Merge tag 'hardening-v6.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull hardening fixes from Kees Cook:

- yama: document function parameter (Christian Göttsche)

- mm/util: Swap kmemdup_array() arguments (Jean-Philippe Brucker)

- kunit/overflow: Adjust for __counted_by with DEFINE_RAW_FLEX()

- MAINTAINERS: Update entries for Kees Cook

* tag 'hardening-v6.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
MAINTAINERS: Update entries for Kees Cook
kunit/overflow: Adjust for __counted_by with DEFINE_RAW_FLEX()
yama: document function parameter
mm/util: Swap kmemdup_array() arguments

MAINTAINERS

···
 
 CLANG CONTROL FLOW INTEGRITY SUPPORT
 M:	Sami Tolvanen <[e-mail]>
-M:	Kees Cook <[e-mail]>
+M:	Kees Cook <[e-mail]>
 R:	Nathan Chancellor <[e-mail]>
 L:	[e-mail]
 S:	Supported
···
 
 EXEC & BINFMT API, ELF
 R:	Eric Biederman <[e-mail]>
-R:	Kees Cook <[e-mail]>
+R:	Kees Cook <[e-mail]>
 L:	[e-mail]
 S:	Supported
 T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/execve
···
 F:	drivers/net/ethernet/nvidia/*
 
 FORTIFY_SOURCE
-M:	Kees Cook <[e-mail]>
+M:	Kees Cook <[e-mail]>
 L:	[e-mail]
 S:	Supported
 T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening
···
 F:	include/linux/platform_data/gsc_hwmon.h
 
 GCC PLUGINS
-M:	Kees Cook <[e-mail]>
+M:	Kees Cook <[e-mail]>
 L:	[e-mail]
 S:	Maintained
 T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening
···
 F:	drivers/input/touchscreen/resistive-adc-touch.c
 
 GENERIC STRING LIBRARY
-M:	Kees Cook <[e-mail]>
+M:	Kees Cook <[e-mail]>
 R:	Andy Shevchenko <[e-mail]>
 L:	[e-mail]
 S:	Supported
···
 F:	usr/
 
 KERNEL HARDENING (not covered by other areas)
-M:	Kees Cook <[e-mail]>
+M:	Kees Cook <[e-mail]>
 R:	Gustavo A. R. Silva <[e-mail]>
 L:	[e-mail]
 S:	Supported
···
 
 LEAKING_ADDRESSES
 M:	Tycho Andersen <[e-mail]>
-R:	Kees Cook <[e-mail]>
+R:	Kees Cook <[e-mail]>
 L:	[e-mail]
 S:	Maintained
 T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening
···
 F:	arch/powerpc/platforms/83xx/
 
 LINUX KERNEL DUMP TEST MODULE (LKDTM)
-M:	Kees Cook <[e-mail]>
+M:	Kees Cook <[e-mail]>
 S:	Maintained
 F:	drivers/misc/lkdtm/*
 F:	tools/testing/selftests/lkdtm/*
···
 F:	drivers/media/usb/dvb-usb-v2/lmedm04*
 
 LOADPIN SECURITY MODULE
-M:	Kees Cook <[e-mail]>
+M:	Kees Cook <[e-mail]>
 S:	Supported
 T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening
 F:	Documentation/admin-guide/LSM/LoadPin.rst
···
 
 PROC SYSCTL
 M:	Luis Chamberlain <[e-mail]>
-M:	Kees Cook <[e-mail]>
+M:	Kees Cook <[e-mail]>
 M:	Joel Granados <[e-mail]>
 L:	[e-mail]
 L:	[e-mail]
···
 F:	drivers/net/pse-pd/
 
 PSTORE FILESYSTEM
-M:	Kees Cook <[e-mail]>
+M:	Kees Cook <[e-mail]>
 R:	Tony Luck <[e-mail]>
 R:	Guilherme G. Piccoli <[e-mail]>
 L:	[e-mail]
···
 F:	drivers/media/cec/platform/seco/seco-cec.h
 
 SECURE COMPUTING
-M:	Kees Cook <[e-mail]>
+M:	Kees Cook <[e-mail]>
 R:	Andy Lutomirski <[e-mail]>
 R:	Will Drewry <[e-mail]>
 S:	Supported
···
 F:	include/uapi/linux/ublk_cmd.h
 
 UBSAN
-M:	Kees Cook <[e-mail]>
+M:	Kees Cook <[e-mail]>
 R:	Marco Elver <[e-mail]>
 R:	Andrey Konovalov <[e-mail]>
 R:	Andrey Ryabinin <[e-mail]>
···
 F:	include/linux/yam.h
 
