From nobody Sun Feb 8 14:59:42 2026 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 83AAD1C861D; Tue, 25 Mar 2025 22:09:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1742940597; cv=none; b=uj0cv/qoiGcpcQ2jqwHIVap2yvB6DmTu3O1ceWd4fsm0kU8Du2qUuKJ+5PQBTFZAbsOPSOPWOD0aIM3dZ2qMSzC2CmxM2z56ahyZsRddXqrsyR6xGKKrFRgQnvi9+vNzZZGIgDmYy9LsT3tG/W+nZc6L6ujYSceUhQ6ORIt/6/s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1742940597; c=relaxed/simple; bh=8NlWWcoLP0DG3IwtUNaUKdjJte3jsifT8q1MgEN7Efk=; h=Date:From:To:Subject:Cc:In-Reply-To:References:MIME-Version: Message-ID:Content-Type; b=IFxX+VjnF6RNMF6nmw7ZMEYOGscEGnK2L6Vql0h+892or7DY0y3JPfQUS9l/3PswHCTb/m0TJwiZO7SR2lNoZ94BMsrSw3GJMxANfWSOLMCOjXvSNuvUQBnUpPHT4jAqZqibUT3TrDOlip/DgdynzdOobW1nSVqnlxZAouPImiU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=MjCYAe+K; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=qbvuj7Hu; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="MjCYAe+K"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="qbvuj7Hu" Date: Tue, 25 Mar 2025 22:09:47 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1742940593; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=x56uCukBF2n2NAbetPZBBAI8p6oLEmJtzcjPztQvfpo=; b=MjCYAe+KguOQNW2bnJszJYsNsP5glnTlq+4Jzc88N8rf81bgfvvZOl9MaNfqa0gf74IdD0 5AHvFrAmbXv1O8XyfPy/XOQQ0LgpYs9XGjmoS7UDyr9UvUFubfDCpUmlj3kjBfm4o2uKYQ PZnAHL66snweaANCmP8qoLIcwN3e9xBrERNfltIfnC5jYgvp9xMZRaEBKYD3ps0OoocMh1 lR5ndz+lnjXXKy7+ZOmDHMPQO99nIwSRPaVZ1umd3yILaHryB+9GXHV+ZSst6irV2rITgi BuJXf+ew9CAUcQIwTPUS6Whnt5fwmWwpoqSgqdUr9pj1HcenjNAJ6rvsKJj2Ew== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1742940593; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=x56uCukBF2n2NAbetPZBBAI8p6oLEmJtzcjPztQvfpo=; b=qbvuj7Hudv29+O+BPs1ubXZeMknpbYpC5Te3LBocmvvXusPbQ4xiu8kvdYIjbss2eGxM03 R29YpJSMnE6WMdDA== From: "tip-bot2 for Josh Poimboeuf" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: objtool/urgent] objtool, lkdtm: Obfuscate the do_nothing() pointer Cc: kernel test robot , Josh Poimboeuf , Ingo Molnar , Kees Cook , Arnd Bergmann , "Greg Kroah-Hartman" , Linus Torvalds , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <30b9abffbddeb43c4f6320b1270fa9b4d74c54ed.1742852847.git.jpoimboe@kernel.org> References: <30b9abffbddeb43c4f6320b1270fa9b4d74c54ed.1742852847.git.jpoimboe@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <174294058761.14745.9324171206395053435.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Precedence: bulk Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The following commit has been merged into the objtool/urgent branch of tip: Commit-ID: 26d2ab43acdd1fd5fab3c3abb0b79d7ff14fedaa Gitweb: https://git.kernel.org/tip/26d2ab43acdd1fd5fab3c3abb0b79d7ff= 14fedaa Author: Josh Poimboeuf AuthorDate: Mon, 24 Mar 2025 14:56:12 -07:00 Committer: Ingo Molnar CommitterDate: Tue, 25 Mar 2025 23:00:45 +01:00 objtool, lkdtm: Obfuscate the do_nothing() pointer If execute_location()'s memcpy of do_nothing() gets inlined and unrolled by the compiler, it copies one word at a time: mov 0x0(%rip),%rax R_X86_64_PC32 .text+0x1374 mov %rax,0x38(%rbx) mov 0x0(%rip),%rax R_X86_64_PC32 .text+0x136c mov %rax,0x30(%rbx) ... Those .text references point to the middle of the function, causing objtool to complain about their lack of ENDBR. Prevent that by resolving the function pointer at runtime rather than build time. This fixes the following warning: drivers/misc/lkdtm/lkdtm.o: warning: objtool: execute_location+0x23: relo= cation to !ENDBR: .text+0x1378 Reported-by: kernel test robot Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Reviewed-by: Kees Cook Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Cc: Linus Torvalds Link: https://lore.kernel.org/r/30b9abffbddeb43c4f6320b1270fa9b4d74c54ed.17= 42852847.git.jpoimboe@kernel.org Closes: https://lore.kernel.org/oe-kbuild-all/202503191453.uFfxQy5R-lkp@int= el.com/ --- drivers/misc/lkdtm/perms.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/misc/lkdtm/perms.c b/drivers/misc/lkdtm/perms.c index 5b861db..6c24426 100644 --- a/drivers/misc/lkdtm/perms.c +++ b/drivers/misc/lkdtm/perms.c @@ -29,6 +29,13 @@ static const unsigned long rodata =3D 0xAA55AA55; static unsigned long ro_after_init __ro_after_init =3D 0x55AA5500; =20 /* + * This is a pointer to do_nothing() which is initialized at runtime rather + * than build time to avoid objtool IBT validation warnings caused by an + * inlined unrolled memcpy() in execute_location(). + */ +static void __ro_after_init *do_nothing_ptr; + +/* * This just returns to the caller. It is designed to be copied into * non-executable memory regions. */ @@ -65,13 +72,12 @@ static noinline __nocfi void execute_location(void *dst= , bool write) { void (*func)(void); func_desc_t fdesc; - void *do_nothing_text =3D dereference_function_descriptor(do_nothing); =20 - pr_info("attempting ok execution at %px\n", do_nothing_text); + pr_info("attempting ok execution at %px\n", do_nothing_ptr); do_nothing(); =20 if (write =3D=3D CODE_WRITE) { - memcpy(dst, do_nothing_text, EXEC_SIZE); + memcpy(dst, do_nothing_ptr, EXEC_SIZE); flush_icache_range((unsigned long)dst, (unsigned long)dst + EXEC_SIZE); } @@ -267,6 +273,8 @@ static void lkdtm_ACCESS_NULL(void) =20 void __init lkdtm_perms_init(void) { + do_nothing_ptr =3D dereference_function_descriptor(do_nothing); + /* Make sure we can write to __ro_after_init values during __init */ ro_after_init |=3D 0xAA; }