From nobody Thu Dec 18 05:02:02 2025 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DD7B017C225; Fri, 28 Mar 2025 13:48:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1743169709; cv=none; b=bz1U2Crz+CZyzD6BikGUgr7fRYVvd7aPA6hgh0iJQsj5pPQWq5JYmzeHYBQaWJWF7enUHUfktLkNCEIiPaR2D39MLDGe2CgEwNh63R4/wFRlUaKGtVx36Zcn0I+jKdhUMgBqxjjmIFSDGhXVtE2MAyQZ0PfZEkvUZ+5azDerUYo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1743169709; c=relaxed/simple; bh=A4lEWOeHQUYgXZddxDMWiNnsI7HKHKG9xnnHtCg4XgQ=; h=Date:From:To:Subject:Cc:In-Reply-To:References:MIME-Version: Message-ID:Content-Type; b=KTPBE62TOmA13+ExsIWYEK3GaskNTTMBtJYAeTd+UH3rk59kegK+8mh4YpzF9fa3ui03SehKTGNy8dw0FLXDa3ll2n5HeTgDJ1RehxoNa2MDmFj3FiED7FlrhbYfeieU1u0QpERMaml/OJaqJ6dAfOfF6Su6ocakYQv50OvDHjQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=YAFpctMq; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=8X9hFvGw; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="YAFpctMq"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="8X9hFvGw" Date: Fri, 28 Mar 2025 13:48:25 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1743169706; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=OoDqsfdyFwtIrnDdUOO1ZJZxvc9k9417KYe0eB98UGI=; b=YAFpctMqOW2Ku8TrsHXlzOGfNiHY1UX6ohlW9XWVsk4ES3ipxhDQj4y1tpUGJuEY/OOxZr qH26b6fEDPvCUdkJC28cgBPIHtDYMjeKjJHyH/NNmVquNi/Q5iEGSmRD7p3gRUJSYI09HA t+3w4fYDhX4i2KnVjsIpIKlbVXVcvB+hw+LaNYJgeCwAbWAuur1bGIuJECkwJxD3yUmAxc fnchKYlYC+IMwHqFrXd8edxobehL5PxcQ/vTrXpD8Di4/axz3dJpzUrhJ+CsdeCq6NNYRf YO3PWblJym5Y+fJ6h7R2IRQpBu1QKX3gXEHMcLSNM5hn/vvVt6/TnFoQmBtU8g== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1743169706; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=OoDqsfdyFwtIrnDdUOO1ZJZxvc9k9417KYe0eB98UGI=; b=8X9hFvGwAM7/Vwy+ikJsNRxxm3nVY3T9qMZt1KYqh1p/M9RzSC+qvsTAyVKT03kdhBSZRp Z2cvrC1Kd7qoYhAg== From: "tip-bot2 for Josh Poimboeuf" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: objtool/urgent] objtool, lkdtm: Obfuscate the do_nothing() pointer Cc: kernel test robot , Josh Poimboeuf , Ingo Molnar , Kees Cook , Arnd Bergmann , "Greg Kroah-Hartman" , Linus Torvalds , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <30b9abffbddeb43c4f6320b1270fa9b4d74c54ed.1742852847.git.jpoimboe@kernel.org> References: <30b9abffbddeb43c4f6320b1270fa9b4d74c54ed.1742852847.git.jpoimboe@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <174316970529.14745.224291620616247692.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Precedence: bulk Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The following commit has been merged into the objtool/urgent branch of tip: Commit-ID: 05026ea01e95ffdeb0e5ac8fb7fb1b551e3a8726 Gitweb: https://git.kernel.org/tip/05026ea01e95ffdeb0e5ac8fb7fb1b551= e3a8726 Author: Josh Poimboeuf AuthorDate: Mon, 24 Mar 2025 14:56:12 -07:00 Committer: Ingo Molnar CommitterDate: Fri, 28 Mar 2025 14:38:09 +01:00 objtool, lkdtm: Obfuscate the do_nothing() pointer If execute_location()'s memcpy of do_nothing() gets inlined and unrolled by the compiler, it copies one word at a time: mov 0x0(%rip),%rax R_X86_64_PC32 .text+0x1374 mov %rax,0x38(%rbx) mov 0x0(%rip),%rax R_X86_64_PC32 .text+0x136c mov %rax,0x30(%rbx) ... Those .text references point to the middle of the function, causing objtool to complain about their lack of ENDBR. Prevent that by resolving the function pointer at runtime rather than build time. This fixes the following warning: drivers/misc/lkdtm/lkdtm.o: warning: objtool: execute_location+0x23: relo= cation to !ENDBR: .text+0x1378 Reported-by: kernel test robot Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Reviewed-by: Kees Cook Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Cc: Linus Torvalds Link: https://lore.kernel.org/r/30b9abffbddeb43c4f6320b1270fa9b4d74c54ed.17= 42852847.git.jpoimboe@kernel.org Closes: https://lore.kernel.org/oe-kbuild-all/202503191453.uFfxQy5R-lkp@int= el.com/ --- drivers/misc/lkdtm/perms.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/misc/lkdtm/perms.c b/drivers/misc/lkdtm/perms.c index 5b861db..6c24426 100644 --- a/drivers/misc/lkdtm/perms.c +++ b/drivers/misc/lkdtm/perms.c @@ -29,6 +29,13 @@ static const unsigned long rodata =3D 0xAA55AA55; static unsigned long ro_after_init __ro_after_init =3D 0x55AA5500; =20 /* + * This is a pointer to do_nothing() which is initialized at runtime rather + * than build time to avoid objtool IBT validation warnings caused by an + * inlined unrolled memcpy() in execute_location(). + */ +static void __ro_after_init *do_nothing_ptr; + +/* * This just returns to the caller. It is designed to be copied into * non-executable memory regions. */ @@ -65,13 +72,12 @@ static noinline __nocfi void execute_location(void *dst= , bool write) { void (*func)(void); func_desc_t fdesc; - void *do_nothing_text =3D dereference_function_descriptor(do_nothing); =20 - pr_info("attempting ok execution at %px\n", do_nothing_text); + pr_info("attempting ok execution at %px\n", do_nothing_ptr); do_nothing(); =20 if (write =3D=3D CODE_WRITE) { - memcpy(dst, do_nothing_text, EXEC_SIZE); + memcpy(dst, do_nothing_ptr, EXEC_SIZE); flush_icache_range((unsigned long)dst, (unsigned long)dst + EXEC_SIZE); } @@ -267,6 +273,8 @@ static void lkdtm_ACCESS_NULL(void) =20 void __init lkdtm_perms_init(void) { + do_nothing_ptr =3D dereference_function_descriptor(do_nothing); + /* Make sure we can write to __ro_after_init values during __init */ ro_after_init |=3D 0xAA; }