entropy void hrtimer_run_softirq(void)
  1823.  {
  1824.     struct hrtimer_cpu_base *cpu_base = this_cpu_ptr(&hrtimer_bases);
  1825.     unsigned long flags;
  1826. diff --git a/kernel/time/timer.c b/kernel/time/timer.c
  1827. index f475f1a027c8..ff43cfc99f71 100644
  1828. --- a/kernel/time/timer.c
  1829. +++ b/kernel/time/timer.c
  1830. @@ -1751,7 +1751,7 @@ static inline void __run_timers(struct timer_base *base)
  1831.  /*
  1832.   * This function runs timers and the timer-tq in bottom half context.
  1833.   */
  1834. -static __latent_entropy void run_timer_softirq(struct softirq_action *h)
  1835. +static __latent_entropy void run_timer_softirq(void)
  1836.  {
  1837.     struct timer_base *base = this_cpu_ptr(&timer_bases[BASE_STD]);
  1838.  
  1839. diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
  1840. index 5c9f528dd46d..2fada078d7f7 100644
  1841. --- a/lib/Kconfig.debug
  1842. +++ b/lib/Kconfig.debug
  1843. @@ -412,6 +412,9 @@ config DEBUG_FORCE_FUNCTION_ALIGN_32B
  1844.  
  1845.       It is mainly for debug and performance tuning use.
  1846.  
  1847. +config DEBUG_WRITABLE_FUNCTION_POINTERS_VERBOSE
  1848. +   bool "Enable verbose reporting of writable function pointers"
  1849. +
  1850.  #
  1851.  # Select this config option from the architecture Kconfig, if it
  1852.  # is preferred to always offer frame pointers as a config
  1853. @@ -526,7 +529,7 @@ config DEBUG_FS
  1854.  choice
  1855.     prompt "Debugfs default access"
  1856.     depends on DEBUG_FS
  1857. -   default DEBUG_FS_ALLOW_ALL
  1858. +   default DEBUG_FS_ALLOW_NONE
  1859.     help
  1860.       This selects the default access restrictions for debugfs.
  1861.       It can be overridden with kernel command line option
  1862. @@ -955,6 +958,7 @@ menu "Debug Oops, Lockups and Hangs"
  1863.  
  1864.  config PANIC_ON_OOPS
  1865.     bool "Panic on Oops"
  1866. +   default y
  1867.     help
  1868.       Say Y here to enable the kernel to panic when it oopses. This
  1869.       has the same effect as setting oops=panic on the kernel command
  1870. @@ -964,7 +968,7 @@ config PANIC_ON_OOPS
  1871.       anything erroneous after an oops which could result in data
  1872.       corruption or other issues.
  1873.  
  1874. -     Say N if unsure.
  1875. +     Say Y if unsure.
  1876.  
  1877.  config PANIC_ON_OOPS_VALUE
  1878.     int
  1879. @@ -1539,6 +1543,7 @@ menu "Debug kernel data structures"
  1880.  config DEBUG_LIST
  1881.     bool "Debug linked list manipulation"
  1882.     depends on DEBUG_KERNEL || BUG_ON_DATA_CORRUPTION
  1883. +   default y
  1884.     help
  1885.       Enable this to turn on extended checks in the linked-list
  1886.       walking routines.
  1887. @@ -1578,6 +1583,7 @@ config DEBUG_NOTIFIERS
  1888.  config BUG_ON_DATA_CORRUPTION
  1889.     bool "Trigger a BUG when data corruption is detected"
  1890.     select DEBUG_LIST
  1891. +   default y
  1892.     help
  1893.       Select this option if the kernel should BUG when it encounters
  1894.       data corruption in kernel memory structures when they get checked
  1895. @@ -1733,6 +1739,7 @@ config STRICT_DEVMEM
  1896.  config IO_STRICT_DEVMEM
  1897.     bool "Filter I/O access to /dev/mem"
  1898.     depends on STRICT_DEVMEM
  1899. +   default y
  1900.     help
  1901.       If this option is disabled, you allow userspace (root) access to all
  1902.       io-memory regardless of whether a driver is actively using that
  1903. diff --git a/lib/irq_poll.c b/lib/irq_poll.c
  1904. index 2f17b488d58e..b6e7996a0058 100644
  1905. --- a/lib/irq_poll.c
  1906. +++ b/lib/irq_poll.c
  1907. @@ -75,7 +75,7 @@ void irq_poll_complete(struct irq_poll *iop)
  1908.  }
  1909.  EXPORT_SYMBOL(irq_poll_complete);
  1910.  
  1911. -static void __latent_entropy irq_poll_softirq(struct softirq_action *h)
  1912. +static void __latent_entropy irq_poll_softirq(void)
  1913.  {
  1914.     struct list_head *list = this_cpu_ptr(&blk_cpu_iopoll);
  1915.     int rearm = 0, budget = irq_poll_budget;
  1916. diff --git a/lib/kobject.c b/lib/kobject.c
  1917. index ea53b30cf483..5343bbeea5f8 100644
  1918. --- a/lib/kobject.c
  1919. +++ b/lib/kobject.c
  1920. @@ -1023,9 +1023,9 @@ EXPORT_SYMBOL_GPL(kset_create_and_add);
  1921.  
  1922.  
  1923.  static DEFINE_SPINLOCK(kobj_ns_type_lock);
  1924. -static const struct kobj_ns_type_operations *kobj_ns_ops_tbl[KOBJ_NS_TYPES];
  1925. +static const struct kobj_ns_type_operations *kobj_ns_ops_tbl[KOBJ_NS_TYPES] __ro_after_init;
  1926.  
  1927. -int kobj_ns_type_register(const struct kobj_ns_type_operations *ops)
  1928. +int __init kobj_ns_type_register(const struct kobj_ns_type_operations *ops)
  1929.  {
  1930.     enum kobj_ns_type type = ops->type;
  1931.     int error;
  1932. diff --git a/lib/nlattr.c b/lib/nlattr.c
  1933. index 1d051ef66afe..4dd3c165d1da 100644
  1934. --- a/lib/nlattr.c
  1935. +++ b/lib/nlattr.c
  1936. @@ -790,6 +790,8 @@ int nla_memcpy(void *dest, const struct nlattr *src, int count)
  1937.  {
  1938.     int minlen = min_t(int, count, nla_len(src));
  1939.  
  1940. +   BUG_ON(minlen < 0);
  1941. +
  1942.     memcpy(dest, nla_data(src), minlen);
  1943.     if (count > minlen)
  1944.         memset(dest + minlen, 0, count - minlen);
  1945. diff --git a/lib/vsprintf.c b/lib/vsprintf.c
  1946. index 9d6722199390..717a62154f87 100644
  1947. --- a/lib/vsprintf.c
  1948. +++ b/lib/vsprintf.c
  1949. @@ -847,7 +847,7 @@ static char *ptr_to_id(char *buf, char *end, const void *ptr,
  1950.     return pointer_string(buf, end, (const void *)hashval, spec);
  1951.  }
  1952.  
  1953. -int kptr_restrict __read_mostly;
  1954. +int kptr_restrict __read_mostly = 2;
  1955.  
  1956.  static noinline_for_stack
  1957.  char *restricted_pointer(char *buf, char *end, const void *ptr,
  1958. diff --git a/mm/Kconfig b/mm/Kconfig
  1959. index 24c045b24b95..db91dbc2a65a 100644
  1960. --- a/mm/Kconfig
  1961. +++ b/mm/Kconfig
  1962. @@ -321,7 +321,8 @@ config KSM
  1963.  config DEFAULT_MMAP_MIN_ADDR
  1964.     int "Low address space to protect from user allocation"
  1965.     depends on MMU
  1966. -   default 4096
  1967. +   default 32768 if ARM || (ARM64 && COMPAT)
  1968. +   default 65536
  1969.     help
  1970.       This is the portion of low virtual memory which should be protected
  1971.       from userspace allocation.  Keeping a user from writing to low pages
  1972. diff --git a/mm/Kconfig.debug b/mm/Kconfig.debug
  1973. index 1e73717802f8..4a023b575370 100644
  1974. --- a/mm/Kconfig.debug
  1975. +++ b/mm/Kconfig.debug
  1976. @@ -106,6 +106,7 @@ config DEBUG_WX
  1977.     depends on ARCH_HAS_DEBUG_WX
  1978.     depends on MMU
  1979.     select PTDUMP_CORE
  1980. +   default y
  1981.     help
  1982.       Generate a warning if any W+X mappings are found at boot.
  1983.  
