From 3c1e4ccabb6a8bc88a5230f808863a3bb8edff8b Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Sun, 10 Jul 2022 01:15:21 +0300 Subject: [PATCH] Add slub_debug check --- kconfig_hardened_check/__init__.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/kconfig_hardened_check/__init__.py b/kconfig_hardened_check/__init__.py index 9f4bbb2..21e9e80 100644 --- a/kconfig_hardened_check/__init__.py +++ b/kconfig_hardened_check/__init__.py @@ -16,7 +16,6 @@ # iommu.passthrough=0 # iommu.strict=1 # slub_debug=FZ (slow) -# slub_debug=P # loadpin.enforce=1 # debugfs=no-mount (or off if possible) # @@ -416,8 +415,7 @@ def add_kconfig_checks(l, arch): l += [OR(KconfigCheck('self_protection', 'kspp', 'INIT_STACK_ALL_ZERO', 'y'), KconfigCheck('self_protection', 'kspp', 'GCC_PLUGIN_STRUCTLEAK_BYREF_ALL', 'y'))] l += [OR(KconfigCheck('self_protection', 'kspp', 'INIT_ON_FREE_DEFAULT_ON', 'y'), - AND(KconfigCheck('self_protection', 'kspp', 'PAGE_POISONING_ZERO', 'y'), - CmdlineCheck('self_protection', 'kspp', 'page_poison', '1')))] + KconfigCheck('self_protection', 'kspp', 'PAGE_POISONING_ZERO', 'y'))] # CONFIG_INIT_ON_FREE_DEFAULT_ON was added in v5.3. # CONFIG_PAGE_POISONING_ZERO was removed in v5.11. # Starting from v5.11 CONFIG_PAGE_POISONING unconditionally checks @@ -652,7 +650,10 @@ def add_cmdline_checks(l, arch): CmdlineCheck('self_protection', 'kspp', 'init_on_alloc', 'is not set')))] l += [OR(CmdlineCheck('self_protection', 'kspp', 'init_on_free', '1'), AND(KconfigCheck('self_protection', 'kspp', 'INIT_ON_FREE_DEFAULT_ON', 'y'), - CmdlineCheck('self_protection', 'kspp', 'init_on_free', 'is not set')))] + CmdlineCheck('self_protection', 'kspp', 'init_on_free', 'is not set')), + AND(CmdlineCheck('self_protection', 'kspp', 'page_poison', '1'), + KconfigCheck('self_protection', 'kspp', 'PAGE_POISONING_ZERO', 'y'), + CmdlineCheck('self_protection', 'kspp', 'slub_debug', 'P')))] l += [OR(CmdlineCheck('self_protection', 'kspp', 'slab_nomerge'), AND(KconfigCheck('self_protection', 'clipos', 'SLAB_MERGE_DEFAULT', 'is not set'), CmdlineCheck('self_protection', 'kspp', 'slab_merge', 'is not set')))] # option presence check -- 2.31.1