Re: [PATCH] x86/alternatives: gracefully skip unrecognized indirect call instructions

["Jürgen Groß" <jgross@suse.com>]

[-- Attachment #1.1.1: Type: text/plain, Size: 2462 bytes --]

On 11.08.26 13:41, 李则良 wrote:
>  From cd58bd112a6178593c6bc9c0f9b307d6897ae3d0 Mon Sep 17 00:00:00 2001
> From: Zeliang Li <lizeliang.linux@gmail.com <mailto:lizeliang.linux@gmail.com>>
> Date: Tue, 11 Aug 2026 19:09:09 +0800
> Subject: [PATCH] x86/alternatives: gracefully skip unrecognized indirect call
>   instructions
> 
> When the kernel is compiled at a non-default optimization level
> (e.g., KCFLAGS=-O1), the compiler may emit call instruction
> patterns that differ from the expected 6-byte sequence
> (opcodes 0xff 0x15 followed by a 32-bit displacement) checked
> by alt_replace_call().
> 
> Currently this triggers a BUG() in apply_alternatives(), causing
> an immediate kernel panic during early boot:
> 
>    kernel BUG at arch/x86/kernel/alternative.c:558!
> 
> Instead of crashing, print a warning (once per boot) and preserve
> the original call instruction verbatim. The call will execute as
> compiled, without any alternatives patching applied. This is a
> graceful degradation: the indirect call remains indirect, which is
> functionally correct albeit slower than the direct-call patching
> that was skipped.
> 
> No change to normal -O2 builds, where call instructions continue
> to match the expected pattern.
> 
> Signed-off-by: Zeliang Li <lizeliang.linux@gmail.com 
> <mailto:lizeliang.linux@gmail.com>>

Please don't send patches as HTML mails!

> ---
>   arch/x86/kernel/alternative.c | 11 +++++++++--
>   1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
> index 62936a3bde19..0e3903e76b55 100644
> --- a/arch/x86/kernel/alternative.c
> +++ b/arch/x86/kernel/alternative.c
> @@ -554,8 +554,15 @@ static unsigned int alt_replace_call(u8 *instr, u8 
> *insn_buff, struct alt_instr
>    if (a->instrlen != 6 ||
>       instr[0] != CALL_RIP_REL_OPCODE ||
>       instr[1] != CALL_RIP_REL_MODRM) {
> - pr_err("ALT_FLAG_DIRECT_CALL set for unrecognized indirect call\n");
> - BUG();
> + static bool warned;
> +
> + if (!warned) {
> + warned = true;
> + pr_warn("%s: skipping unrecognized indirect call (instrlen=%d)\n",
> + __func__, a->instrlen);
> + }

You are open coding pr_warn_once() here.

> + memcpy(insn_buff, instr, a->instrlen);
> + return a->instrlen;

And now you are letting an indirect call survive which is not subject to
any cpu bug mitigations.


Juergen


[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3743 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]