[PATCH v4 04/15] cfi: Add DEFINE_CFI_IMMEDIATE_RETURN_STUB

Sami Tolvanen
2021-09-30T18:05:48Z

This change introduces the DEFINE_CFI_IMMEDIATE_RETURN_STUB macro,
which defines a stub function that immediately returns and when
defined in the core kernel, always passes indirect call checking
with CONFIG_CFI_CLANG. Note that this macro should only be used when
a stub cannot be called using the correct function type.

Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
---
include/asm-generic/vmlinux.lds.h | 11 +++++++++++
include/linux/cfi.h | 13 +++++++++++++
kernel/cfi.c | 24 +++++++++++++++++++++++-
3 files changed, 47 insertions(+), 1 deletion(-)

diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index f2984af2b85b..5b77284f7221 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -407,6 +407,16 @@
KEEP(*(.static_call_tramp_key)) \
__stop_static_call_tramp_key = .;

+#ifdef CONFIG_CFI_CLANG
+#define CFI_EXCLUDED_DATA \
+ . = ALIGN(8); \
+ __start_cfi_excluded = .; \
+ KEEP(*(.cfi_excluded_stubs)) \
+ __stop_cfi_excluded = .;
+#else
+#define CFI_EXCLUDED_DATA
+#endif
+
/*
* Allow architectures to handle ro_after_init data on their
* own by defining an empty RO_AFTER_INIT_DATA.
@@ -430,6 +440,7 @@
__start_rodata = .; \
*(.rodata) *(.rodata.*) \
SCHED_DATA \
+ CFI_EXCLUDED_DATA \
RO_AFTER_INIT_DATA /* Read only after init */ \
. = ALIGN(8); \
__start___tracepoints_ptrs = .; \
diff --git a/include/linux/cfi.h b/include/linux/cfi.h
index 879744aaa6e0..19f74af8eac2 100644
--- a/include/linux/cfi.h
+++ b/include/linux/cfi.h
@@ -20,6 +20,17 @@ extern void __cfi_check(uint64_t id, void *ptr, void *diag);
#define __CFI_ADDRESSABLE(fn, __attr) \
const void *__cfi_jt_ ## fn __visible __attr = (void *)&fn

+/*
+ * Defines a stub function that returns immediately, and when defined and
+ * referenced in the core kernel, always passes CFI checking. This should
+ * be used only for stubs that cannot be called using the correct function
+ * pointer type, which should be rare.
+ */
+#define DEFINE_CFI_IMMEDIATE_RETURN_STUB(fn) \
+ void fn(void) { return; } \
+ const void *__cfi_excl_ ## fn __visible \
+ __section(".cfi_excluded_stubs") = (void *)&fn
+
#ifdef CONFIG_CFI_CLANG_SHADOW

extern void cfi_module_add(struct module *mod, unsigned long base_addr);
@@ -35,6 +46,8 @@ static inline void cfi_module_remove(struct module *mod, unsigned long base_addr
#else /* !CONFIG_CFI_CLANG */

#define __CFI_ADDRESSABLE(fn, __attr)
+#define DEFINE_CFI_IMMEDIATE_RETURN_STUB(fn) \
+ void fn(void) { return; }

#endif /* CONFIG_CFI_CLANG */

diff --git a/kernel/cfi.c b/kernel/cfi.c
index 9594cfd1cf2c..8d931089141b 100644
--- a/kernel/cfi.c
+++ b/kernel/cfi.c
@@ -278,12 +278,34 @@ static inline cfi_check_fn find_module_check_fn(unsigned long ptr)
return fn;
}

+extern unsigned long __start_cfi_excluded[];
+extern unsigned long __stop_cfi_excluded[];
+
+static inline bool is_cfi_excluded(unsigned long ptr)
+{
+ unsigned long *p = __start_cfi_excluded;
+
+ for ( ; p < __stop_cfi_excluded; ++p)
+ if (*p == ptr)
+ return true;
+
+ return false;
+}
+
+static void __cfi_pass(uint64_t id, void *ptr, void *diag)
+{
+}
+
static inline cfi_check_fn find_check_fn(unsigned long ptr)
{
cfi_check_fn fn = NULL;

- if (is_kernel_text(ptr))
+ if (is_kernel_text(ptr)) {
+ if (unlikely(is_cfi_excluded(ptr)))
+ return __cfi_pass;
+
return __cfi_check;
+ }

/*
* Indirect call checks can happen when RCU is not watching. Both
--
2.33.0.800.g4c38ced690-goog