Hi! While testing x86 kernels built by GCC with the coming kCFI patches I tripped over three problems. Since the kCFI call sequence was optimized in v7.3-rc1, the trap handler decodes the check one byte off, so a kCFI failure in a CONFIG_FINEIBT=y kernel running in kCFI mode reports whatever %rbx holds as the target, with Clang as well as GCC (1/3). GNU as warns about the "cs" prefix in the FineIBT paranoid caller template, which Clang's integrated assembler accepts silently (2/3). And objtool's kCFI check treats GCC's jump-table jump for the BPF interpreter's computed goto as an unchecked indirect call (3/3).
Thanks! -Kees Kees Cook (3): x86/kcfi: Decode the kCFI check from the trap address x86/kcfi: Emit the FineIBT paranoid "cs" prefix as a byte objtool: Skip jump table jumps in the kCFI indirect call check arch/x86/kernel/alternative.c | 3 ++- arch/x86/kernel/cfi.c | 14 +++++++------- tools/objtool/check.c | 8 ++++++++ 3 files changed, 17 insertions(+), 8 deletions(-) -- 2.55.0
