From 75467f60a3d14f08f86f2b353298d2826382ff23 Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Fri, 25 Sep 2026 15:55:03 -0700 Subject: Merge tag 'ipe-pr-20260925' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe Pull IPE fixes from Fan Wu: "Two fixes for use-after-free issues found by recent LLM-assisted code analysis. - move successful policy load auditing under the new policy directory's inode lock, preventing a concurrent policy deletion from freeing the policy while it is still being audited - protect the dm-verity root hash with RCU, preventing policy evaluation from racing with root hash replacement during preresume" * tag 'ipe-pr-20260925' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe: ipe: protect the dm-verity root hash with RCU ipe: fix use-after-free when auditing a newly loaded policy --- usr/initramfs_data.S | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 usr/initramfs_data.S (limited to 'usr/initramfs_data.S') diff --git a/usr/initramfs_data.S b/usr/initramfs_data.S new file mode 100644 index 000000000..e92fb59b3 --- /dev/null +++ b/usr/initramfs_data.S @@ -0,0 +1,36 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + initramfs_data includes the compressed binary that is the + filesystem used for early user space. + Note: Older versions of "as" (prior to binutils 2.11.90.0.23 + released on 2001-07-14) did not support .incbin. + If you are forced to use older binutils than that then the + following trick can be applied to create the resulting binary: + + + ld -m elf_i386 --format binary --oformat elf32-i386 -r \ + -T initramfs_data.scr initramfs_data.cpio.gz -o initramfs_data.o + ld -m elf_i386 -r -o built-in.a initramfs_data.o + + For including the .init.ramfs sections, see include/asm-generic/vmlinux.lds. + + The above example is for i386 - the parameters vary from architectures. + Eventually look up LDFLAGS_BLOB in an older version of the + arch/$(ARCH)/Makefile to see the flags used before .incbin was introduced. + + Using .incbin has the advantage over ld that the correct flags are set + in the ELF header, as required by certain architectures. +*/ + +.section .init.ramfs,"a" +__irf_start: +.incbin "usr/initramfs_inc_data" +__irf_end: +.section .init.ramfs.info,"a" +.globl __initramfs_size +__initramfs_size: +#ifdef CONFIG_64BIT + .quad __irf_end - __irf_start +#else + .long __irf_end - __irf_start +#endif -- cgit v1.3.1