Skip to content

x86/cfi: Fix a few kCFI issues found with GCC

Kees Cook linux-hardening lkml llvm 1 version Applied

Status from this message: The following commit has been merged into the x86/urgent branch of tip:

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest3 patches 9 repliesApplied

Patches in v1 Applied

#Subject and filesSizeRepliesApplied
1/3x86/kcfi: Decode the kCFI check from the trap addressarch/x86/kernel/cfi.c+7 -70 replies
2/3x86/kcfi: Emit the FineIBT paranoid "cs" prefix as a bytearch/x86/kernel/alternative.c+2 -13 replies
3/3objtool: Skip jump table jumps in the kCFI indirect call checktools/objtool/check.c+8 -06 replies

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.

Read the v1 thread

Cover letter [PATCH 0/3] x86/cfi: Fix a few kCFI issues found with GCC

Hi!

While testing x86 kernels built by GCC with the coming kCFI patches I tripped over three problems. Since the kCFI call sequence was optimized in v7.3-rc1, the trap handler decodes the check one byte off, so a kCFI failure in a CONFIG_FINEIBT=y kernel running in kCFI mode reports whatever %rbx holds as the target, with Clang as well as GCC (1/3). GNU as warns about the "cs" prefix in the FineIBT paranoid caller template, which Clang's integrated assembler accepts silently (2/3). And objtool's kCFI check treats GCC's jump-table jump for the BPF interpreter's computed goto as an unchecked indirect call (3/3).

Thanks!

-Kees

Kees Cook (3):
x86/kcfi: Decode the kCFI check from the trap address x86/kcfi: Emit the FineIBT paranoid "cs" prefix as a byte
objtool: Skip jump table jumps in the kCFI indirect call check

 arch/x86/kernel/alternative.c |  3 ++-
 arch/x86/kernel/cfi.c         | 14 +++++++-------
 tools/objtool/check.c         |  8 ++++++++
 3 files changed, 17 insertions(+), 8 deletions(-)
Signature · 1 line
2.55.0

Read the cover letter in its thread