  1984. diff --git a/mm/kfence/report.c b/mm/kfence/report.c
  1985. index e3f71451ad9e..a5468a199a00 100644
  1986. --- a/mm/kfence/report.c
  1987. +++ b/mm/kfence/report.c
  1988. @@ -260,6 +260,10 @@ void kfence_report_error(unsigned long address, bool is_write, struct pt_regs *r
  1989.  
  1990.     lockdep_on();
  1991.  
  1992. +#ifdef CONFIG_BUG_ON_DATA_CORRUPTION
  1993. +   BUG();
  1994. +#endif
  1995. +
  1996.     if (panic_on_warn)
  1997.         panic("panic_on_warn set ...\n");
  1998.  
  1999. diff --git a/mm/mmap.c b/mm/mmap.c
  2000. index 3f287599a7a3..a2ef50c85c3e 100644
  2001. --- a/mm/mmap.c
  2002. +++ b/mm/mmap.c
  2003. @@ -230,6 +230,13 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
  2004.  
  2005.     newbrk = PAGE_ALIGN(brk);
  2006.     oldbrk = PAGE_ALIGN(mm->brk);
  2007. +   /* properly handle unaligned min_brk as an empty heap */
  2008. +   if (min_brk & ~PAGE_MASK) {
  2009. +       if (brk == min_brk)
  2010. +           newbrk -= PAGE_SIZE;
  2011. +       if (mm->brk == min_brk)
  2012. +           oldbrk -= PAGE_SIZE;
  2013. +   }
  2014.     if (oldbrk == newbrk) {
  2015.         mm->brk = brk;
  2016.         goto success;
  2017. diff --git a/mm/page_alloc.c b/mm/page_alloc.c
  2018. index 382af5377274..31bd45f8eae3 100644
  2019. --- a/mm/page_alloc.c
  2020. +++ b/mm/page_alloc.c
  2021. @@ -72,6 +72,7 @@
  2022.  #include <linux/padata.h>
  2023.  #include <linux/khugepaged.h>
  2024.  #include <linux/buffer_head.h>
  2025. +#include <linux/random.h>
  2026.  
  2027.  #include <asm/sections.h>
  2028.  #include <asm/tlbflush.h>
  2029. @@ -138,6 +139,15 @@ struct pcpu_drain {
  2030.  static DEFINE_MUTEX(pcpu_drain_mutex);
  2031.  static DEFINE_PER_CPU(struct pcpu_drain, pcpu_drain);
  2032.  
  2033. +bool __meminitdata extra_latent_entropy;
  2034. +
  2035. +static int __init setup_extra_latent_entropy(char *str)
  2036. +{
  2037. +   extra_latent_entropy = true;
  2038. +   return 0;
  2039. +}
  2040. +early_param("extra_latent_entropy", setup_extra_latent_entropy);
  2041. +
  2042.  #ifdef CONFIG_GCC_PLUGIN_LATENT_ENTROPY
  2043.  volatile unsigned long latent_entropy __latent_entropy;
  2044.  EXPORT_SYMBOL(latent_entropy);
  2045. @@ -1552,6 +1562,25 @@ static void __free_pages_ok(struct page *page, unsigned int order,
  2046.     local_irq_restore(flags);
  2047.  }
  2048.  
  2049. +static void __init __gather_extra_latent_entropy(struct page *page,
  2050. +                        unsigned int nr_pages)
  2051. +{
  2052. +   if (extra_latent_entropy && !PageHighMem(page) && page_to_pfn(page) < 0x100000) {
  2053. +       unsigned long hash = 0;
  2054. +       size_t index, end = PAGE_SIZE * nr_pages / sizeof hash;
  2055. +       const unsigned long *data = lowmem_page_address(page);
  2056. +
  2057. +       for (index = 0; index < end; index++)
  2058. +           hash ^= hash + data[index];
  2059. +#ifdef CONFIG_GCC_PLUGIN_LATENT_ENTROPY
  2060. +       latent_entropy ^= hash;
  2061. +       add_device_randomness((const void *)&latent_entropy, sizeof(latent_entropy));
  2062. +#else
  2063. +       add_device_randomness((const void *)&hash, sizeof(hash));
  2064. +#endif
  2065. +   }
  2066. +}
  2067. +
  2068.  void __free_pages_core(struct page *page, unsigned int order)
  2069.  {
  2070.     unsigned int nr_pages = 1 << order;
  2071. @@ -1571,7 +1600,6 @@ void __free_pages_core(struct page *page, unsigned int order)
  2072.     }
  2073.     __ClearPageReserved(p);
  2074.     set_page_count(p, 0);
  2075. -
  2076.     atomic_long_add(nr_pages, &page_zone(page)->managed_pages);
  2077.  
  2078.     /*
  2079. @@ -1638,6 +1666,7 @@ void __init memblock_free_pages(struct page *page, unsigned long pfn,
  2080.  {
  2081.     if (early_page_uninitialised(pfn))
  2082.         return;
  2083. +   __gather_extra_latent_entropy(page, 1 << order);
  2084.     __free_pages_core(page, order);
  2085.  }
  2086.  
  2087. @@ -1729,6 +1758,7 @@ static void __init deferred_free_range(unsigned long pfn,
  2088.     if (nr_pages == pageblock_nr_pages &&
  2089.         (pfn & (pageblock_nr_pages - 1)) == 0) {
  2090.         set_pageblock_migratetype(page, MIGRATE_MOVABLE);
  2091. +       __gather_extra_latent_entropy(page, 1 << pageblock_order);
  2092.         __free_pages_core(page, pageblock_order);
  2093.         return;
  2094.     }
  2095. @@ -1736,6 +1766,7 @@ static void __init deferred_free_range(unsigned long pfn,
  2096.     for (i = 0; i < nr_pages; i++, page++, pfn++) {
  2097.         if ((pfn & (pageblock_nr_pages - 1)) == 0)
  2098.             set_pageblock_migratetype(page, MIGRATE_MOVABLE);
  2099. +       __gather_extra_latent_entropy(page, 1);
  2100.         __free_pages_core(page, 0);
  2101.     }
  2102.  }
  2103. @@ -2305,6 +2336,12 @@ inline void post_alloc_hook(struct page *page, unsigned int order,
  2104.     kernel_unpoison_pages(page, 1 << order);
  2105.     set_page_owner(page, order, gfp_flags);
  2106.  
  2107. +   if (IS_ENABLED(CONFIG_PAGE_SANITIZE_VERIFY) && want_init_on_free()) {
  2108. +       int i;
  2109. +       for (i = 0; i < (1 << order); i++)
  2110. +           verify_zero_highpage(page + i);
  2111. +   }
  2112. +
  2113.     if (!want_init_on_free() && want_init_on_alloc(gfp_flags))
  2114.         kernel_init_free_pages(page, 1 << order);
  2115.  }
  2116. diff --git a/mm/slab.h b/mm/slab.h
  2117. index 440133f93a53..271fc26d0253 100644
  2118. --- a/mm/slab.h
  2119. +++ b/mm/slab.h
  2120. @@ -414,9 +414,13 @@ static inline struct kmem_cache *virt_to_cache(const void *obj)
  2121.     struct page *page;
  2122.  
