Ard Biesheuvel 70a2425a13 x86/efistub: Remap kernel text read-only before dropping NX attribute ... commit 9c55461040 upstream. Currently, the EFI stub invokes the EFI memory attributes protocol to strip any NX restrictions from the entire loaded kernel, resulting in all code and data being mapped read-write-execute. The point of the EFI memory attributes protocol is to remove the need for all memory allocations to be mapped with both write and execute permissions by default, and make it the OS loader's responsibility to transition data mappings to code mappings where appropriate. Even though the UEFI specification does not appear to leave room for denying memory attribute changes based on security policy, let's be cautious and avoid relying on the ability to create read-write-execute mappings. This is trivially achievable, given that the amount of kernel code executing via the firmware's 1:1 mapping is rather small and limited to the .head.text region. So let's drop the NX restrictions only on that subregion, but not before remapping it as read-only first. Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-04-10 16:38:23 +02:00
..
accel	accel/ivpu: Don't enable any tiles by default on VPU40xx	2024-02-20 16:56:21 +01:00
accessibility	speakup: Fix 8bit characters from direct synth	2024-04-03 15:32:16 +02:00
acpi	ACPICA: debugger: check status of acpi_evaluate_object() in acpi_db_walk_for_fields()	2024-04-10 16:37:57 +02:00
amba	…
android	…
ata	ata: sata_mv: Fix PCI device ID table declaration compilation warning	2024-04-10 16:38:14 +02:00
atm	…
auxdisplay	…
base	driver core: Introduce device_link_wait_removal()	2024-04-10 16:38:18 +02:00
bcma	…
block	aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts	2024-03-26 18:16:29 -04:00
bluetooth	Bluetooth: qca: fix device-address endianness	2024-04-10 16:38:02 +02:00
bus	bus: mhi: ep: check the correct variable in mhi_ep_register_controller()	2024-03-26 18:17:29 -04:00
cache	cache: ax45mp_cache: Align end size to cache boundary in ax45mp_dma_cache_wback()	2024-02-21 16:24:10 +00:00
cdrom	…
cdx	…
char	tpm,tpm_tis: Avoid warning splat at shutdown	2024-04-03 15:32:19 +02:00
clk	clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays	2024-04-03 15:32:10 +02:00
clocksource	clocksource/drivers/arm_global_timer: Fix maximum prescaler value	2024-04-03 15:32:32 +02:00
comedi	comedi: comedi_test: Prevent timers rescheduling during deletion	2024-03-05 14:21:45 +00:00
connector	connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared"	2024-02-13 11:15:44 +01:00
counter	counter: fix privdata alignment	2024-02-16 18:51:00 -05:00
cpufreq	cpufreq: dt: always allocate zeroed cpumask	2024-04-03 15:32:24 +02:00
cpuidle	…
crypto	crypto: iaa - Fix nr_cpus < nr_iaa case	2024-04-03 15:32:36 +02:00
cxl	cxl/trace: Properly initialize cxl_poison region name	2024-04-03 15:32:25 +02:00
dax	…
dca	…
devfreq	…
dio	…
dma	dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA	2024-03-26 18:17:00 -04:00
dma-buf	dma-buf: Fix NULL pointer dereference in sanitycheck()	2024-04-10 16:37:54 +02:00
dpll	dpll: indent DPLL option type by a tab	2024-04-10 16:37:56 +02:00
edac	…
eisa	…
extcon	…
firewire	firewire: ohci: prevent leak of left-over IRQ on unbind	2024-03-06 22:35:22 +09:00
firmware	x86/efistub: Remap kernel text read-only before dropping NX attribute	2024-04-10 16:38:23 +02:00
fpga	…
fsi	…
gnss	…
gpio	gpio: cdev: fix missed label sanitizing in debounce_setup()	2024-04-10 16:38:15 +02:00
gpu	drm/xe: Rework rebinding	2024-04-10 16:38:22 +02:00
greybus	…
hid	HID: amd_sfh: Avoid disabling the interrupt	2024-03-26 18:17:14 -04:00
hsi	…
hte	…
hv	x86/hyperv: Use per cpu initial stack for vtl context	2024-03-26 18:17:30 -04:00
hwmon	hwmon: (amc6821) add of_match table	2024-04-03 15:32:16 +02:00
hwspinlock	…
hwtracing	hwtracing: hisi_ptt: Move type check to the beginning of hisi_ptt_pmu_event_init()	2024-03-26 18:17:30 -04:00
i2c	i2c: aspeed: Fix the dummy irq expected print	2024-03-08 10:10:27 +01:00
i3c	i3c: dw: Disable IBI IRQ depends on hot-join and SIR enabling	2024-03-26 18:17:24 -04:00
idle	…
iio	iio: adc: rockchip_saradc: use mask for write_enable bitfield	2024-04-03 15:32:08 +02:00
infiniband	RDMA/mana_ib: Use virtual address in dma regions for MRs	2024-03-26 18:17:26 -04:00
input	Input: iqs7222 - add support for IQS7222D v1.1 and v1.2	2024-03-26 18:17:26 -04:00
interconnect	…
