From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9BC5D269883; Mon, 7 Apr 2025 18:15:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744049714; cv=none; b=qJShggt2Pqr/eBT9Y81QR3F4ojQqViXA7IQRWNOT4biqiX8y0JZ/ZCyBchrirElarZbDWHX5r7vRdmN8w+zYJqCnLBx25LW7rxfHR3d6eEEAM0LvH/58SxxVstl/0KuLFGo5wgO23wnRWFjW4xPUd5OAThOLhE18/KHiTiHG5Io= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744049714; c=relaxed/simple; bh=bJtGJP8sax2ChKbqPETEfAg4bV7UJgYiYMxoNViRgWA=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=TG0rdv4byE69mP4px8c5WEk27JhSPtSkKugy2ss9kIKtE4D0DoWgH73ShVGRxYnyfchrN2PMVk9ls+6uGJ8KESifF+SNYrbalEM0lpncchqJDxvBpqvT+/iOxuspgiPa6CYoEO3qfh8vhCq7uS1KGsvfi8ngqQIU6IOOvVKTCBQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=UEnofkjy; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="UEnofkjy" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 61240C4CEE7; Mon, 7 Apr 2025 18:15:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1744049714; bh=bJtGJP8sax2ChKbqPETEfAg4bV7UJgYiYMxoNViRgWA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UEnofkjyIIfE/m/gtOIlVEZ2aBVAyRdf7r6pTGTCZ1PKcichWE63WggsnSzlK2DGz aGpMAjj1TP7cyyQCPW12UCCvl+s+j5PQWiImJdM4EWIDRbFDzs2I203uMtixBWuELO gSF3ob6kQejbxR30tqXH3D2N5mnAFJifVeVx9z3D15YQNfi3mLRtZf0cpoptwxiKOy 7KVeP9pChX+cvd4dzdl7r9+jW98KW/NpI3DqcXoXqtVYepkoHqMdFbUgHsXD6Uf8sF YXjqQ2I44QaxmTkWm5nWeG58wAQHeMctFu+2LFJ2RtPPM5n/mG8kQG8Ab8y9fjEVpi IhVblXwfb0mnA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Josh Poimboeuf , kernel test robot , Ingo Molnar , Kees Cook , Arnd Bergmann , Greg Kroah-Hartman , Linus Torvalds , Sasha Levin Subject: [PATCH AUTOSEL 6.1 13/13] objtool, lkdtm: Obfuscate the do_nothing() pointer Date: Mon, 7 Apr 2025 14:14:47 -0400 Message-Id: <20250407181449.3183687-13-sashal@kernel.org> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20250407181449.3183687-1-sashal@kernel.org> References: <20250407181449.3183687-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 6.1.133 Content-Transfer-Encoding: 8bit From: Josh Poimboeuf [ Upstream commit 05026ea01e95ffdeb0e5ac8fb7fb1b551e3a8726 ] If execute_location()'s memcpy of do_nothing() gets inlined and unrolled by the compiler, it copies one word at a time: mov 0x0(%rip),%rax R_X86_64_PC32 .text+0x1374 mov %rax,0x38(%rbx) mov 0x0(%rip),%rax R_X86_64_PC32 .text+0x136c mov %rax,0x30(%rbx) ... Those .text references point to the middle of the function, causing objtool to complain about their lack of ENDBR. Prevent that by resolving the function pointer at runtime rather than build time. This fixes the following warning: drivers/misc/lkdtm/lkdtm.o: warning: objtool: execute_location+0x23: relocation to !ENDBR: .text+0x1378 Reported-by: kernel test robot Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Reviewed-by: Kees Cook Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Cc: Linus Torvalds Link: https://lore.kernel.org/r/30b9abffbddeb43c4f6320b1270fa9b4d74c54ed.1742852847.git.jpoimboe@kernel.org Closes: https://lore.kernel.org/oe-kbuild-all/202503191453.uFfxQy5R-lkp@intel.com/ Signed-off-by: Sasha Levin --- drivers/misc/lkdtm/perms.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/misc/lkdtm/perms.c b/drivers/misc/lkdtm/perms.c index b93404d656509..e82d9543a0c5f 100644 --- a/drivers/misc/lkdtm/perms.c +++ b/drivers/misc/lkdtm/perms.c @@ -28,6 +28,13 @@ static const unsigned long rodata = 0xAA55AA55; /* This is marked __ro_after_init, so it should ultimately be .rodata. */ static unsigned long ro_after_init __ro_after_init = 0x55AA5500; +/* + * This is a pointer to do_nothing() which is initialized at runtime rather + * than build time to avoid objtool IBT validation warnings caused by an + * inlined unrolled memcpy() in execute_location(). + */ +static void __ro_after_init *do_nothing_ptr; + /* * This just returns to the caller. It is designed to be copied into * non-executable memory regions. @@ -65,13 +72,12 @@ static noinline void execute_location(void *dst, bool write) { void (*func)(void); func_desc_t fdesc; - void *do_nothing_text = dereference_function_descriptor(do_nothing); - pr_info("attempting ok execution at %px\n", do_nothing_text); + pr_info("attempting ok execution at %px\n", do_nothing_ptr); do_nothing(); if (write == CODE_WRITE) { - memcpy(dst, do_nothing_text, EXEC_SIZE); + memcpy(dst, do_nothing_ptr, EXEC_SIZE); flush_icache_range((unsigned long)dst, (unsigned long)dst + EXEC_SIZE); } @@ -267,6 +273,8 @@ static void lkdtm_ACCESS_NULL(void) void __init lkdtm_perms_init(void) { + do_nothing_ptr = dereference_function_descriptor(do_nothing); + /* Make sure we can write to __ro_after_init values during __init */ ro_after_init |= 0xAA; } -- 2.39.5