  2123.     page = virt_to_head_page(obj);
  2124. +#ifdef CONFIG_BUG_ON_DATA_CORRUPTION
  2125. +   BUG_ON(!PageSlab(page));
  2126. +#else
  2127.     if (WARN_ONCE(!PageSlab(page), "%s: Object is not a Slab page!\n",
  2128.                     __func__))
  2129.         return NULL;
  2130. +#endif
  2131.     return page->slab_cache;
  2132.  }
  2133.  
  2134. @@ -450,10 +454,15 @@ static inline struct kmem_cache *cache_from_obj(struct kmem_cache *s, void *x)
  2135.         return s;
  2136.  
  2137.     cachep = virt_to_cache(x);
  2138. -   if (WARN(cachep && cachep != s,
  2139. -         "%s: Wrong slab cache. %s but object is from %s\n",
  2140. -         __func__, s->name, cachep->name))
  2141. +   if (cachep && cachep != s) {
  2142. +#ifdef CONFIG_BUG_ON_DATA_CORRUPTION
  2143. +       BUG();
  2144. +#else
  2145. +       WARN(1, "%s: Wrong slab cache. %s but object is from %s\n",
  2146. +           __func__, s->name, cachep->name);
  2147. +#endif
  2148.         print_tracking(cachep, x);
  2149. +   }
  2150.     return cachep;
  2151.  }
  2152.  
  2153. @@ -478,7 +487,7 @@ static inline size_t slab_ksize(const struct kmem_cache *s)
  2154.      * back there or track user information then we can
  2155.      * only use the space before that information.
  2156.      */
  2157. -   if (s->flags & (SLAB_TYPESAFE_BY_RCU | SLAB_STORE_USER))
  2158. +   if ((s->flags & (SLAB_TYPESAFE_BY_RCU | SLAB_STORE_USER)) || IS_ENABLED(CONFIG_SLAB_CANARY))
  2159.         return s->inuse;
  2160.     /*
  2161.      * Else we can use all the padding etc for the allocation
  2162. @@ -601,8 +610,10 @@ static inline void cache_random_seq_destroy(struct kmem_cache *cachep) { }
  2163.  static inline bool slab_want_init_on_alloc(gfp_t flags, struct kmem_cache *c)
  2164.  {
  2165.     if (static_branch_unlikely(&init_on_alloc)) {
  2166. +#ifndef CONFIG_SLUB
  2167.         if (c->ctor)
  2168.             return false;
  2169. +#endif
  2170.         if (c->flags & (SLAB_TYPESAFE_BY_RCU | SLAB_POISON))
  2171.             return flags & __GFP_ZERO;
  2172.         return true;
  2173. @@ -612,9 +623,15 @@ static inline bool slab_want_init_on_alloc(gfp_t flags, struct kmem_cache *c)
  2174.  
  2175.  static inline bool slab_want_init_on_free(struct kmem_cache *c)
  2176.  {
  2177. -   if (static_branch_unlikely(&init_on_free))
  2178. -       return !(c->ctor ||
  2179. -            (c->flags & (SLAB_TYPESAFE_BY_RCU | SLAB_POISON)));
  2180. +   if (static_branch_unlikely(&init_on_free)) {
  2181. +#ifndef CONFIG_SLUB
  2182. +       if (c->ctor)
  2183. +           return false;
  2184. +#endif
  2185. +       if (c->flags & (SLAB_TYPESAFE_BY_RCU | SLAB_POISON))
  2186. +           return false;
  2187. +       return true;
  2188. +   }
  2189.     return false;
  2190.  }
  2191.  
  2192. diff --git a/mm/slab_common.c b/mm/slab_common.c
  2193. index ba2f4b01920f..8943c57ccb27 100644
  2194. --- a/mm/slab_common.c
  2195. +++ b/mm/slab_common.c
  2196. @@ -32,10 +32,10 @@
  2197.  
  2198.  #include "slab.h"
  2199.  
  2200. -enum slab_state slab_state;
  2201. +enum slab_state slab_state __ro_after_init;
  2202.  LIST_HEAD(slab_caches);
  2203.  DEFINE_MUTEX(slab_mutex);
  2204. -struct kmem_cache *kmem_cache;
  2205. +struct kmem_cache *kmem_cache __ro_after_init;
  2206.  
  2207.  #ifdef CONFIG_HARDENED_USERCOPY
  2208.  bool usercopy_fallback __ro_after_init =
  2209. @@ -63,7 +63,7 @@ static DECLARE_WORK(slab_caches_to_rcu_destroy_work,
  2210.  /*
  2211.   * Merge control. If this is set then no merging of slab caches will occur.
  2212.   */
  2213. -static bool slab_nomerge = !IS_ENABLED(CONFIG_SLAB_MERGE_DEFAULT);
  2214. +static bool slab_nomerge __ro_after_init = !IS_ENABLED(CONFIG_SLAB_MERGE_DEFAULT);
  2215.  
  2216.  static int __init setup_slab_nomerge(char *str)
  2217.  {
  2218. diff --git a/mm/slub.c b/mm/slub.c
  2219. index 602f9712ab53..8b4b142cfce2 100644
  2220. --- a/mm/slub.c
  2221. +++ b/mm/slub.c
  2222. @@ -129,6 +129,12 @@ static inline bool kmem_cache_debug(struct kmem_cache *s)
  2223.     return kmem_cache_debug_flags(s, SLAB_DEBUG_FLAGS);
  2224.  }
  2225.  
  2226. +static inline bool has_sanitize_verify(struct kmem_cache *s)
  2227. +{
  2228. +   return IS_ENABLED(CONFIG_SLAB_SANITIZE_VERIFY) &&
  2229. +          slab_want_init_on_free(s);
  2230. +}
  2231. +
  2232.  void *fixup_red_left(struct kmem_cache *s, void *p)
  2233.  {
  2234.     if (kmem_cache_debug_flags(s, SLAB_RED_ZONE))
  2235. @@ -444,6 +450,55 @@ static inline bool cmpxchg_double_slab(struct kmem_cache *s, struct page *page,
  2236.     return false;
  2237.  }
  2238.  
  2239. +#if defined(CONFIG_SLUB_DEBUG) || defined(CONFIG_SLAB_CANARY)
  2240. +/*
  2241. + * See comment in calculate_sizes().
  2242. + */
  2243. +static inline bool freeptr_outside_object(struct kmem_cache *s)
  2244. +{
  2245. +   return s->offset >= s->inuse;
  2246. +}
  2247. +
  2248. +/*
  2249. + * Return offset of the end of info block which is inuse + free pointer if
  2250. + * not overlapping with object.
  2251. + */
  2252. +static inline unsigned int get_info_end(struct kmem_cache *s)
  2253. +{
  2254. +   if (freeptr_outside_object(s))
  2255. +       return s->inuse + sizeof(void *);
  2256. +   else
  2257. +       return s->inuse;
  2258. +}
  2259. +#endif
  2260. +
  2261. +#ifdef CONFIG_SLAB_CANARY
  2262. +static inline unsigned long *get_canary(struct kmem_cache *s, void *object)
  2263. +{
  2264. +   return object + get_info_end(s);
  2265. +}
  2266. +
  2267. +static inline unsigned long get_canary_value(const void *canary, unsigned long value)
  2268. +{
  2269. +   return (value ^ (unsigned long)canary) & CANARY_MASK;
  2270. +}
  2271. +
  2272. +static inline void set_canary(struct kmem_cache *s, void *object, unsigned long value)
  2273. +{
  2274. +   unsigned long *canary = get_canary(s, object);
  2275. +   *canary = get_canary_value(canary, value);
  2276. +}
  2277. +
  2278. +static inline void check_canary(struct kmem_cache *s, void *object, unsigned long value)
  2279. +{
  2280. +   unsigned long *canary = get_canary(s, object);
  2281. +   BUG_ON(*canary != get_canary_value(canary, value));
  2282. +}
  2283. +#else
  2284. +#define set_canary(s, object, value)
  2285. +#define check_canary(s, object, value)
  2286. +#endif
  2287. +
  2288.  #ifdef CONFIG_SLUB_DEBUG
  2289.  static unsigned long object_map[BITS_TO_LONGS(MAX_OBJS_PER_PAGE)];
  2290.  static DEFINE_SPINLOCK(object_map_lock);
  2291. @@ -555,26 +610,6 @@ static void print_section(char *level, char *text, u8 *addr,
  2292.     metadata_access_disable();
  2293.  }
  2294.  
