[GIT PULL] kernel hardening updates for v5.20-rc1

[Kees Cook <keescook@chromium.org>]

Hi Linus,

Please pull these kernel hardening updates for v5.20-rc1. Two
cross-maintainer notes: the dm-verity/loadpin changes are Acked by
Mike Snitzer but they have been carried in my treer; the LKDTM change
is duplicated in the drivers/misc tree (it was late in cycle when Greg
and I both picked it up).

Thanks!

-Kees

The following changes since commit a111daf0c53ae91e71fd2bfe7497862d14132e3e:

  Linux 5.19-rc3 (2022-06-19 15:06:47 -0500)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git tags/hardening-v5.20-rc1

for you to fetch changes up to 27603a606fda0806d7c08914bc976931aa42020e:

  dm: verity-loadpin: Drop use of dm_table_get_num_targets() (2022-07-28 21:48:12 -0700)

----------------------------------------------------------------
hardening updates for v5.20-rc1

- Fix Sparse warnings with randomizd kstack (GONG, Ruiqi)

- Replace uintptr_t with unsigned long in usercopy (Jason A. Donenfeld)

- Fix Clang -Wforward warning in LKDTM (Justin Stitt)

- Fix comment to correctly refer to STRICT_DEVMEM (Lukas Bulwahn)

- Introduce dm-verity binding logic to LoadPin LSM (Matthias Kaehlcke)

- Clean up warnings and overflow and KASAN tests (Kees Cook)

----------------------------------------------------------------
GONG, Ruiqi (1):
      stack: Declare {randomize_,}kstack_offset to fix Sparse warnings

Jason A. Donenfeld (1):
      usercopy: use unsigned long instead of uintptr_t

Justin Stitt (1):
      drivers: lkdtm: fix clang -Wformat warning

Kees Cook (3):
      MAINTAINERS: Add a general "kernel hardening" section
      lib: overflow: Do not define 64-bit tests on 32-bit
      kasan: test: Silence GCC 12 warnings

Lukas Bulwahn (1):
      x86: mm: refer to the intended config STRICT_DEVMEM in a comment

Matthias Kaehlcke (4):
      dm: Add verity helpers for LoadPin
      LoadPin: Enable loading from trusted dm-verity devices
      dm: verity-loadpin: Use CONFIG_SECURITY_LOADPIN_VERITY for conditional compilation
      dm: verity-loadpin: Drop use of dm_table_get_num_targets()

 MAINTAINERS                       |  21 ++++-
 arch/x86/mm/init.c                |   2 +-
 drivers/md/Makefile               |   1 +
 drivers/md/dm-verity-loadpin.c    |  75 +++++++++++++++++
 drivers/md/dm-verity-target.c     |  33 +++++++-
 drivers/md/dm-verity.h            |   4 +
 drivers/misc/lkdtm/bugs.c         |   2 +-
 include/linux/dm-verity-loadpin.h |  27 ++++++
 include/uapi/linux/loadpin.h      |  22 +++++
 init/main.c                       |   1 +
 lib/overflow_kunit.c              |   6 ++
 lib/test_kasan.c                  |  10 +++
 mm/usercopy.c                     |   2 +-
 security/loadpin/Kconfig          |  16 ++++
 security/loadpin/loadpin.c        | 167 +++++++++++++++++++++++++++++++++++++-
 15 files changed, 380 insertions(+), 9 deletions(-)
 create mode 100644 drivers/md/dm-verity-loadpin.c
 create mode 100644 include/linux/dm-verity-loadpin.h
 create mode 100644 include/uapi/linux/loadpin.h

-- 
Kees Cook