 YAMA SECURITY MODULE
-M:	Kees Cook <[e-mail]>
+M:	Kees Cook <[e-mail]>
 S:	Supported
 T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening
 F:	Documentation/admin-guide/LSM/Yama.rst

drivers/soc/tegra/fuse/fuse-tegra.c

···
 
 static int tegra_fuse_add_lookups(struct tegra_fuse *fuse)
 {
-	fuse->lookups = kmemdup_array(fuse->soc->lookups, sizeof(*fuse->lookups),
-				      fuse->soc->num_lookups, GFP_KERNEL);
+	fuse->lookups = kmemdup_array(fuse->soc->lookups, fuse->soc->num_lookups,
+				      sizeof(*fuse->lookups), GFP_KERNEL);
 	if (!fuse->lookups)
 		return -ENOMEM;
 

include/linux/string.h

···
 
 extern void *kvmemdup(const void *src, size_t len, gfp_t gfp) __realloc_size(2);
 extern char *kmemdup_nul(const char *s, size_t len, gfp_t gfp);
-extern void *kmemdup_array(const void *src, size_t element_size, size_t count, gfp_t gfp)
+extern void *kmemdup_array(const void *src, size_t count, size_t element_size, gfp_t gfp)
 		__realloc_size(2, 3);
 
 /* lib/argv_split.c */

lib/fortify_kunit.c

···
 	for (i = 0; i < ARRAY_SIZE(test_strs); i++) {			\
 		len = strlen(test_strs[i]);				\
 		KUNIT_EXPECT_EQ(test, __builtin_constant_p(len), 0);	\
-		checker(len, kmemdup_array(test_strs[i], len, 1, gfp),	\
+		checker(len, kmemdup_array(test_strs[i], 1, len, gfp),	\
 			kfree(p));					\
 		checker(len, kmemdup(test_strs[i], len, gfp),		\
 			kfree(p));					\

lib/overflow_kunit.c

···
 	s16 array[] __counted_by(counter);
 };
 
+struct bar {
+	int a;
+	u32 counter;
+	s16 array[];
+};
+
 static void DEFINE_FLEX_test(struct kunit *test)
 {
-	DEFINE_RAW_FLEX(struct foo, two, array, 2);
+	/* Using _RAW_ on a __counted_by struct will initialize "counter" to zero */
+	DEFINE_RAW_FLEX(struct foo, two_but_zero, array, 2);
+#if __has_attribute(__counted_by__)
+	int expected_raw_size = sizeof(struct foo);
+#else
+	int expected_raw_size = sizeof(struct foo) + 2 * sizeof(s16);
+#endif
+	/* Without annotation, it will always be on-stack size. */
+	DEFINE_RAW_FLEX(struct bar, two, array, 2);
 	DEFINE_FLEX(struct foo, eight, array, counter, 8);
 	DEFINE_FLEX(struct foo, empty, array, counter, 0);
 
-	KUNIT_EXPECT_EQ(test, __struct_size(two),
-			sizeof(struct foo) + sizeof(s16) + sizeof(s16));
+	KUNIT_EXPECT_EQ(test, __struct_size(two_but_zero), expected_raw_size);
+	KUNIT_EXPECT_EQ(test, __struct_size(two), sizeof(struct bar) + 2 * sizeof(s16));
 	KUNIT_EXPECT_EQ(test, __struct_size(eight), 24);
 	KUNIT_EXPECT_EQ(test, __struct_size(empty), sizeof(struct foo));
 }

mm/util.c

···
  * kmemdup_array - duplicate a given array.
  *
  * @src: array to duplicate.
- * @element_size: size of each element of array.
  * @count: number of elements to duplicate from array.
+ * @element_size: size of each element of array.
  * @gfp: GFP mask to use.
  *
  * Return: duplicated array of @src or %NULL in case of error,
  * result is physically contiguous. Use kfree() to free.
  */
-void *kmemdup_array(const void *src, size_t element_size, size_t count, gfp_t gfp)
+void *kmemdup_array(const void *src, size_t count, size_t element_size, gfp_t gfp)
 {
 	return kmemdup(src, size_mul(element_size, count), gfp);
 }

security/yama/yama_lsm.c

···
 
 /**
  * yama_relation_cleanup - remove invalid entries from the relation list
+ * @work: unused
  *
  */
 static void yama_relation_cleanup(struct work_struct *work)