Since commit b2250d63e6422 ("x86/kcfi: Optimize call sequence"), a
CONFIG_FINEIBT=y kernel running in kCFI mode rewrites each kCFI call
site at boot so that a failed check traps on the 0xd6 byte of
"test $0xd6, %al", one byte past where the compiler's "ud2" was.
handle_cfi_failure() steps "addr" back one byte to find the trap in
.kcfi_traps, but decode_cfi_insn() still decodes from regs->ip, so it
reads each instruction starting at its second byte.
"movl $-<id>, %r10d" then decodes as "movl $-<id>, %edx", so the
reported type is right by accident, but "addl -15(%r11), %r10d" decodes
as "addl -15(%rbx), %edx", so the reported target is whatever %rbx holds:
CFI failure at lkdtm_indirect_call+0x16/0x20 (target: 0x12; expected type:
0xc79a2d1b)
Pass the adjusted address to decode_cfi_insn() and decode from it.
Tested ARCH=x86_64 defconfig with CONFIG_CFI=y and CONFIG_LKDTM=y under
QEMU, with LKDTM's CFI_FORWARD_PROTO and both Clang 24.0.0git and GCC
17.0.0 (experimental, with the kCFI series). With CONFIG_FINEIBT=y in
kCFI mode, the report gives %rbx as the target without this change, and
the expected lkdtm_increment_int() with it. With cfi=fineibt, with
cfi=fineibt,paranoid, and with CONFIG_FINEIBT=n, it gives
lkdtm_increment_int() both with and without this change.
Fixes: b2250d63e6422 ("x86/kcfi: Optimize call sequence")
Assisted-by: LLM
Signed-off-by: Kees Cook <[email protected]>
---
arch/x86/kernel/cfi.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/arch/x86/kernel/cfi.c b/arch/x86/kernel/cfi.c
index 1df26dfdce08..8e5c4ed264a0 100644
--- a/arch/x86/kernel/cfi.c
+++ b/arch/x86/kernel/cfi.c
@@ -10,11 +10,11 @@
#include <asm/insn-eval.h>
/*
- * Returns the target address and the expected type when regs->ip points
+ * Returns the target address and the expected type when addr points
* to a compiler-generated CFI trap.
*/
-static bool decode_cfi_insn(struct pt_regs *regs, unsigned long *target,
- u32 *type)
+static bool decode_cfi_insn(struct pt_regs *regs, unsigned long addr,
+ unsigned long *target, u32 *type)
{
char buffer[MAX_INSN_SIZE];
struct insn insn;
@@ -29,13 +29,13 @@ static bool decode_cfi_insn(struct pt_regs *regs, unsigned
long *target,
* movl -<id>, %r10d ; 6 bytes
* addl -<pos>(%reg), %r10d; 4 bytes
* je .Ltmp1 ; 2 bytes
- * ud2 ; <- regs->ip
+ * ud2 ; <- addr
* .Ltmp1:
*
* We can decode the expected type and the target address from the
* movl/addl instructions.
*/
- if (copy_from_kernel_nofault(buffer, (void *)regs->ip - 12,
MAX_INSN_SIZE))
+ if (copy_from_kernel_nofault(buffer, (void *)addr - 12, MAX_INSN_SIZE))
return false;
if (insn_decode_kernel(&insn, &buffer[offset]))
return false;
@@ -44,7 +44,7 @@ static bool decode_cfi_insn(struct pt_regs *regs, unsigned
long *target,
*type = -(u32)insn.immediate.value;
- if (copy_from_kernel_nofault(buffer, (void *)regs->ip - 6,
MAX_INSN_SIZE))
+ if (copy_from_kernel_nofault(buffer, (void *)addr - 6, MAX_INSN_SIZE))
return false;
if (insn_decode_kernel(&insn, &buffer[offset]))
return false;
@@ -82,7 +82,7 @@ enum bug_trap_type handle_cfi_failure(struct pt_regs *regs)
return BUG_TRAP_TYPE_NONE;
}
- if (!decode_cfi_insn(regs, &target, &type))
+ if (!decode_cfi_insn(regs, addr, &target, &type))
return report_cfi_failure_noaddr(regs, addr);
break;
--
2.55.0