  2295. -/*
  2296. - * See comment in calculate_sizes().
  2297. - */
  2298. -static inline bool freeptr_outside_object(struct kmem_cache *s)
  2299. -{
  2300. -   return s->offset >= s->inuse;
  2301. -}
  2302. -
  2303. -/*
  2304. - * Return offset of the end of info block which is inuse + free pointer if
  2305. - * not overlapping with object.
  2306. - */
  2307. -static inline unsigned int get_info_end(struct kmem_cache *s)
  2308. -{
  2309. -   if (freeptr_outside_object(s))
  2310. -       return s->inuse + sizeof(void *);
  2311. -   else
  2312. -       return s->inuse;
  2313. -}
  2314. -
  2315.  static struct track *get_track(struct kmem_cache *s, void *object,
  2316.     enum track_item alloc)
  2317.  {
  2318. @@ -582,6 +617,9 @@ static struct track *get_track(struct kmem_cache *s, void *object,
  2319.  
  2320.     p = object + get_info_end(s);
  2321.  
  2322. +   if (IS_ENABLED(CONFIG_SLAB_CANARY))
  2323. +       p = (void *)p + sizeof(void *);
  2324. +
  2325.     return kasan_reset_tag(p + alloc);
  2326.  }
  2327.  
  2328. @@ -724,6 +762,9 @@ static void print_trailer(struct kmem_cache *s, struct page *page, u8 *p)
  2329.  
  2330.     off = get_info_end(s);
  2331.  
  2332. +   if (IS_ENABLED(CONFIG_SLAB_CANARY))
  2333. +       off += sizeof(void *);
  2334. +
  2335.     if (s->flags & SLAB_STORE_USER)
  2336.         off += 2 * sizeof(struct track);
  2337.  
  2338. @@ -832,8 +873,9 @@ static int check_bytes_and_report(struct kmem_cache *s, struct page *page,
  2339.   *     Meta data starts here.
  2340.   *
  2341.   *     A. Free pointer (if we cannot overwrite object on free)
  2342. - *     B. Tracking data for SLAB_STORE_USER
  2343. - *     C. Padding to reach required alignment boundary or at mininum
  2344. + *     B. Canary for SLAB_CANARY
  2345. + *     C. Tracking data for SLAB_STORE_USER
  2346. + *     D. Padding to reach required alignment boundary or at mininum
  2347.   *         one word if debugging is on to be able to detect writes
  2348.   *         before the word boundary.
  2349.   *
  2350. @@ -851,6 +893,9 @@ static int check_pad_bytes(struct kmem_cache *s, struct page *page, u8 *p)
  2351.  {
  2352.     unsigned long off = get_info_end(s);    /* The end of info */
  2353.  
  2354. +   if (IS_ENABLED(CONFIG_SLAB_CANARY))
  2355. +       off += sizeof(void *);
  2356. +
  2357.     if (s->flags & SLAB_STORE_USER)
  2358.         /* We also have user information there */
  2359.         off += 2 * sizeof(struct track);
  2360. @@ -1585,6 +1630,8 @@ static inline bool slab_free_freelist_hook(struct kmem_cache *s,
  2361.         object = next;
  2362.         next = get_freepointer(s, object);
  2363.  
  2364. +       check_canary(s, object, s->random_active);
  2365. +
  2366.         if (slab_want_init_on_free(s)) {
  2367.             /*
  2368.              * Clear the object and the metadata, but don't touch
  2369. @@ -1595,8 +1642,12 @@ static inline bool slab_free_freelist_hook(struct kmem_cache *s,
  2370.                                : 0;
  2371.             memset((char *)kasan_reset_tag(object) + s->inuse, 0,
  2372.                    s->size - s->inuse - rsize);
  2373. -
  2374. +           if (!IS_ENABLED(CONFIG_SLAB_SANITIZE_VERIFY) && s->ctor)
  2375. +               s->ctor(object);
  2376.         }
  2377. +
  2378. +       set_canary(s, object, s->random_inactive);
  2379. +
  2380.         /* If object's reuse doesn't have to be delayed */
  2381.         if (!slab_free_hook(s, object)) {
  2382.             /* Move object to the new freelist */
  2383. @@ -1604,6 +1655,18 @@ static inline bool slab_free_freelist_hook(struct kmem_cache *s,
  2384.             *head = object;
  2385.             if (!*tail)
  2386.                 *tail = object;
  2387. +       } else if (slab_want_init_on_free(s) && s->ctor) {
  2388. +           /* Objects that are put into quarantine by KASAN will
  2389. +            * still undergo free_consistency_checks() and thus
  2390. +            * need to show a valid freepointer to check_object().
  2391. +            *
  2392. +            * Note that doing this for all caches (not just ctor
  2393. +            * ones, which have s->offset >= object_size)) causes a
  2394. +            * GPF, due to KASAN poisoning and the way
  2395. +            * set_freepointer() eventually dereferences the
  2396. +            * freepointer.
  2397. +            */
  2398. +           set_freepointer(s, object, NULL);
  2399.         }
  2400.     } while (object != old_tail);
  2401.  
  2402. @@ -1617,8 +1680,10 @@ static void *setup_object(struct kmem_cache *s, struct page *page,
  2403.                 void *object)
  2404.  {
  2405.     setup_object_debug(s, page, object);
  2406. +   if (!is_kfence_address(object))
  2407. +       set_canary(s, object, s->random_inactive);
  2408.     object = kasan_init_slab_obj(s, object);
  2409. -   if (unlikely(s->ctor)) {
  2410. +   if (unlikely(s->ctor) && !has_sanitize_verify(s)) {
  2411.         kasan_unpoison_object_data(s, object);
  2412.         s->ctor(object);
  2413.         kasan_poison_object_data(s, object);
  2414. @@ -2901,10 +2966,30 @@ static __always_inline void *slab_alloc_node(struct kmem_cache *s,
  2415.  
  2416.     maybe_wipe_obj_freeptr(s, object);
  2417.  
  2418. -   if (unlikely(slab_want_init_on_alloc(gfpflags, s)) && object)
  2419. +   if (has_sanitize_verify(s) && object) {
  2420. +       /* KASAN hasn't unpoisoned the object yet (this is done in the
  2421. +        * post-alloc hook), so let's do it temporarily.
  2422. +        */
  2423. +       kasan_unpoison_object_data(s, object);
  2424. +       BUG_ON(memchr_inv(object, 0, s->object_size));
  2425. +       if (s->ctor)
  2426. +           s->ctor(object);
  2427. +       kasan_poison_object_data(s, object);
  2428. +   } else if (unlikely(slab_want_init_on_alloc(gfpflags, s)) && object) {
  2429.         memset(kasan_reset_tag(object), 0, s->object_size);
  2430. +       if (s->ctor) {
  2431. +           kasan_unpoison_object_data(s, object);
  2432. +           s->ctor(object);
  2433. +           kasan_poison_object_data(s, object);
  2434. +       }
  2435. +   }
  2436.  
  2437.  out:
  2438. +   if (object && !is_kfence_address(object)) {
  2439. +       check_canary(s, object, s->random_inactive);
  2440. +       set_canary(s, object, s->random_active);
  2441. +   }
  2442. +
  2443.     slab_post_alloc_hook(s, objcg, gfpflags, 1, &object);
  2444.  
