87 lines
2.1 KiB
C
87 lines
2.1 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
||
/*
|
||
* Clang Control Flow Integrity (CFI) support.
|
||
*
|
||
* Copyright (C) 2022 Google LLC
|
||
*/
|
||
#include <asm/cfi.h>
|
||
#include <asm/insn.h>
|
||
#include <asm/insn-eval.h>
|
||
#include <linux/string.h>
|
||
|
||
/*
|
||
* Returns the target address and the expected type when regs->ip points
|
||
* to a compiler-generated CFI trap.
|
||
*/
|
||
static bool decode_cfi_insn(struct pt_regs *regs, unsigned long *target,
|
||
u32 *type)
|
||
{
|
||
char buffer[MAX_INSN_SIZE];
|
||
struct insn insn;
|
||
int offset = 0;
|
||
|
||
*target = *type = 0;
|
||
|
||
/*
|
||
* The compiler generates the following instruction sequence
|
||
* for indirect call checks:
|
||
*
|
||
* movl -<id>, %r10d ; 6 bytes
|
||
* addl -4(%reg), %r10d ; 4 bytes
|
||
* je .Ltmp1 ; 2 bytes
|
||
* ud2 ; <- regs->ip
|
||
* .Ltmp1:
|
||
*
|
||
* We can decode the expected type and the target address from the
|
||
* movl/addl instructions.
|
||
*/
|
||
if (copy_from_kernel_nofault(buffer, (void *)regs->ip - 12, MAX_INSN_SIZE))
|
||
return false;
|
||
if (insn_decode_kernel(&insn, &buffer[offset]))
|
||
return false;
|
||
if (insn.opcode.value != 0xBA)
|
||
return false;
|
||
|
||
*type = -(u32)insn.immediate.value;
|
||
|
||
if (copy_from_kernel_nofault(buffer, (void *)regs->ip - 6, MAX_INSN_SIZE))
|
||
return false;
|
||
if (insn_decode_kernel(&insn, &buffer[offset]))
|
||
return false;
|
||
if (insn.opcode.value != 0x3)
|
||
return false;
|
||
|
||
/* Read the target address from the register. */
|
||
offset = insn_get_modrm_rm_off(&insn, regs);
|
||
if (offset < 0)
|
||
return false;
|
||
|
||
*target = *(unsigned long *)((void *)regs + offset);
|
||
|
||
return true;
|
||
}
|
||
|
||
/*
|
||
* Checks if a ud2 trap is because of a CFI failure, and handles the trap
|
||
* if needed. Returns a bug_trap_type value similarly to report_bug.
|
||
*/
|
||
enum bug_trap_type handle_cfi_failure(struct pt_regs *regs)
|
||
{
|
||
unsigned long target;
|
||
u32 type;
|
||
|
||
if (!is_cfi_trap(regs->ip))
|
||
return BUG_TRAP_TYPE_NONE;
|
||
|
||
if (!decode_cfi_insn(regs, &target, &type))
|
||
return report_cfi_failure_noaddr(regs, regs->ip);
|
||
|
||
return report_cfi_failure(regs, regs->ip, &target, type);
|
||
}
|
||
|
||
/*
|
||
* Ensure that __kcfi_typeid_ symbols are emitted for functions that may
|
||
* not be indirectly called with all configurations.
|
||
*/
|
||
__ADDRESSABLE(__memcpy)
|