Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Mon, 26 Sep 2022 17:53:53 +0200
From:   Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To:     Ard Biesheuvel <ardb@kernel.org>
Cc:     Pavel Machek <pavel@denx.de>, linux-kernel@vger.kernel.org,
        stable@vger.kernel.org,
        Daniel Marth <daniel.marth@inso.tuwien.ac.at>,
        Kees Cook <keescook@chromium.org>,
        Sasha Levin <sashal@kernel.org>
Subject: Re: [PATCH 4.14 06/40] efi: libstub: Disable struct randomization
Message-ID: <YzHLEZtLCw9V3xnZ@kroah.com>
References: <20220926100738.148626940@linuxfoundation.org>
 <20220926100738.463310701@linuxfoundation.org>
 <20220926110826.GE8978@amd>
 <CAMj1kXHOMuaBeR_LqVBKVtmGaJQg5hznSxow5bosQ9+NzhZ72A@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAMj1kXHOMuaBeR_LqVBKVtmGaJQg5hznSxow5bosQ9+NzhZ72A@mail.gmail.com>
Precedence: bulk

On Mon, Sep 26, 2022 at 04:16:02PM +0200, Ard Biesheuvel wrote:
> On Mon, 26 Sept 2022 at 13:08, Pavel Machek <pavel@denx.de> wrote:
> >
> > Hi!
> >
> > > These structs look like the ideal randomization candidates to the
> > > randstruct plugin (as they only carry function pointers), but of course,
> > > these protocols are contracts between the firmware that exposes them,
> > > and the EFI applications (including our stubbed kernel) that invoke
> > > them. This means that struct randomization for EFI protocols is not a
> > > great idea, and given that the stub shares very little data with the
> > > core kernel that is represented as a randomizable struct, we're better
> > > off just disabling it completely here.
> >
> > > Cc: <stable@vger.kernel.org> # v4.14+
> >
> > AFAICT RANDSTRUCT_CFLAGS is not available in v4.19, so we should not
> > take this patch.
> >
> 
> Ugh, as it turns out, this macro doesn't exist before v5.19 so it
> should not be backported beyond that version at all.
> 
> Greg, can you please drop this patch from all the -stable trees except
> v5.19? Thanks, and apologies for creating confusion.

Now dropped from the 4.14, 4.19, and 5.4 queues, it is already in the
5.10 release.

thanks,

greg k-h