False positive on CONFIG_REFCOUNT_FULL in recent 5.4.x kernels about kernel-hardening-checker

[a13xp0p0v]

Hello @hlein,

Thanks for your comment!

The REFCOUNT_FULL config option was removed from the mainline in the commit fb041bb7c0a918b95c6889fc965cdc4a75b4c0ca

This commit appeared in the mainline kernel v5.5-rc1:

$ cd linux/
$ git describe --match 'v*' --contains fb041bb7c0a918b95c6889fc965cdc4a75b4c0ca
v5.5-rc1~149^2~2

The commit d0d583484d2ed9f5903edbbfa7e2a68f78b950b0 is the backport of the upstream commit to the stable branch:

$ cd linux-stable/
$ git describe --match 'v*' --contains d0d583484d2ed9f5903edbbfa7e2a68f78b950b0
v5.4.208~21

I didn't find backports of this commit to other stable branches.

So, technically, it's not wrong to say that REFCOUNT_FULL was removed in v5.4.208 :)

I'll take a look at your pull request. Thanks a lot!

[a13xp0p0v]

Hello @hlein,

I've implemented parsing all three numbers of the kernel version.

Let's see how it works for CONFIG_REFCOUNT_FULL now:

$ diff config207 config208
3c3
< # Linux/x86 5.4.207 Kernel Configuration
---
> # Linux/x86 5.4.208 Kernel Configuration
709,710d708
< CONFIG_ARCH_HAS_REFCOUNT=y
< # CONFIG_REFCOUNT_FULL is not set

The tool gives the correct output for Linux v5.4.207:

[+] Special report mode: verbose
[+] Kconfig file to check: /home/a13x/develop_local/linux-stable/linux-stable/config207
[+] Detected microarchitecture: X86_64
[+] Detected kernel version: (5, 4, 207)
...
-------------------------------------------------------------------------------------------------------------------------
    <<< OR >>>                                                                             | FAIL: "is not set"
CONFIG_REFCOUNT_FULL                    |kconfig|     y      |defconfig | self_protection  | FAIL: "is not set"
kernel version >= (5, 4, 208)                                                              | FAIL: version < (5, 4, 208)
-------------------------------------------------------------------------------------------------------------------------

And for Linux v5.4.208:

[+] Special report mode: verbose
[+] Kconfig file to check: /home/a13x/develop_local/linux-stable/linux-stable/config208
[+] Detected microarchitecture: X86_64
[+] Detected kernel version: (5, 4, 208)
...
-------------------------------------------------------------------------------------------------------------------------
    <<< OR >>>                                                                             | OK: version >= (5, 4, 208)
CONFIG_REFCOUNT_FULL                    |kconfig|     y      |defconfig | self_protection  | FAIL: is not found
kernel version >= (5, 4, 208)                                                              | OK: version >= (5, 4, 208)
-------------------------------------------------------------------------------------------------------------------------

CC #89

[hlein]

Great, thank you!