  2445.     return object;
  2446. @@ -3302,7 +3387,7 @@ int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
  2447.               void **p)
  2448.  {
  2449.     struct kmem_cache_cpu *c;
  2450. -   int i;
  2451. +   int i, k;
  2452.     struct obj_cgroup *objcg = NULL;
  2453.  
  2454.     /* memcg and kmem_cache debug support */
  2455. @@ -3358,11 +3443,37 @@ int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
  2456.     local_irq_enable();
  2457.  
  2458.     /* Clear memory outside IRQ disabled fastpath loop */
  2459. -   if (unlikely(slab_want_init_on_alloc(flags, s))) {
  2460. +   if (has_sanitize_verify(s)) {
  2461.         int j;
  2462.  
  2463. -       for (j = 0; j < i; j++)
  2464. +       for (j = 0; j < i; j++) {
  2465. +           /* KASAN hasn't unpoisoned the object yet (this is done
  2466. +            * in the post-alloc hook), so let's do it temporarily.
  2467. +            */
  2468. +           kasan_unpoison_object_data(s, p[j]);
  2469. +           BUG_ON(memchr_inv(p[j], 0, s->object_size));
  2470. +           if (s->ctor)
  2471. +               s->ctor(p[j]);
  2472. +           kasan_poison_object_data(s, p[j]);
  2473. +       }
  2474. +   } else if (unlikely(slab_want_init_on_alloc(flags, s))) {
  2475. +       int j;
  2476. +
  2477. +       for (j = 0; j < i; j++) {
  2478.             memset(kasan_reset_tag(p[j]), 0, s->object_size);
  2479. +           if (s->ctor) {
  2480. +               kasan_unpoison_object_data(s, p[j]);
  2481. +               s->ctor(p[j]);
  2482. +               kasan_poison_object_data(s, p[j]);
  2483. +           }
  2484. +       }
  2485. +   }
  2486. +
  2487. +   for (k = 0; k < i; k++) {
  2488. +       if (!is_kfence_address(p[k])) {
  2489. +           check_canary(s, p[k], s->random_inactive);
  2490. +           set_canary(s, p[k], s->random_active);
  2491. +       }
  2492.     }
  2493.  
  2494.     /* memcg and kmem_cache debug support */
  2495. @@ -3580,6 +3691,8 @@ static void early_kmem_cache_node_alloc(int node)
  2496.     init_object(kmem_cache_node, n, SLUB_RED_ACTIVE);
  2497.     init_tracking(kmem_cache_node, n);
  2498.  #endif
  2499. +   if (!is_kfence_address(n))
  2500. +       set_canary(kmem_cache_node, n, kmem_cache_node->random_active);
  2501.     n = kasan_slab_alloc(kmem_cache_node, n, GFP_KERNEL);
  2502.     page->freelist = get_freepointer(kmem_cache_node, n);
  2503.     page->inuse = 1;
  2504. @@ -3753,6 +3866,9 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)
  2505.         s->offset = ALIGN_DOWN(s->object_size / 2, sizeof(void *));
  2506.     }
  2507.  
  2508. +   if (IS_ENABLED(CONFIG_SLAB_CANARY))
  2509. +       size += sizeof(void *);
  2510. +
  2511.  #ifdef CONFIG_SLUB_DEBUG
  2512.     if (flags & SLAB_STORE_USER)
  2513.         /*
  2514. @@ -3826,6 +3942,10 @@ static int kmem_cache_open(struct kmem_cache *s, slab_flags_t flags)
  2515.  #ifdef CONFIG_SLAB_FREELIST_HARDENED
  2516.     s->random = get_random_long();
  2517.  #endif
  2518. +#ifdef CONFIG_SLAB_CANARY
  2519. +   s->random_active = get_random_long();
  2520. +   s->random_inactive = get_random_long();
  2521. +#endif
  2522.  
  2523.     if (!calculate_sizes(s, -1))
  2524.         goto error;
  2525. @@ -4143,6 +4263,9 @@ void __check_heap_object(const void *ptr, unsigned long n, struct page *page,
  2526.         offset -= s->red_left_pad;
  2527.     }
  2528.  
  2529. +   if (!is_kfence)
  2530. +       check_canary(s, (void *)ptr - offset, s->random_active);
  2531. +
  2532.     /* Allow address range falling entirely within usercopy region. */
  2533.     if (offset >= s->useroffset &&
  2534.         offset - s->useroffset <= s->usersize &&
  2535. @@ -4176,7 +4299,11 @@ size_t __ksize(const void *object)
  2536.     page = virt_to_head_page(object);
  2537.  
  2538.     if (unlikely(!PageSlab(page))) {
  2539. +#ifdef CONFIG_BUG_ON_DATA_CORRUPTION
  2540. +       BUG_ON(!PageCompound(page));
  2541. +#else
  2542.         WARN_ON(!PageCompound(page));
  2543. +#endif
  2544.         return page_size(page);
  2545.     }
  2546.  
  2547. diff --git a/mm/swap.c b/mm/swap.c
  2548. index 31b844d4ed94..e1f9ee51f6e1 100644
  2549. --- a/mm/swap.c
  2550. +++ b/mm/swap.c
  2551. @@ -99,6 +99,8 @@ static void __put_single_page(struct page *page)
  2552.  
  2553.  static void __put_compound_page(struct page *page)
  2554.  {
  2555. +   compound_page_dtor *dtor;
  2556. +
  2557.     /*
  2558.      * __page_cache_release() is supposed to be called for thp, not for
  2559.      * hugetlb. This is because hugetlb page does never have PageLRU set
  2560. @@ -107,7 +109,15 @@ static void __put_compound_page(struct page *page)
  2561.      */
  2562.     if (!PageHuge(page))
  2563.         __page_cache_release(page);
  2564. -   destroy_compound_page(page);
  2565. +   dtor = get_compound_page_dtor(page);
  2566. +   if (!PageHuge(page))
  2567. +       BUG_ON(dtor != free_compound_page
  2568. +#ifdef CONFIG_TRANSPARENT_HUGEPAGE
  2569. +           && dtor != free_transhuge_page
  2570. +#endif
  2571. +       );
  2572. +
  2573. +   (*dtor)(page);
  2574.  }
  2575.  
  2576.  void __put_page(struct page *page)
  2577. diff --git a/mm/util.c b/mm/util.c
  2578. index 54870226cea6..46ce65234d84 100644
  2579. --- a/mm/util.c
  2580. +++ b/mm/util.c
  2581. @@ -348,9 +348,9 @@ unsigned long arch_randomize_brk(struct mm_struct *mm)
  2582.  {
  2583.     /* Is the current task 32bit ? */
  2584.     if (!IS_ENABLED(CONFIG_64BIT) || is_compat_task())
  2585. -       return randomize_page(mm->brk, SZ_32M);
  2586. +       return mm->brk + get_random_long() % SZ_32M + PAGE_SIZE;
  2587.  
  2588. -   return randomize_page(mm->brk, SZ_1G);
  2589. +   return mm->brk + get_random_long() % SZ_1G + PAGE_SIZE;
  2590.  }
  2591.  
  2592.  unsigned long arch_mmap_rnd(void)
  2593. diff --git a/net/core/dev.c b/net/core/dev.c
  2594. index a8c89cad1ca4..e0021f950824 100644
  2595. --- a/net/core/dev.c
  2596. +++ b/net/core/dev.c
  2597. @@ -4936,7 +4936,7 @@ int netif_rx_any_context(struct sk_buff *skb)
  2598.  }
  2599.  EXPORT_SYMBOL(netif_rx_any_context);
  2600.  
  2601. -static __latent_entropy void net_tx_action(struct softirq_action *h)
  2602. +static __latent_entropy void net_tx_action(void)
  2603.  {
  2604.     struct softnet_data *sd = this_cpu_ptr(&softnet_data);
  2605.  
  2606. @@ -7071,7 +7071,7 @@ static int napi_threaded_poll(void *data)
  2607.     return 0;
  2608.  }
  2609.  
