[GIT PULL] bounds fixes for v5.18-rc1

From: Kees Cook <keescook@chromium.org>
To: Linus Torvalds <torvalds@linux-foundation.org>
Cc: linux-kernel@vger.kernel.org,
	Alexander Shishkin <alexander.shishkin@linux.intel.com>,
	Arnd Bergmann <arnd@arndb.de>,
	Geert Uytterhoeven <geert@linux-m68k.org>,
	Greg Ungerer <gerg@linux-m68k.org>,
	Guenter Roeck <linux@roeck-us.net>,
	"Gustavo A. R. Silva" <gustavoars@kernel.org>,
	Ivan Kokshaysky <ink@jurassic.park.msu.ru>,
	Jarkko Sakkinen <jarkko@kernel.org>,
	Jason Gunthorpe <jgg@ziepe.ca>, Kees Cook <keescook@chromium.org>,
	Laurent Pinchart <laurent.pinchart@ideasonboard.com>,
	Mark Rutland <mark.rutland@arm.com>,
	Matt Turner <mattst88@gmail.com>,
	Mauro Carvalho Chehab <mchehab@kernel.org>,
	Peter Huewe <peterhuewe@gmx.de>,
	"Peter Zijlstra (Intel)" <peterz@infradead.org>,
	Richard Henderson <rth@twiddle.net>,
	Sakari Ailus <sakari.ailus@linux.intel.com>,
	Sean Christopherson <seanjc@google.com>,
	Stefan Berger <stefanb@linux.ibm.com>
Subject: [GIT PULL] bounds fixes for v5.18-rc1
Date: Mon, 21 Mar 2022 08:52:31 -0700	[thread overview]
Message-ID: <202203210843.0E70F58@keescook> (raw)

Hi Linus,

Please pull these scattered buffer and array bounds fixes for v5.18-rc1.
These are a handful of fixes that I've been carrying in -next in
preparation for the coming memcpy improvements and the enabling of
-Warray-bounds globally. There are additional similar fixes in other
maintainer's trees, but these ended up getting carried by me. :)

Thanks!

-Kees

The following changes since commit dfd42facf1e4ada021b939b4e19c935dcdd55566:

  Linux 5.17-rc3 (2022-02-06 12:20:50 -0800)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git tags/bounds-fixes-v5.18-rc1

for you to fetch changes up to fad278388e01e3658a356118bed8ee2c2408d280:

  media: omap3isp: Use struct_group() for memcpy() region (2022-02-27 10:58:04 -0800)

----------------------------------------------------------------
bounds-fixes updates for v5.18-rc1

- Various buffer and array bounds related fixes

----------------------------------------------------------------
Kees Cook (5):
      intel_th: msu: Use memset_startat() for clearing hw header
      m68k: cmpxchg: Dereference matching size
      alpha: Silence -Warray-bounds warnings
      tpm: vtpm_proxy: Check length to avoid compiler warning
      media: omap3isp: Use struct_group() for memcpy() region

Sean Christopherson (1):
      KVM: x86: Replace memset() "optimization" with normal per-field writes

 arch/alpha/mm/init.c                      |  6 +++---
 arch/m68k/include/asm/cmpxchg.h           |  9 ++++-----
 arch/x86/kvm/emulate.c                    |  9 +++++++--
 arch/x86/kvm/kvm_emulate.h                |  6 +-----
 drivers/char/tpm/tpm_vtpm_proxy.c         |  2 +-
 drivers/hwtracing/intel_th/msu.c          |  4 +---
 drivers/media/platform/omap3isp/ispstat.c |  5 +++--
 include/uapi/linux/omap3isp.h             | 21 +++++++++++++--------
 8 files changed, 33 insertions(+), 29 deletions(-)

-- 
Kees Cook