Merge tag 'hardening-v6.5-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel...

Pull hardening fixes from Kees Cook:

 - Check for NULL bdev in LoadPin (Matthias Kaehlcke)

 - Revert unwanted KUnit FORTIFY build default

 - Fix 1-element array causing boot warnings with xhci-hub

* tag 'hardening-v6.5-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  usb: ch9: Replace bmSublinkSpeedAttr 1-element array with flexible array
  Revert "fortify: Allow KUnit test to build without FORTIFY"
  dm: verity-loadpin: Add NULL pointer check for 'bdev' parameter

diff --combined include/uapi/linux/usb/ch9.h
index 82ec6af71a1d11c89fea07fceff5f4e49d2911f0,3ff98c7ba7e3f6d5877dae251a3b86bd20d1a49d..62d318377379e1b03869db1256781cf33ff28c4a
--- 1/include/uapi/linux/usb/ch9.h
--- 2/include/uapi/linux/usb/ch9.h
+++ b/include/uapi/linux/usb/ch9.h
@@@ -376,10 -376,7 +376,10 @@@ struct usb_string_descriptor 
        __u8  bLength;
        __u8  bDescriptorType;
  
 -      __le16 wData[1];                /* UTF-16LE encoded */
 +      union {
 +              __le16 legacy_padding;
 +              __DECLARE_FLEX_ARRAY(__le16, wData);    /* UTF-16LE encoded */
 +      };
  } __attribute__ ((packed));
  
  /* note that "string" zero is special, it holds language codes that
@@@ -984,7 -981,11 +984,11 @@@ struct usb_ssp_cap_descriptor 
  #define USB_SSP_MIN_RX_LANE_COUNT             (0xf << 8)
  #define USB_SSP_MIN_TX_LANE_COUNT             (0xf << 12)
        __le16 wReserved;
-       __le32 bmSublinkSpeedAttr[1]; /* list of sublink speed attrib entries */
+       union {
+               __le32 legacy_padding;
+               /* list of sublink speed attrib entries */
+               __DECLARE_FLEX_ARRAY(__le32, bmSublinkSpeedAttr);
+       };
  #define USB_SSP_SUBLINK_SPEED_SSID    (0xf)           /* sublink speed ID */
  #define USB_SSP_SUBLINK_SPEED_LSE     (0x3 << 4)      /* Lanespeed exponent */
  #define USB_SSP_SUBLINK_SPEED_LSE_BPS         0

diff --combined lib/Kconfig.debug
index 781f061ec0fa72ec053e6b2a2b77d09564e10a94,6c6a7ee9f1f939bc3a99d4517d354e469bbf16da..fbc89baf7de645c12f137ba488acf16963e9f249
--- 1/lib/Kconfig.debug
--- 2/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@@ -1035,30 -1035,27 +1035,30 @@@ config BOOTPARAM_SOFTLOCKUP_PANI
  
          Say N if unsure.
  
 -config HARDLOCKUP_DETECTOR_PERF
 +config HAVE_HARDLOCKUP_DETECTOR_BUDDY
        bool
 -      select SOFTLOCKUP_DETECTOR
 +      depends on SMP
 +      default y
  
  #
 -# Enables a timestamp based low pass filter to compensate for perf based
 -# hard lockup detection which runs too fast due to turbo modes.
 +# Global switch whether to build a hardlockup detector at all. It is available
 +# only when the architecture supports at least one implementation. There are
 +# two exceptions. The hardlockup detector is never enabled on:
  #
 -config HARDLOCKUP_CHECK_TIMESTAMP
 -      bool
 -
 +#     s390: it reported many false positives there
  #
 -# arch/ can define HAVE_HARDLOCKUP_DETECTOR_ARCH to provide their own hard
 -# lockup detector rather than the perf based detector.
 +#     sparc64: has a custom implementation which is not using the common
 +#             hardlockup command line options and sysctl interface.
  #
  config HARDLOCKUP_DETECTOR
        bool "Detect Hard Lockups"
 -      depends on DEBUG_KERNEL && !S390
 -      depends on HAVE_HARDLOCKUP_DETECTOR_PERF || HAVE_HARDLOCKUP_DETECTOR_ARCH
 +      depends on DEBUG_KERNEL && !S390 && !HARDLOCKUP_DETECTOR_SPARC64
 +      depends on HAVE_HARDLOCKUP_DETECTOR_PERF || HAVE_HARDLOCKUP_DETECTOR_BUDDY || HAVE_HARDLOCKUP_DETECTOR_ARCH
 +      imply HARDLOCKUP_DETECTOR_PERF
 +      imply HARDLOCKUP_DETECTOR_BUDDY
 +      imply HARDLOCKUP_DETECTOR_ARCH
        select LOCKUP_DETECTOR
 -      select HARDLOCKUP_DETECTOR_PERF if HAVE_HARDLOCKUP_DETECTOR_PERF
 +
        help
          Say Y here to enable the kernel to act as a watchdog to detect
          hard lockups.
@@@ -1068,63 -1065,6 +1068,63 @@@
          chance to run.  The current stack trace is displayed upon detection
          and the system will stay locked up.
  
