diff options
| author | Masami Hiramatsu <mhiramat@kernel.org> | 2023-07-11 04:50:58 +0300 |
|---|---|---|
| committer | Peter Zijlstra <peterz@infradead.org> | 2023-08-02 17:27:07 +0300 |
| commit | b65413768abd27a55af74945aec58127a52b30a8 (patch) | |
| tree | 1d9c2172862d662d72a06ad9d5251bc9b152ac1e /include/linux/cfi.h | |
| parent | d7114f83ee051dfeac82546d7ba03d74f8b92af3 (diff) | |
| download | linux-b65413768abd27a55af74945aec58127a52b30a8.tar.xz | |
x86/kprobes: Prohibit probing on compiler generated CFI checking code
Prohibit probing on the compiler generated CFI typeid checking code
because it is used for decoding typeid when CFI error happens.
The compiler generates the following instruction sequence for indirect
call checks on x86;
movl -<id>, %r10d ; 6 bytes
addl -4(%reg), %r10d ; 4 bytes
je .Ltmp1 ; 2 bytes
ud2 ; <- regs->ip
And handle_cfi_failure() decodes these instructions (movl and addl)
for the typeid and the target address. Thus if we put a kprobe on
those instructions, the decode will fail and report a wrong typeid
and target address.
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/168904025785.116016.12766408611437534723.stgit@devnote2
Diffstat (limited to 'include/linux/cfi.h')
| -rw-r--r-- | include/linux/cfi.h | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/include/linux/cfi.h b/include/linux/cfi.h index 5e134f4ce8b7..3552ec82b725 100644 --- a/include/linux/cfi.h +++ b/include/linux/cfi.h @@ -19,11 +19,13 @@ static inline enum bug_trap_type report_cfi_failure_noaddr(struct pt_regs *regs, { return report_cfi_failure(regs, addr, NULL, 0); } +#endif /* CONFIG_CFI_CLANG */ #ifdef CONFIG_ARCH_USES_CFI_TRAPS bool is_cfi_trap(unsigned long addr); +#else +static inline bool is_cfi_trap(unsigned long addr) { return false; } #endif -#endif /* CONFIG_CFI_CLANG */ #ifdef CONFIG_MODULES #ifdef CONFIG_ARCH_USES_CFI_TRAPS |