iommu	iommu: Validate the PASID in iommu_attach_device_pasid()	2024-04-10 16:37:59 +02:00
ipack	…
irqchip	irqchip/renesas-rzg2l: Prevent spurious interrupts when setting trigger type	2024-04-03 15:32:34 +02:00
isdn	…
leds	leds: trigger: netdev: Fix kernel panic on interface rename trig notify	2024-04-03 15:32:15 +02:00
macintosh	…
mailbox	…
mcb	…
md	dm integrity: fix out-of-range warning	2024-04-10 16:38:00 +02:00
media	media: nxp: imx8-isi: Mark all crossbar sink pads as MUST_CONNECT	2024-04-03 15:32:03 +02:00
memory	memory: tegra: Correct DLA client names	2024-03-26 18:16:46 -04:00
memstick	…
message	…
mfd	mfd: intel-lpss: Introduce QUIRK_CLOCK_DIVIDER_UNITY for XPS 9530	2024-04-03 15:32:35 +02:00
misc	mei: vsc: Don't use sleeping condition in wait_event_timeout()	2024-03-26 18:17:30 -04:00
mmc	sdhci-of-dwcmshc: disable PM runtime in dwcmshc_remove()	2024-04-03 15:32:40 +02:00
most	…
mtd	mtd: rawnand: Constrain even more when continuous reads are enabled	2024-04-03 15:32:23 +02:00
mux	…
net	net: ravb: Always update error counters	2024-04-10 16:38:08 +02:00
nfc	…
ntb	NTB: fix possible name leak in ntb_register_device()	2024-03-26 18:17:06 -04:00
nubus	…
nvdimm	…
nvme	nvme: fix reconnection fail due to reserved tag allocation	2024-03-26 18:17:33 -04:00
nvmem	nvmem: meson-efuse: fix function pointer type mismatch	2024-04-03 15:32:16 +02:00
of	of: module: prevent NULL pointer dereference in vsnprintf()	2024-04-10 16:38:19 +02:00
opp	OPP: debugfs: Fix warning around icc_get_name()	2024-03-26 18:16:56 -04:00
parisc	…
parport	…
pci	PCI: hv: Fix ring buffer size calculation	2024-04-03 15:32:18 +02:00
pcmcia	…
peci	…
perf	drivers/perf: riscv: Disable PERF_SAMPLE_BRANCH_* while not supported	2024-04-10 16:38:10 +02:00
phy	phy: tegra: xusb: Add API to retrieve the port number of phy	2024-04-03 15:32:16 +02:00
pinctrl	kbuild: make -Woverride-init warnings more consistent	2024-04-10 16:38:00 +02:00
platform	platform/x86/intel/tpmi: Change vsec offset to u64	2024-04-03 15:32:20 +02:00
pmdomain	pmdomain: qcom: rpmhpd: Drop SA8540P gfx.lvl	2024-03-26 18:16:35 -04:00
pnp	…
power	power: supply: mm8013: fix "not charging" detection	2024-03-26 18:17:17 -04:00
powercap	powercap: intel_rapl_tpmi: Fix System Domain probing	2024-04-03 15:32:04 +02:00
pps	…
ps3	…
ptp	…
pwm	pwm: img: fix pwm clock lookup	2024-04-03 15:32:35 +02:00
rapidio	…
ras	…
regulator	regulator: userspace-consumer: add module device table	2024-03-26 18:16:50 -04:00
remoteproc	remoteproc: virtio: Fix wdg cannot recovery remote processor	2024-04-03 15:32:01 +02:00
reset	…
rpmsg	…
rtc	rtc: max31335: fix interrupt status reg	2024-03-26 18:17:30 -04:00
s390	s390/qeth: handle deferred cc1	2024-04-10 16:37:56 +02:00
sbus	…
scsi	scsi: sd: Unregister device if device_add_disk() failed in sd_probe()	2024-04-10 16:38:13 +02:00
sh	…
siox	…
slimbus	slimbus: core: Remove usage of the deprecated ida_simple_xx() API	2024-04-03 15:32:16 +02:00
soc	soc: fsl: qbman: Use raw spinlock for cgr_lock	2024-04-03 15:32:21 +02:00
soundwire	…
spi	spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx_spi_probe	2024-04-10 16:38:13 +02:00
spmi	…
ssb	…
staging	staging: vc04_services: fix information leak in create_component()	2024-04-03 15:32:45 +02:00
target	scsi: target: pscsi: Fix bio_put() for error case	2024-02-15 14:44:07 -05:00
tc	…
tee	tee: optee: Fix kernel panic caused by incorrect error handling	2024-03-04 09:49:03 +01:00
thermal	thermal: gov_power_allocator: Allow binding without trip points	2024-04-10 16:38:13 +02:00
thunderbolt	thunderbolt: Fix for v6.8-rc7	2024-03-02 19:47:01 +01:00
tty	serial: Lock console when calling into driver before registration	2024-04-03 15:32:12 +02:00
ufs	scsi: ufs: qcom: Provide default cycles_in_1us value	2024-04-03 15:32:45 +02:00
uio	…
usb	usb: dwc3: pci: Drop duplicate ID	2024-04-03 15:32:50 +02:00
vdpa	vdpa/mlx5: Allow CVQ size changes	2024-03-26 18:17:35 -04:00
vfio	vfio/pds: Make sure migration file isn't accessed after reset	2024-04-03 15:32:44 +02:00
vhost	…
video	fbdev: Select I/O-memory framebuffer ops for SBus	2024-04-03 15:32:39 +02:00
virt	…
virtio	virtio: reenable config if freezing device failed	2024-04-03 15:32:25 +02:00
w1	…
watchdog	watchdog: stm32_iwdg: initialize default timeout	2024-03-26 18:17:25 -04:00
xen	xen/events: increment refcnt only if event channel is refcounted	2024-03-26 18:17:34 -04:00
zorro	…
Kconfig	…
Makefile	…