  2610. -static __latent_entropy void net_rx_action(struct softirq_action *h)
  2611. +static __latent_entropy void net_rx_action(void)
  2612.  {
  2613.     struct softnet_data *sd = this_cpu_ptr(&softnet_data);
  2614.     unsigned long time_limit = jiffies +
  2615. diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
  2616. index 87983e70f03f..d1584b4b39f9 100644
  2617. --- a/net/ipv4/Kconfig
  2618. +++ b/net/ipv4/Kconfig
  2619. @@ -267,6 +267,7 @@ config IP_PIMSM_V2
  2620.  
  2621.  config SYN_COOKIES
  2622.     bool "IP: TCP syncookie support"
  2623. +   default y
  2624.     help
  2625.       Normal TCP/IP networking is open to an attack known as "SYN
  2626.       flooding". This denial-of-service attack prevents legitimate remote
  2627. @@ -742,3 +743,26 @@ config TCP_MD5SIG
  2628.       on the Internet.
  2629.  
  2630.       If unsure, say N.
  2631. +
  2632. +config TCP_SIMULT_CONNECT_DEFAULT_ON
  2633. +   bool "Enable TCP simultaneous connect"
  2634. +   help
  2635. +     Enable TCP simultaneous connect that adds a weakness in Linux's strict
  2636. +     implementation of TCP that allows two clients to connect to each other
  2637. +     without either entering a listening state. The weakness allows an
  2638. +     attacker to easily prevent a client from connecting to a known server
  2639. +     provided the source port for the connection is guessed correctly.
  2640. +
  2641. +     As the weakness could be used to prevent an antivirus or IPS from
  2642. +     fetching updates, or prevent an SSL gateway from fetching a CRL, it
  2643. +     should be eliminated by disabling this option. Though Linux is one of
  2644. +     few operating systems supporting simultaneous connect, it has no
  2645. +     legitimate use in practice and is rarely supported by firewalls.
  2646. +
  2647. +     Disabling this may break TCP STUNT which is used by some applications
  2648. +     for NAT traversal.
  2649. +
  2650. +     This setting can be overridden at runtime via the
  2651. +     net.ipv4.tcp_simult_connect sysctl.
  2652. +
  2653. +     If unsure, say N.
  2654. diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
  2655. index 60465f077497..253eb350bd86 100644
  2656. --- a/net/ipv4/sysctl_net_ipv4.c
  2657. +++ b/net/ipv4/sysctl_net_ipv4.c
  2658. @@ -588,6 +588,15 @@ static struct ctl_table ipv4_table[] = {
  2659.         .mode       = 0644,
  2660.         .proc_handler   = proc_do_static_key,
  2661.     },
  2662. +   {
  2663. +       .procname   = "tcp_simult_connect",
  2664. +       .data       = &sysctl_tcp_simult_connect,
  2665. +       .maxlen     = sizeof(int),
  2666. +       .mode       = 0644,
  2667. +       .proc_handler   = proc_dointvec_minmax,
  2668. +       .extra1     = SYSCTL_ZERO,
  2669. +       .extra2     = SYSCTL_ONE,
  2670. +   },
  2671.     { }
  2672.  };
  2673.  
  2674. diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
  2675. index e567fff1d1a6..5b1c8cea9ec4 100644
  2676. --- a/net/ipv4/tcp_input.c
  2677. +++ b/net/ipv4/tcp_input.c
  2678. @@ -82,6 +82,7 @@
  2679.  #include <net/mptcp.h>
  2680.  
  2681.  int sysctl_tcp_max_orphans __read_mostly = NR_FILE;
  2682. +int sysctl_tcp_simult_connect __read_mostly = IS_ENABLED(CONFIG_TCP_SIMULT_CONNECT_DEFAULT_ON);
  2683.  
  2684.  #define FLAG_DATA      0x01 /* Incoming frame contained data.      */
  2685.  #define FLAG_WIN_UPDATE        0x02 /* Incoming ACK was a window update.   */
  2686. @@ -6214,7 +6215,7 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
  2687.         tcp_paws_reject(&tp->rx_opt, 0))
  2688.         goto discard_and_undo;
  2689.  
  2690. -   if (th->syn) {
  2691. +   if (th->syn && sysctl_tcp_simult_connect) {
  2692.         /* We see SYN without ACK. It is attempt of
  2693.          * simultaneous connect with crossed SYNs.
  2694.          * Particularly, it can be connect to self.
  2695. diff --git a/scripts/Makefile.modpost b/scripts/Makefile.modpost
  2696. index 4ca5579af4e4..32873f0cb4f5 100644
  2697. --- a/scripts/Makefile.modpost
  2698. +++ b/scripts/Makefile.modpost
  2699. @@ -50,6 +50,7 @@ MODPOST = scripts/mod/modpost                             \
  2700.     $(if $(CONFIG_MODVERSIONS),-m)                          \
  2701.     $(if $(CONFIG_MODULE_SRCVERSION_ALL),-a)                    \
  2702.     $(if $(CONFIG_SECTION_MISMATCH_WARN_ONLY),,-E)                  \
  2703. +   $(if $(CONFIG_DEBUG_WRITABLE_FUNCTION_POINTERS_VERBOSE),-f)         \
  2704.     $(if $(KBUILD_MODPOST_WARN),-w) \
  2705.     -o $@
  2706.  
  2707. diff --git a/scripts/gcc-plugins/Kconfig b/scripts/gcc-plugins/Kconfig
  2708. index ab9eb4cbe33a..2870588ef733 100644
  2709. --- a/scripts/gcc-plugins/Kconfig
  2710. +++ b/scripts/gcc-plugins/Kconfig
  2711. @@ -53,6 +53,11 @@ config GCC_PLUGIN_LATENT_ENTROPY
  2712.       is some slowdown of the boot process (about 0.5%) and fork and
  2713.       irq processing.
  2714.  
  2715. +     When extra_latent_entropy is passed on the kernel command line,
  2716. +     entropy will be extracted from up to the first 4GB of RAM while the
  2717. +     runtime memory allocator is being initialized.  This costs even more
  2718. +     slowdown of the boot process.
  2719. +
  2720.       Note that entropy extracted this way is not cryptographically
  2721.       secure!
  2722.  
  2723. diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
  2724. index 10c3fba26f03..164d7ad688b6 100644
  2725. --- a/scripts/mod/modpost.c
  2726. +++ b/scripts/mod/modpost.c
  2727. @@ -34,6 +34,8 @@ static int warn_unresolved = 0;
  2728.  /* How a symbol is exported */
  2729.  static int sec_mismatch_count = 0;
  2730.  static int sec_mismatch_warn_only = true;
  2731. +static int writable_fptr_count = 0;
  2732. +static int writable_fptr_verbose = 0;
  2733.  /* ignore missing files */
  2734.  static int ignore_missing_files;
  2735.  /* If set to 1, only warn (instead of error) about missing ns imports */
  2736. @@ -982,6 +984,7 @@ enum mismatch {
  2737.     ANY_EXIT_TO_ANY_INIT,
  2738.     EXPORT_TO_INIT_EXIT,
  2739.     EXTABLE_TO_NON_TEXT,
  2740. +   DATA_TO_TEXT
  2741.  };
  2742.  
  2743.  /**
  2744. @@ -1108,6 +1111,12 @@ static const struct sectioncheck sectioncheck[] = {
  2745.     .good_tosec = {ALL_TEXT_SECTIONS , NULL},
  2746.     .mismatch = EXTABLE_TO_NON_TEXT,
  2747.     .handler = extable_mismatch_handler,
  2748. +},
  2749. +/* Do not reference code from writable data */
  2750. +{
  2751. +   .fromsec = { DATA_SECTIONS, NULL },
  2752. +   .bad_tosec = { ALL_TEXT_SECTIONS, NULL },
  2753. +   .mismatch = DATA_TO_TEXT
  2754.  }
  2755.  };
  2756.  
