Merge tag 'gcc-plugins-v4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull structure randomization updates from Kees Cook:
 "Now that IPC and other changes have landed, enable manual markings for
  randstruct plugin, including the task_struct.

  This is the rest of what was staged in -next for the gcc-plugins, and
  comes in three patches, largest first:

   - mark "easy" structs with __randomize_layout

   - mark task_struct with an optional anonymous struct to isolate the
     __randomize_layout section

   - mark structs to opt _out_ of automated marking (which will come
     later)

  And, FWIW, this continues to pass allmodconfig (normal and patched to
  enable gcc-plugins) builds of x86_64, i386, arm64, arm, powerpc, and
  s390 for me"

* tag 'gcc-plugins-v4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  randstruct: opt-out externally exposed function pointer structs
  task_struct: Allow randomized layout
  randstruct: Mark various structs for randomization

1 files changed, 15 insertions, 1 deletions

diff --git a/include/linux/sched.h b/include/linux/sched.h
index 2ba9ec93423f..8337e2db0bb2 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -426,7 +426,7 @@ struct sched_rt_entity {
         /* rq "owned" by this entity/group: */
         struct rt_rq                    *my_q;
 #endif
-};
+} __randomize_layout;
 
 struct sched_dl_entity {
         struct rb_node                  rb_node;
@@ -526,6 +526,13 @@ struct task_struct {
 #endif
         /* -1 unrunnable, 0 runnable, >0 stopped: */
         volatile long                   state;
+
+        /*
+         * This begins the randomizable portion of task_struct. Only
+         * scheduling-critical items should be added above here.
+         */
+        randomized_struct_fields_start
+
         void                            *stack;
         atomic_t                        usage;
         /* Per task flags (PF_*), defined further below: */
@@ -1079,6 +1086,13 @@ struct task_struct {
         /* Used by LSM modules for access restriction: */
         void                            *security;
 #endif
+
+        /*
+         * New fields for task_struct should be added above here, so that
+         * they are included in the randomized portion of task_struct.
+         */
+        randomized_struct_fields_end
+
         /* CPU-specific state of this task: */
         struct thread_struct            thread;