From nobody Wed Dec 17 07:14:50 2025 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BFE583C463; Thu, 27 Mar 2025 11:06:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1743073572; cv=none; b=LJe3eXmtianLxOtIpC03P0Q4EIw6i7eVpMmf4aRRoB68Yuqf24QokdB81ovcX9ly9thLu7Ynn4x+YdT8fjRCA+AwAwOuNFcqsbMFz4AnhDn8JQAM6l/Ht7Q9DNpl8UHiaBVMhGENQ6+crbwNs526qkAA9mZ2DyFshgS0/DN9zb4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1743073572; c=relaxed/simple; bh=OqS0eZwmq6Hh9B4vt0N/WNyECSJS0mixtbitr+dNLG4=; h=Date:From:To:Subject:Cc:In-Reply-To:References:MIME-Version: Message-ID:Content-Type; b=DCpBHfDmoXN1300MwYOvXlo9wMf4ujqCzUc3AWCSl4bvJtnuqRfSzAgj5TdCewoZZSGcWbdb8M91v0ntL3bHar0y8zGFuMmEY52a0hPcMp1BS0YQhgpotAFNGaQqB3JcGDRsIV+amVn5AafY9i90rXTl/4pT3a6q+iH+fx+uCUE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=Icque4hR; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=8BNgh/VQ; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="Icque4hR"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="8BNgh/VQ" Date: Thu, 27 Mar 2025 11:06:07 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1743073568; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=0QOeu1i8DigA3+4N+PE0sx9P3KY7dSOOvzbEYknQGak=; b=Icque4hR83uNcEVhHR807drAeblkUV6OMnx+1xqpBcg0fjdJF02FjtSak29Bb8mi/FmHXd HR+ATdc5nZxidsIUE962T74m16RYWY9SNoRDWV60mqKUUGOK2+DofsfB6ohA9QE9mCUUTz wnVTpRicP9hLCt0Tb+CcL8hzP7met0sbMi8dI+d/gM0Yf3NNsOfNW5AsIr+TBhN9nlqvBg eTgxV7rdJVI+PtyVDytOB/XlBlZcSeupze4Oxd4I9cLat9d3cqniLkUUcUyCCkv50ukYer hhyNL1S54IhZpl8wNXVgLhNTXWMIcPqNN+U5Hif8CEyGOOR5LjgTO1YoDcl1Yg== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1743073568; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=0QOeu1i8DigA3+4N+PE0sx9P3KY7dSOOvzbEYknQGak=; b=8BNgh/VQ/8erchhKpJz8beF2qC6sTAWMJ08Ufh2NyF57N+DGgzw8wfmf1yE7YfhQVTqc0D fIry3gpLfkgigpAQ== From: "tip-bot2 for Josh Poimboeuf" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: objtool/urgent] objtool, lkdtm: Obfuscate the do_nothing() pointer Cc: kernel test robot , Josh Poimboeuf , Ingo Molnar , Kees Cook , Arnd Bergmann , "Greg Kroah-Hartman" , Linus Torvalds , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <30b9abffbddeb43c4f6320b1270fa9b4d74c54ed.1742852847.git.jpoimboe@kernel.org> References: <30b9abffbddeb43c4f6320b1270fa9b4d74c54ed.1742852847.git.jpoimboe@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <174307356765.14745.3081301410519795216.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Precedence: bulk Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The following commit has been merged into the objtool/urgent branch of tip: Commit-ID: 42e5650944b8cd4361385cc9414f03a6d6748989 Gitweb: https://git.kernel.org/tip/42e5650944b8cd4361385cc9414f03a6d= 6748989 Author: Josh Poimboeuf AuthorDate: Mon, 24 Mar 2025 14:56:12 -07:00 Committer: Ingo Molnar CommitterDate: Thu, 27 Mar 2025 11:59:11 +01:00 objtool, lkdtm: Obfuscate the do_nothing() pointer If execute_location()'s memcpy of do_nothing() gets inlined and unrolled by the compiler, it copies one word at a time: mov 0x0(%rip),%rax R_X86_64_PC32 .text+0x1374 mov %rax,0x38(%rbx) mov 0x0(%rip),%rax R_X86_64_PC32 .text+0x136c mov %rax,0x30(%rbx) ... Those .text references point to the middle of the function, causing objtool to complain about their lack of ENDBR. Prevent that by resolving the function pointer at runtime rather than build time. This fixes the following warning: drivers/misc/lkdtm/lkdtm.o: warning: objtool: execute_location+0x23: relo= cation to !ENDBR: .text+0x1378 Reported-by: kernel test robot Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Reviewed-by: Kees Cook Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Cc: Linus Torvalds Link: https://lore.kernel.org/r/30b9abffbddeb43c4f6320b1270fa9b4d74c54ed.17= 42852847.git.jpoimboe@kernel.org Closes: https://lore.kernel.org/oe-kbuild-all/202503191453.uFfxQy5R-lkp@int= el.com/ --- drivers/misc/lkdtm/perms.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/misc/lkdtm/perms.c b/drivers/misc/lkdtm/perms.c index 5b861db..6c24426 100644 --- a/drivers/misc/lkdtm/perms.c +++ b/drivers/misc/lkdtm/perms.c @@ -29,6 +29,13 @@ static const unsigned long rodata =3D 0xAA55AA55; static unsigned long ro_after_init __ro_after_init =3D 0x55AA5500; =20 /* + * This is a pointer to do_nothing() which is initialized at runtime rather + * than build time to avoid objtool IBT validation warnings caused by an + * inlined unrolled memcpy() in execute_location(). + */ +static void __ro_after_init *do_nothing_ptr; + +/* * This just returns to the caller. It is designed to be copied into * non-executable memory regions. */ @@ -65,13 +72,12 @@ static noinline __nocfi void execute_location(void *dst= , bool write) { void (*func)(void); func_desc_t fdesc; - void *do_nothing_text =3D dereference_function_descriptor(do_nothing); =20 - pr_info("attempting ok execution at %px\n", do_nothing_text); + pr_info("attempting ok execution at %px\n", do_nothing_ptr); do_nothing(); =20 if (write =3D=3D CODE_WRITE) { - memcpy(dst, do_nothing_text, EXEC_SIZE); + memcpy(dst, do_nothing_ptr, EXEC_SIZE); flush_icache_range((unsigned long)dst, (unsigned long)dst + EXEC_SIZE); } @@ -267,6 +273,8 @@ static void lkdtm_ACCESS_NULL(void) =20 void __init lkdtm_perms_init(void) { + do_nothing_ptr =3D dereference_function_descriptor(do_nothing); + /* Make sure we can write to __ro_after_init values during __init */ ro_after_init |=3D 0xAA; }