UBUNTU: [Config] UNMAP_KERNEL_AT_EL0=y && HARDEN_BRANCH_PREDICTOR=y

CVE-2017-5753
CVE-2017-5715
CVE-2017-5754

Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
Acked-by: Brad Figg <brad.figg@canonical.com>
Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/debian.master/config/arm64/config.common.arm64 b/debian.master/config/arm64/config.common.arm64
index 9567d71e5cc74c849d009e908ca1f74c2629bb04..ec3f512dffb15eb287a7dab2683defb34295ce79 100644 (file)
--- a/debian.master/config/arm64/config.common.arm64
+++ b/debian.master/config/arm64/config.common.arm64
@@ -139,7 +139,7 @@ CONFIG_GPIO_TWL4030=m
 CONFIG_GPIO_TWL6040=m
 # CONFIG_HAVE_AOUT is not set
 CONFIG_HAVE_ARCH_BITREVERSE=y
-# CONFIG_HAVE_ARCH_VMAP_STACK is not set
+CONFIG_HAVE_ARCH_VMAP_STACK=y
 # CONFIG_HAVE_BOOTMEM_INFO_NODE is not set
 CONFIG_HAVE_GENERIC_DMA_COHERENT=y
 CONFIG_HFSPLUS_FS=m

diff --git a/debian.master/config/config.common.ubuntu b/debian.master/config/config.common.ubuntu
index 481eec025f8294cd52aa7428e8c4220a58088146..34025d5d3d68fbcec8803c695445f7aafcfdee8d 100644 (file)
--- a/debian.master/config/config.common.ubuntu
+++ b/debian.master/config/config.common.ubuntu
@@ -537,6 +537,7 @@ CONFIG_ARM64_MODULE_CMODEL_LARGE=y
 CONFIG_ARM64_MODULE_PLTS=y
 CONFIG_ARM64_PAGE_SHIFT=12
 CONFIG_ARM64_PAN=y
+# CONFIG_ARM64_PMEM is not set
 CONFIG_ARM64_PTDUMP_CORE=y
 # CONFIG_ARM64_PTDUMP_DEBUGFS is not set
 # CONFIG_ARM64_RANDOMIZE_TEXT_OFFSET is not set
@@ -3201,6 +3202,7 @@ CONFIG_HANGCHECK_TIMER=m
 CONFIG_HAPPYMEAL=m
 CONFIG_HARDENED_USERCOPY=y
 # CONFIG_HARDENED_USERCOPY_PAGESPAN is not set
+CONFIG_HARDEN_BRANCH_PREDICTOR=y
 CONFIG_HARDIRQS_SW_RESEND=y
 CONFIG_HARDLOCKUP_CHECK_TIMESTAMP=y
 CONFIG_HARDLOCKUP_DETECTOR=y
@@ -9178,6 +9180,7 @@ CONFIG_UNISYS_VISORNIC=m
 CONFIG_UNIX=y
 CONFIG_UNIX98_PTYS=y
 CONFIG_UNIX_DIAG=m
+CONFIG_UNMAP_KERNEL_AT_EL0=y
 CONFIG_UNUSED_SYMBOLS=y
 CONFIG_UNWINDER_FRAME_POINTER=y
 # CONFIG_UNWINDER_GUESS is not set