x86/traps: Decode 0xEA instructions as #UD

FineIBT will start using 0xEA as #UD. Normally '0xEA' is a 'bad',
invalid instruction for the CPU.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Kees Cook <kees@kernel.org>
Link: https://lore.kernel.org/r/20250224124200.166774696@infradead.org

diff --git a/arch/x86/include/asm/bug.h b/arch/x86/include/asm/bug.h
index 1a5e4b3726940471b069121410cd88e99080bd65..bc8a2ca3c82ef5f9539172662288005e5ba08ed3 100644 (file)
--- a/arch/x86/include/asm/bug.h
+++ b/arch/x86/include/asm/bug.h
@@ -25,6 +25,7 @@
 #define BUG_UD2                        0xfffe
 #define BUG_UD1                        0xfffd
 #define BUG_UD1_UBSAN          0xfffc
+#define BUG_EA                 0xffea
 
 #ifdef CONFIG_GENERIC_BUG
 

diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 05b86c05e446c34722c5d6bc875075173b580297..a02a51bf433fa0cf945c2ca0397ffd8942370788 100644 (file)
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -96,6 +96,7 @@ __always_inline int is_valid_bugaddr(unsigned long addr)
  * Check for UD1 or UD2, accounting for Address Size Override Prefixes.
  * If it's a UD1, further decode to determine its use:
  *
+ * FineIBT:      ea                      (bad)
  * UBSan{0}:     67 0f b9 00             ud1    (%eax),%eax
  * UBSan{10}:    67 0f b9 40 10          ud1    0x10(%eax),%eax
  * static_call:  0f b9 cc                ud1    %esp,%ecx
@@ -113,6 +114,10 @@ __always_inline int decode_bug(unsigned long addr, s32 *imm, int *len)
        v = *(u8 *)(addr++);
        if (v == INSN_ASOP)
                v = *(u8 *)(addr++);
+       if (v == 0xea) {
+               *len = addr - start;
+               return BUG_EA;
+       }
        if (v != OPCODE_ESCAPE)
                return BUG_NONE;
 
@@ -309,10 +314,16 @@ static noinstr bool handle_bug(struct pt_regs *regs)
 
        switch (ud_type) {
        case BUG_UD2:
-               if (report_bug(regs->ip, regs) == BUG_TRAP_TYPE_WARN ||
-                   handle_cfi_failure(regs) == BUG_TRAP_TYPE_WARN) {
-                       regs->ip += ud_len;
+               if (report_bug(regs->ip, regs) == BUG_TRAP_TYPE_WARN) {
+                       handled = true;
+                       break;
+               }
+               fallthrough;
+
+       case BUG_EA:
+               if (handle_cfi_failure(regs) == BUG_TRAP_TYPE_WARN) {
                        handled = true;
+                       break;
                }
                break;
 
@@ -328,6 +339,9 @@ static noinstr bool handle_bug(struct pt_regs *regs)
                break;
        }
 
+       if (handled)
+               regs->ip += ud_len;
+
        if (regs->flags & X86_EFLAGS_IF)
                raw_local_irq_disable();
        instrumentation_end();