From nobody Fri Apr 3 06:02:38 2026 Received: from smtp-out1.suse.de (smtp-out1.suse.de [195.135.223.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D8997314A62 for ; Wed, 18 Feb 2026 08:21:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=195.135.223.130 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771402905; cv=none; b=EmSgc41Lp+I6FNPEjMFDxtYUXG1ChzkBUvR54df2yP4gEVooxhzpIX7mPAI6JD9QZYsUi7NZ92U5CGy3dbiudK55NuPQ1TRnRQxXdnrw+8ARytpD+bRf3XgohxIxj33KZNtRnfCtLFOZFMYr/1IAA55twM8JA/EcTUmx+YcR4Aw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771402905; c=relaxed/simple; bh=xLsOnGu4DxeyAKhwjQJIuMFziEHsNA1NJifo2KMfBKk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=bJz8R4KKYZSGy3XS/RTV5OqxTLBe8zE7hBJseE+i4Y3yZ3vfSpVFsAmjYyqIn3ipOqnyHRs5sBNIngW1pcZHXtMIzDndLMmBZ6W4STNGJkYTfDZgQyuEZcMxQqe31bfVciFC2oqGHoapgCMP/7xScFfc/WhM6/7+Nu7yrQdx0LU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=suse.com; spf=pass smtp.mailfrom=suse.com; arc=none smtp.client-ip=195.135.223.130 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=suse.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=suse.com Received: from imap1.dmz-prg2.suse.org (imap1.dmz-prg2.suse.org [IPv6:2a07:de40:b281:104:10:150:64:97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id D9FD23E6E8; Wed, 18 Feb 2026 08:21:41 +0000 (UTC) Authentication-Results: smtp-out1.suse.de; none Received: from imap1.dmz-prg2.suse.org (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id 9B1FA3EA65; Wed, 18 Feb 2026 08:21:41 +0000 (UTC) Received: from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167]) by imap1.dmz-prg2.suse.org with ESMTPSA id F4KLJJV2lWlqHQAAD6G6ig (envelope-from ); Wed, 18 Feb 2026 08:21:41 +0000 From: Juergen Gross To: linux-kernel@vger.kernel.org, x86@kernel.org Cc: Juergen Gross , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , "H. Peter Anvin" Subject: [PATCH v3 01/16] x86/alternative: Support alt_replace_call() with instructions after call Date: Wed, 18 Feb 2026 09:21:18 +0100 Message-ID: <20260218082133.400602-2-jgross@suse.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260218082133.400602-1-jgross@suse.com> References: <20260218082133.400602-1-jgross@suse.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Rspamd-Server: rspamd2.dmz-prg2.suse.org X-Spamd-Result: default: False [-4.00 / 50.00]; REPLY(-4.00)[] X-Rspamd-Queue-Id: D9FD23E6E8 X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Rspamd-Action: no action X-Spam-Flag: NO X-Spam-Score: -4.00 X-Spam-Level: Content-Type: text/plain; charset="utf-8" Today alt_replace_call() requires the initial indirect call not to be followed by any further instructions, including padding NOPs. In case any replacement is longer than 6 bytes, a subsequent replacement of the indirect call with a direct one will result in a crash. Fix that by crashing only if the original instruction is less than 6 bytes long or not a known indirect call. Signed-off-by: Juergen Gross --- V3: - new patch arch/x86/kernel/alternative.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c index 693b59b2f7d0..6d37672ba71f 100644 --- a/arch/x86/kernel/alternative.c +++ b/arch/x86/kernel/alternative.c @@ -534,6 +534,7 @@ noinstr void BUG_func(void) } EXPORT_SYMBOL(BUG_func); =20 +#define CALL_RIP_INSTRLEN 6 #define CALL_RIP_REL_OPCODE 0xff #define CALL_RIP_REL_MODRM 0x15 =20 @@ -551,7 +552,7 @@ static unsigned int alt_replace_call(u8 *instr, u8 *ins= n_buff, struct alt_instr BUG(); } =20 - if (a->instrlen !=3D 6 || + if (a->instrlen < CALL_RIP_INSTRLEN || instr[0] !=3D CALL_RIP_REL_OPCODE || instr[1] !=3D CALL_RIP_REL_MODRM) { pr_err("ALT_FLAG_DIRECT_CALL set for unrecognized indirect call\n"); @@ -563,7 +564,7 @@ static unsigned int alt_replace_call(u8 *instr, u8 *ins= n_buff, struct alt_instr #ifdef CONFIG_X86_64 /* ff 15 00 00 00 00 call *0x0(%rip) */ /* target address is stored at "next instruction + disp". */ - target =3D *(void **)(instr + a->instrlen + disp); + target =3D *(void **)(instr + CALL_RIP_INSTRLEN + disp); #else /* ff 15 00 00 00 00 call *0x0 */ /* target address is stored at disp. */ --=20 2.53.0