Re: [PATCH] lkdtm: Make UNSET_SMEP built-in-only and unexport native_write_cr4()

[Kees Cook]

On Wed, 14 Oct 2026 13:58:59 -0400, Dennis Chen wrote:
> native_write_cr4 should not be exported to modules. Commit 21953ee5013d
> ("x86/cpu: Export native_write_cr4() only when CONFIG_LKTDM=m")
> restricted the export somewhat, but native_write_cr4() is still exposed
> to all GPL-compatible modules when CONFIG_LKDTM=m.
> 
> UNSET_SMEP is the only module user of native_write_cr4(). Restrict
> the test to CONFIG_LKDTM=y and remove the export. When LKDTM is
> built as a module, report XFAIL for UNSET_SMEP.
> 
> [...]

Applied to for-next/hardening, thanks!

[1/1] lkdtm: Make UNSET_SMEP built-in-only and unexport native_write_cr4()
      https://git.kernel.org/kees/c/e2cd253cb31b

Take care,

-- 
Kees Cook