  2757. @@ -1295,10 +1304,10 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr,
  2758.             continue;
  2759.         if (!is_valid_name(elf, sym))
  2760.             continue;
  2761. -       if (sym->st_value == addr)
  2762. -           return sym;
  2763.         /* Find a symbol nearby - addr are maybe negative */
  2764.         d = sym->st_value - addr;
  2765. +       if (d == 0)
  2766. +           return sym;
  2767.         if (d < 0)
  2768.             d = addr - sym->st_value;
  2769.         if (d < distance) {
  2770. @@ -1433,7 +1442,13 @@ static void report_sec_mismatch(const char *modname,
  2771.     char *prl_from;
  2772.     char *prl_to;
  2773.  
  2774. -   sec_mismatch_count++;
  2775. +   if (mismatch->mismatch == DATA_TO_TEXT) {
  2776. +       writable_fptr_count++;
  2777. +       if (!writable_fptr_verbose)
  2778. +           return;
  2779. +   } else {
  2780. +       sec_mismatch_count++;
  2781. +   }
  2782.  
  2783.     get_pretty_name(from_is_func, &from, &from_p);
  2784.     get_pretty_name(to_is_func, &to, &to_p);
  2785. @@ -1555,6 +1570,12 @@ static void report_sec_mismatch(const char *modname,
  2786.         fatal("There's a special handler for this mismatch type, "
  2787.               "we should never get here.");
  2788.         break;
  2789. +   case DATA_TO_TEXT:
  2790. +       fprintf(stderr,
  2791. +       "The %s %s:%s references\n"
  2792. +       "the %s %s:%s%s\n",
  2793. +       from, fromsec, fromsym, to, tosec, tosym, to_p);
  2794. +       break;
  2795.     }
  2796.     fprintf(stderr, "\n");
  2797.  }
  2798. @@ -2487,7 +2508,7 @@ int main(int argc, char **argv)
  2799.     struct dump_list *dump_read_start = NULL;
  2800.     struct dump_list **dump_read_iter = &dump_read_start;
  2801.  
  2802. -   while ((opt = getopt(argc, argv, "ei:mnT:o:awENd:")) != -1) {
  2803. +   while ((opt = getopt(argc, argv, "ei:fmnT:o:awENd:")) != -1) {
  2804.         switch (opt) {
  2805.         case 'e':
  2806.             external_module = 1;
  2807. @@ -2498,6 +2519,9 @@ int main(int argc, char **argv)
  2808.             (*dump_read_iter)->file = optarg;
  2809.             dump_read_iter = &(*dump_read_iter)->next;
  2810.             break;
  2811. +       case 'f':
  2812. +           writable_fptr_verbose = 1;
  2813. +           break;
  2814.         case 'm':
  2815.             modversions = 1;
  2816.             break;
  2817. @@ -2596,6 +2620,11 @@ int main(int argc, char **argv)
  2818.     }
  2819.  
  2820.     free(buf.p);
  2821. +   if (writable_fptr_count && !writable_fptr_verbose)
  2822. +       warn("modpost: Found %d writable function pointer%s.\n"
  2823. +            "To see full details build your kernel with:\n"
  2824. +            "'make CONFIG_DEBUG_WRITABLE_FUNCTION_POINTERS_VERBOSE=y'\n",
  2825. +            writable_fptr_count, (writable_fptr_count == 1 ? "" : "s"));
  2826.  
  2827.     return error_occurred ? 1 : 0;
  2828.  }
  2829. diff --git a/security/Kconfig b/security/Kconfig
  2830. index 7561f6f99f1d..ccae931a1c6c 100644
  2831. --- a/security/Kconfig
  2832. +++ b/security/Kconfig
  2833. @@ -9,7 +9,7 @@ source "security/keys/Kconfig"
  2834.  
  2835.  config SECURITY_DMESG_RESTRICT
  2836.     bool "Restrict unprivileged access to the kernel syslog"
  2837. -   default n
  2838. +   default y
  2839.     help
  2840.       This enforces restrictions on unprivileged users reading the kernel
  2841.       syslog via dmesg(8).
  2842. @@ -19,10 +19,34 @@ config SECURITY_DMESG_RESTRICT
  2843.  
  2844.       If you are unsure how to answer this question, answer N.
  2845.  
  2846. +config SECURITY_PERF_EVENTS_RESTRICT
  2847. +   bool "Restrict unprivileged use of performance events"
  2848. +   depends on PERF_EVENTS
  2849. +   default y
  2850. +   help
  2851. +     If you say Y here, the kernel.perf_event_paranoid sysctl
  2852. +     will be set to 3 by default, and no unprivileged use of the
  2853. +     perf_event_open syscall will be permitted unless it is
  2854. +     changed.
  2855. +
  2856. +config SECURITY_TIOCSTI_RESTRICT
  2857. +   bool "Restrict unprivileged use of tiocsti command injection"
  2858. +   default y
  2859. +   help
  2860. +     This enforces restrictions on unprivileged users injecting commands
  2861. +     into other processes which share a tty session using the TIOCSTI
  2862. +     ioctl. This option makes TIOCSTI use require CAP_SYS_ADMIN.
  2863. +
  2864. +     If this option is not selected, no restrictions will be enforced
  2865. +     unless the tiocsti_restrict sysctl is explicitly set to (1).
  2866. +
  2867. +     If you are unsure how to answer this question, answer N.
  2868. +
  2869.  config SECURITY
  2870.     bool "Enable different security models"
  2871.     depends on SYSFS
  2872.     depends on MULTIUSER
  2873. +   default y
  2874.     help
  2875.       This allows you to choose different security modules to be
  2876.       configured into your kernel.
  2877. @@ -48,6 +72,7 @@ config SECURITYFS
  2878.  config SECURITY_NETWORK
  2879.     bool "Socket and Networking Security Hooks"
  2880.     depends on SECURITY
  2881. +   default y
  2882.     help
  2883.       This enables the socket and networking security hooks.
  2884.       If enabled, a security module can use these hooks to
  2885. @@ -154,6 +179,7 @@ config HARDENED_USERCOPY
  2886.     bool "Harden memory copies between kernel and userspace"
  2887.     depends on HAVE_HARDENED_USERCOPY_ALLOCATOR
  2888.     imply STRICT_DEVMEM
  2889. +   default y
  2890.     help
  2891.       This option checks for obviously wrong memory regions when
  2892.       copying memory to/from the kernel (via copy_to_user() and
  2893. @@ -166,7 +192,6 @@ config HARDENED_USERCOPY
  2894.  config HARDENED_USERCOPY_FALLBACK
  2895.     bool "Allow usercopy whitelist violations to fallback to object size"
  2896.     depends on HARDENED_USERCOPY
  2897. -   default y
  2898.     help
  2899.       This is a temporary option that allows missing usercopy whitelists
  2900.       to be discovered via a WARN() to the kernel log, instead of
  2901. @@ -191,6 +216,7 @@ config HARDENED_USERCOPY_PAGESPAN
  2902.  config FORTIFY_SOURCE
  2903.     bool "Harden common str/mem functions against buffer overflows"
  2904.     depends on ARCH_HAS_FORTIFY_SOURCE
  2905. +   default y
  2906.     help
  2907.       Detect overflows of buffers in common string and memory functions
  2908.       where the compiler can determine and validate the buffer sizes.
  2909. diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening
  2910. index a56c36470cb1..ea4c4aeed9cd 100644
  2911. --- a/security/Kconfig.hardening
  2912. +++ b/security/Kconfig.hardening
  2913. @@ -190,6 +190,7 @@ config STACKLEAK_RUNTIME_DISABLE
  2914.  
  2915.  config INIT_ON_ALLOC_DEFAULT_ON
  2916.     bool "Enable heap memory zeroing on allocation by default"
  2917. +   default yes
  2918.     help
  2919.       This has the effect of setting "init_on_alloc=1" on the kernel
  2920.       command line. This can be disabled with "init_on_alloc=0".