 +#
 +# Note that arch-specific variants are always preferred.
 +#
 +config HARDLOCKUP_DETECTOR_PREFER_BUDDY
 +      bool "Prefer the buddy CPU hardlockup detector"
 +      depends on HARDLOCKUP_DETECTOR
 +      depends on HAVE_HARDLOCKUP_DETECTOR_PERF && HAVE_HARDLOCKUP_DETECTOR_BUDDY
 +      depends on !HAVE_HARDLOCKUP_DETECTOR_ARCH
 +      help
 +        Say Y here to prefer the buddy hardlockup detector over the perf one.
 +
 +        With the buddy detector, each CPU uses its softlockup hrtimer
 +        to check that the next CPU is processing hrtimer interrupts by
 +        verifying that a counter is increasing.
 +
 +        This hardlockup detector is useful on systems that don't have
 +        an arch-specific hardlockup detector or if resources needed
 +        for the hardlockup detector are better used for other things.
 +
 +config HARDLOCKUP_DETECTOR_PERF
 +      bool
 +      depends on HARDLOCKUP_DETECTOR
 +      depends on HAVE_HARDLOCKUP_DETECTOR_PERF && !HARDLOCKUP_DETECTOR_PREFER_BUDDY
 +      depends on !HAVE_HARDLOCKUP_DETECTOR_ARCH
 +      select HARDLOCKUP_DETECTOR_COUNTS_HRTIMER
 +
 +config HARDLOCKUP_DETECTOR_BUDDY
 +      bool
 +      depends on HARDLOCKUP_DETECTOR
 +      depends on HAVE_HARDLOCKUP_DETECTOR_BUDDY
 +      depends on !HAVE_HARDLOCKUP_DETECTOR_PERF || HARDLOCKUP_DETECTOR_PREFER_BUDDY
 +      depends on !HAVE_HARDLOCKUP_DETECTOR_ARCH
 +      select HARDLOCKUP_DETECTOR_COUNTS_HRTIMER
 +
 +config HARDLOCKUP_DETECTOR_ARCH
 +      bool
 +      depends on HARDLOCKUP_DETECTOR
 +      depends on HAVE_HARDLOCKUP_DETECTOR_ARCH
 +      help
 +        The arch-specific implementation of the hardlockup detector will
 +        be used.
 +
 +#
 +# Both the "perf" and "buddy" hardlockup detectors count hrtimer
 +# interrupts. This config enables functions managing this common code.
 +#
 +config HARDLOCKUP_DETECTOR_COUNTS_HRTIMER
 +      bool
 +      select SOFTLOCKUP_DETECTOR
 +
 +#
 +# Enables a timestamp based low pass filter to compensate for perf based
 +# hard lockup detection which runs too fast due to turbo modes.
 +#
 +config HARDLOCKUP_CHECK_TIMESTAMP
 +      bool
 +
  config BOOTPARAM_HARDLOCKUP_PANIC
        bool "Panic (Reboot) On Hard Lockups"
        depends on HARDLOCKUP_DETECTOR
@@@ -1194,19 -1134,6 +1194,19 @@@ config WQ_WATCHDO
          state.  This can be configured through kernel parameter
          "workqueue.watchdog_thresh" and its sysfs counterpart.
  
 +config WQ_CPU_INTENSIVE_REPORT
 +      bool "Report per-cpu work items which hog CPU for too long"
 +      depends on DEBUG_KERNEL
 +      help
 +        Say Y here to enable reporting of concurrency-managed per-cpu work
 +        items that hog CPUs for longer than
 +        workqueue.cpu_intensive_threshold_us. Workqueue automatically
 +        detects and excludes them from concurrency management to prevent
 +        them from stalling other per-cpu work items. Occassional
 +        triggering may not necessarily indicate a problem. Repeated
 +        triggering likely indicates that the work item should be switched
 +        to use an unbound workqueue.
 +
  config TEST_LOCKUP
        tristate "Test module to generate lockups"
        depends on m
@@@ -2375,13 -2302,9 +2375,13 @@@ config TEST_XARRA
        tristate "Test the XArray code at runtime"
  
  config TEST_MAPLE_TREE
 -      depends on DEBUG_KERNEL
 -      select DEBUG_MAPLE_TREE
 -      tristate "Test the Maple Tree code at runtime"
 +      tristate "Test the Maple Tree code at runtime or module load"
 +      help
 +        Enable this option to test the maple tree code functions at boot, or
 +        when the module is loaded. Enable "Debug Maple Trees" will enable
 +        more verbose output on failures.
 +
 +        If unsure, say N.
  
  config TEST_RHASHTABLE
        tristate "Perform selftest on resizable hash table"
@@@ -2530,23 -2453,6 +2530,23 @@@ config BITFIELD_KUNI
  
          If unsure, say N.
  
 +config CHECKSUM_KUNIT
 +      tristate "KUnit test checksum functions at runtime" if !KUNIT_ALL_TESTS
 +      depends on KUNIT
 +      default KUNIT_ALL_TESTS
 +      help
 +        Enable this option to test the checksum functions at boot.
 +
 +        KUnit tests run during boot and output the results to the debug log
 +        in TAP format (http://testanything.org/). Only useful for kernel devs
 +        running the KUnit test harness, and not intended for inclusion into a
 +        production build.
 +
 +        For more information on KUnit and unit tests in general please refer
 +        to the KUnit documentation in Documentation/dev-tools/kunit/.
 +
 +        If unsure, say N.
 +
  config HASH_KUNIT_TEST
        tristate "KUnit Test for integer hash functions" if !KUNIT_ALL_TESTS
        depends on KUNIT
@@@ -2739,7 -2645,7 +2739,7 @@@ config STACKINIT_KUNIT_TES
  
  config FORTIFY_KUNIT_TEST
        tristate "Test fortified str*() and mem*() function internals at runtime" if !KUNIT_ALL_TESTS
-       depends on KUNIT
+       depends on KUNIT && FORTIFY_SOURCE
        default KUNIT_ALL_TESTS
        help
          Builds unit tests for checking internals of FORTIFY_SOURCE as used