mm: security: Move hardened usercopy under 'Kernel hardening options'

There is a submenu for 'Kernel hardening options' under "Security".
Move HARDENED_USERCOPY under the hardening options as it is clearly
related.

Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
Acked-by: Paul Moore <paul@paul-moore.com>
Link: https://lore.kernel.org/r/20250123221115.19722-2-mgorman@techsingularity.net
Signed-off-by: Kees Cook <kees@kernel.org>

diff --git a/security/Kconfig b/security/Kconfig
index f10dbf15c29479da6b9c8c84052731f12c01dedd..38ad111e07d0db47e08b929d21b22c9c763af838 100644 (file)
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -164,18 +164,6 @@ config LSM_MMAP_MIN_ADDR
          this low address space will need the permission specific to the
          systems running LSM.
 
-config HARDENED_USERCOPY
-       bool "Harden memory copies between kernel and userspace"
-       imply STRICT_DEVMEM
-       help
-         This option checks for obviously wrong memory regions when
-         copying memory to/from the kernel (via copy_to_user() and
-         copy_from_user() functions) by rejecting memory ranges that
-         are larger than the specified heap object, span multiple
-         separately allocated pages, are not on the process stack,
-         or are part of the kernel text. This prevents entire classes
-         of heap overflow exploits and similar kernel memory exposures.
-
 config FORTIFY_SOURCE
        bool "Harden common str/mem functions against buffer overflows"
        depends on ARCH_HAS_FORTIFY_SOURCE

diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening
index b56e001e0c6a95331a845413a945d94bf48f1ebe..9f1bea733523ed62a1443ef90343f9c7adf9581a 100644 (file)
--- a/security/Kconfig.hardening
+++ b/security/Kconfig.hardening
@@ -280,6 +280,22 @@ config ZERO_CALL_USED_REGS
 
 endmenu
 
+menu "Bounds checking"
+
+config HARDENED_USERCOPY
+       bool "Harden memory copies between kernel and userspace"
+       imply STRICT_DEVMEM
+       help
+         This option checks for obviously wrong memory regions when
+         copying memory to/from the kernel (via copy_to_user() and
+         copy_from_user() functions) by rejecting memory ranges that
+         are larger than the specified heap object, span multiple
+         separately allocated pages, are not on the process stack,
+         or are part of the kernel text. This prevents entire classes
+         of heap overflow exploits and similar kernel memory exposures.
+
+endmenu
+
 menu "Hardening of kernel data structures"
 
 config LIST_HARDENED