kybaaz/linux-xiaomi-chiron
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

cfi: Switch to -fsanitize=kcfi

Browse source 
Switch from Clang's original forward-edge control-flow integrity
implementation to -fsanitize=kcfi, which is better suited for the
kernel, as it doesn't require LTO, doesn't use a jump table that
requires altering function references, and won't break cross-module
function address equality.

Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Tested-by: Kees Cook <keescook@chromium.org>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Tested-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20220908215504.3686827-6-samitolvanen@google.com
This commit is contained in:
Sami Tolvanen 2022-09-08 14:54:47 -07:00 • committed by Kees Cook
parent 92efda8eb1
commit 8924560094
9 changed files with 139 additions and 182 deletions
Download patch file Download diff file Expand all files Collapse all files

29
include/linux/cfi.h
View file

@ -2,17 +2,38 @@
/*
* Clang Control Flow Integrity (CFI) support.
*
* Copyright (C) 2021 Google LLC
* Copyright (C) 2022 Google LLC
*/
#ifndef _LINUX_CFI_H
#define _LINUX_CFI_H
#include <linux/bug.h>
#include <linux/module.h>
#ifdef CONFIG_CFI_CLANG
typedef void (*cfi_check_fn)(uint64_t id, void *ptr, void *diag);
enum bug_trap_type report_cfi_failure(struct pt_regs *regs, unsigned long addr,
unsigned long *target, u32 type);
/* Compiler-generated function in each module, and the kernel */
extern void __cfi_check(uint64_t id, void *ptr, void *diag);
static inline enum bug_trap_type report_cfi_failure_noaddr(struct pt_regs *regs,
unsigned long addr)
{
return report_cfi_failure(regs, addr, NULL, 0);
}
#ifdef CONFIG_ARCH_USES_CFI_TRAPS
bool is_cfi_trap(unsigned long addr);
#endif
#endif /* CONFIG_CFI_CLANG */
#ifdef CONFIG_MODULES
#ifdef CONFIG_ARCH_USES_CFI_TRAPS
void module_cfi_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
struct module *mod);
#else
static inline void module_cfi_finalize(const Elf_Ehdr *hdr,
const Elf_Shdr *sechdrs,
struct module *mod) {}
#endif /* CONFIG_ARCH_USES_CFI_TRAPS */
#endif /* CONFIG_MODULES */
#endif /* _LINUX_CFI_H */

14
include/linux/compiler-clang.h
View file

@ -66,17 +66,9 @@
# define __noscs __attribute__((__no_sanitize__("shadow-call-stack")))
#endif
#define __nocfi __attribute__((__no_sanitize__("cfi")))
#define __cficanonical __attribute__((__cfi_canonical_jump_table__))
#if defined(CONFIG_CFI_CLANG)
/*
* With CONFIG_CFI_CLANG, the compiler replaces function address
* references with the address of the function's CFI jump table
* entry. The function_nocfi macro always returns the address of the
* actual function instead.
*/
#define function_nocfi(x) __builtin_function_start(x)
#if __has_feature(kcfi)
/* Disable CFI checking inside a function. */
#define __nocfi __attribute__((__no_sanitize__("kcfi")))
#endif
/*

6
include/linux/module.h
View file

@ -27,7 +27,6 @@
#include <linux/tracepoint-defs.h>
#include <linux/srcu.h>
#include <linux/static_call_types.h>
#include <linux/cfi.h>
#include <linux/percpu.h>
#include <asm/module.h>
@ -387,8 +386,9 @@ struct module {
const s32 *crcs;
unsigned int num_syms;
#ifdef CONFIG_CFI_CLANG
cfi_check_fn cfi_check;
#ifdef CONFIG_ARCH_USES_CFI_TRAPS
s32 *kcfi_traps;
s32 *kcfi_traps_end;
#endif
/* Kernel parameters. */