  2921. @@ -202,6 +203,7 @@ config INIT_ON_ALLOC_DEFAULT_ON
  2922.  
  2923.  config INIT_ON_FREE_DEFAULT_ON
  2924.     bool "Enable heap memory zeroing on free by default"
  2925. +   default yes
  2926.     help
  2927.       This has the effect of setting "init_on_free=1" on the kernel
  2928.       command line. This can be disabled with "init_on_free=0".
  2929. @@ -217,6 +219,21 @@ config INIT_ON_FREE_DEFAULT_ON
  2930.       touching "cold" memory areas. Most cases see 3-5% impact. Some
  2931.       synthetic workloads have measured as high as 8%.
  2932.  
  2933. +config PAGE_SANITIZE_VERIFY
  2934. +   bool "Verify sanitized pages"
  2935. +   default y
  2936. +   help
  2937. +     When init_on_free is enabled, verify that newly allocated pages
  2938. +     are zeroed to detect write-after-free bugs.
  2939. +
  2940. +config SLAB_SANITIZE_VERIFY
  2941. +   bool "Verify sanitized SLAB allocations"
  2942. +   default y
  2943. +   depends on !KASAN
  2944. +   help
  2945. +     When init_on_free is enabled, verify that newly allocated slab
  2946. +     objects are zeroed to detect write-after-free bugs.
  2947. +
  2948.  endmenu
  2949.  
  2950.  endmenu
  2951. diff --git a/security/selinux/Kconfig b/security/selinux/Kconfig
  2952. index 9e921fc72538..ae851a826c26 100644
  2953. --- a/security/selinux/Kconfig
  2954. +++ b/security/selinux/Kconfig
  2955. @@ -3,7 +3,7 @@ config SECURITY_SELINUX
  2956.     bool "NSA SELinux Support"
  2957.     depends on SECURITY_NETWORK && AUDIT && NET && INET
  2958.     select NETWORK_SECMARK
  2959. -   default n
  2960. +   default y
  2961.     help
  2962.       This selects NSA Security-Enhanced Linux (SELinux).
  2963.       You will also need a policy configuration and a labeled filesystem.
  2964. @@ -70,29 +70,6 @@ config SECURITY_SELINUX_AVC_STATS
  2965.       /sys/fs/selinux/avc/cache_stats, which may be monitored via
  2966.       tools such as avcstat.
  2967.  
  2968. -config SECURITY_SELINUX_CHECKREQPROT_VALUE
  2969. -   int "NSA SELinux checkreqprot default value"
  2970. -   depends on SECURITY_SELINUX
  2971. -   range 0 1
  2972. -   default 0
  2973. -   help
  2974. -     This option sets the default value for the 'checkreqprot' flag
  2975. -     that determines whether SELinux checks the protection requested
  2976. -     by the application or the protection that will be applied by the
  2977. -     kernel (including any implied execute for read-implies-exec) for
  2978. -     mmap and mprotect calls.  If this option is set to 0 (zero),
  2979. -     SELinux will default to checking the protection that will be applied
  2980. -     by the kernel.  If this option is set to 1 (one), SELinux will
  2981. -     default to checking the protection requested by the application.
  2982. -     The checkreqprot flag may be changed from the default via the
  2983. -     'checkreqprot=' boot parameter.  It may also be changed at runtime
  2984. -     via /sys/fs/selinux/checkreqprot if authorized by policy.
  2985. -
  2986. -     WARNING: this option is deprecated and will be removed in a future
  2987. -     kernel release.
  2988. -
  2989. -     If you are unsure how to answer this question, answer 0.
  2990. -
  2991.  config SECURITY_SELINUX_SIDTAB_HASH_BITS
  2992.     int "NSA SELinux sidtab hashtable size"
  2993.     depends on SECURITY_SELINUX
  2994. diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
  2995. index ddd097790d47..d26efee67c3b 100644
  2996. --- a/security/selinux/hooks.c
  2997. +++ b/security/selinux/hooks.c
  2998. @@ -136,21 +136,7 @@ static int __init selinux_enabled_setup(char *str)
  2999.  __setup("selinux=", selinux_enabled_setup);
  3000.  #endif
  3001.  
  3002. -static unsigned int selinux_checkreqprot_boot =
  3003. -   CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
  3004. -
  3005. -static int __init checkreqprot_setup(char *str)
  3006. -{
  3007. -   unsigned long checkreqprot;
  3008. -
  3009. -   if (!kstrtoul(str, 0, &checkreqprot)) {
  3010. -       selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
  3011. -       if (checkreqprot)
  3012. -           pr_warn("SELinux: checkreqprot set to 1 via kernel parameter.  This is deprecated and will be rejected in a future kernel release.\n");
  3013. -   }
  3014. -   return 1;
  3015. -}
  3016. -__setup("checkreqprot=", checkreqprot_setup);
  3017. +static const unsigned int selinux_checkreqprot_boot;
  3018.  
  3019.  /**
  3020.   * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
  3021. diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
  3022. index fff6babeeae6..9ef382e89176 100644
  3023. --- a/security/selinux/selinuxfs.c
  3024. +++ b/security/selinux/selinuxfs.c
  3025. @@ -721,7 +721,6 @@ static ssize_t sel_read_checkreqprot(struct file *filp, char __user *buf,
  3026.  static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf,
  3027.                       size_t count, loff_t *ppos)
  3028.  {
  3029. -   struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
  3030.     char *page;
  3031.     ssize_t length;
  3032.     unsigned int new_value;
  3033. @@ -745,18 +744,9 @@ static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf,
  3034.         return PTR_ERR(page);
  3035.  
  3036.     length = -EINVAL;
  3037. -   if (sscanf(page, "%u", &new_value) != 1)
  3038. +   if (sscanf(page, "%u", &new_value) != 1 || new_value)
  3039.         goto out;
  3040.  
  3041. -   if (new_value) {
  3042. -       char comm[sizeof(current->comm)];
  3043. -
  3044. -       memcpy(comm, current->comm, sizeof(comm));
  3045. -       pr_warn_once("SELinux: %s (%d) set checkreqprot to 1. This is deprecated and will be rejected in a future kernel release.\n",
  3046. -                comm, current->pid);
  3047. -   }
  3048. -
  3049. -   checkreqprot_set(fsi->state, (new_value ? 1 : 0));
  3050.     length = count;
  3051.  out:
  3052.     kfree(page);
  3053. diff --git a/security/yama/Kconfig b/security/yama/Kconfig
  3054. index a810304123ca..b809050b25d2 100644
  3055. --- a/security/yama/Kconfig
  3056. +++ b/security/yama/Kconfig
  3057. @@ -2,7 +2,7 @@
  3058.  config SECURITY_YAMA
  3059.     bool "Yama support"
  3060.     depends on SECURITY
  3061. -   default n
  3062. +   default y
  3063.     help
  3064.       This selects Yama, which extends DAC support with additional
  3065.       system-wide security settings beyond regular Linux discretionary
  3066. diff --git a/tools/perf/Documentation/security.txt b/tools/perf/Documentation/security.txt
  3067. index 4fe3b8b1958f..a7d88cc23a70 100644
  3068. --- a/tools/perf/Documentation/security.txt
  3069. +++ b/tools/perf/Documentation/security.txt
  3070. @@ -148,6 +148,7 @@ Perf tool provides a message similar to the one below:
  3071.     >= 0: Disallow raw and ftrace function tracepoint access
  3072.     >= 1: Disallow CPU event access
  3073.     >= 2: Disallow kernel profiling
  3074. +   >= 3: Disallow use of any event
  3075.     To make the adjusted perf_event_paranoid setting permanent preserve it
  3076.     in /etc/sysctl.conf (e.g. kernel.perf_event_paranoid = <setting>)
  3077.  
  3078.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!