This is a note to let you know that I've just added the patch titled security: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6 to the 6.0-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: security-restrict-config_zero_call_used_regs-to-gcc-or-clang-15.0.6.patch and it can be found in the queue-6.0 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From d6a9fb87e9d18f3394a9845546bbe868efdccfd2 Mon Sep 17 00:00:00 2001 From: Nathan Chancellor <nathan@xxxxxxxxxx> Date: Wed, 14 Dec 2022 16:26:03 -0700 Subject: security: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6 From: Nathan Chancellor <nathan@xxxxxxxxxx> commit d6a9fb87e9d18f3394a9845546bbe868efdccfd2 upstream. A bad bug in clang's implementation of -fzero-call-used-regs can result in NULL pointer dereferences (see the links above the check for more information). Restrict CONFIG_CC_HAS_ZERO_CALL_USED_REGS to either a supported GCC version or a clang newer than 15.0.6, which will catch both a theoretical 15.0.7 and the upcoming 16.0.0, which will both have the bug fixed. Cc: stable@xxxxxxxxxxxxxxx # v5.15+ Signed-off-by: Nathan Chancellor <nathan@xxxxxxxxxx> Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx> Link: https://lore.kernel.org/r/20221214232602.4118147-1-nathan@xxxxxxxxxx Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- security/Kconfig.hardening | 3 +++ 1 file changed, 3 insertions(+) --- a/security/Kconfig.hardening +++ b/security/Kconfig.hardening @@ -253,6 +253,9 @@ config INIT_ON_FREE_DEFAULT_ON config CC_HAS_ZERO_CALL_USED_REGS def_bool $(cc-option,-fzero-call-used-regs=used-gpr) + # https://github.com/ClangBuiltLinux/linux/issues/1766 + # https://github.com/llvm/llvm-project/issues/59242 + depends on !CC_IS_CLANG || CLANG_VERSION > 150006 config ZERO_CALL_USED_REGS bool "Enable register zeroing on function exit" Patches currently in stable-queue which might be from nathan@xxxxxxxxxx are queue-6.0/security-restrict-config_zero_call_used_regs-to-gcc-or-clang-15.0.6.patch queue-6.0/include-uapi-linux-swab-fix-potentially-missing-__al.patch queue-6.0/drm-fsl-dcu-fix-return-type-of-fsl_dcu_drm_connector.patch queue-6.0/drm-sti-fix-return-type-of-sti_-dvo-hda-hdmi-_connec.patch queue-6.0/drm-mediatek-fix-return-type-of-mtk_hdmi_bridge_mode.patch queue-6.0/hamradio-baycom_epp-fix-return-type-of-baycom_send_p.patch queue-6.0/s390-lcs-fix-return-type-of-lcs_start_xmit.patch queue-6.0/drm-amdgpu-fix-type-of-second-parameter-in-trans_msg.patch queue-6.0/bpf-fix-a-btf_id_list-bug-with-config_debug_info_btf.patch queue-6.0/s390-netiucv-fix-return-type-of-netiucv_tx.patch queue-6.0/scsi-elx-libefc-fix-second-parameter-type-in-state-c.patch queue-6.0/s390-ctcm-fix-return-type-of-ctc-mp-m_tx.patch queue-6.0/drm-meson-fix-return-type-of-meson_encoder_cvbs_mode.patch queue-6.0/drm-amdgpu-fix-type-of-second-parameter-in-odn_edit_.patch queue-6.0/net-ethernet-ti-fix-return-type-of-netcp_ndo_start_x.patch