objtool: Validate kCFI calls

Validate that all indirect calls adhere to kCFI rules. Notably doing
nocfi indirect call to a cfi function is broken.

Apparently some Rust 'core' code violates this and explodes when ran
with FineIBT.

All the ANNOTATE_NOCFI_SYM sites are prime targets for attackers.

 - runtime EFI is especially henous because it also needs to disable
   IBT. Basically calling unknown code without CFI protection at
   runtime is a massice security issue.

 - Kexec image handover; if you can exploit this, you get to keep it :-)

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Josh Poimboeuf <jpoimboe@kernel.org>
Acked-by: Sean Christopherson <seanjc@google.com>
Link: https://lkml.kernel.org/r/20250714103441.496787279@infradead.org

diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c
index 697fb99406e6bcc3bac726c29f01bd334bbad911..8593760c255a08b0dbc547a9a31dee488c386017 100644 (file)
--- a/arch/x86/kernel/machine_kexec_64.c
+++ b/arch/x86/kernel/machine_kexec_64.c
@@ -453,6 +453,10 @@ void __nocfi machine_kexec(struct kimage *image)
 
        __ftrace_enabled_restore(save_ftrace_enabled);
 }
+/*
+ * Handover to the next kernel, no CFI concern.
+ */
+ANNOTATE_NOCFI_SYM(machine_kexec);
 
 /* arch-dependent functionality related to kexec file-based syscall */
 

diff --git a/arch/x86/kvm/vmx/vmenter.S b/arch/x86/kvm/vmx/vmenter.S
index 0a6cf5bff2aa4715df46d5297bb2c94b3b7ffa4d..bc255d709d8a16ae22b5bc401965d209a89a8692 100644 (file)
--- a/arch/x86/kvm/vmx/vmenter.S
+++ b/arch/x86/kvm/vmx/vmenter.S
@@ -361,6 +361,10 @@ SYM_FUNC_END(vmread_error_trampoline)
 
 .section .text, "ax"
 
+#ifndef CONFIG_X86_FRED
+
 SYM_FUNC_START(vmx_do_interrupt_irqoff)
        VMX_DO_EVENT_IRQOFF CALL_NOSPEC _ASM_ARG1
 SYM_FUNC_END(vmx_do_interrupt_irqoff)
+
+#endif

diff --git a/arch/x86/platform/efi/efi_stub_64.S b/arch/x86/platform/efi/efi_stub_64.S
index 2206b8bc47b8a75749ecbccdd8407fc2d2d58592..f0a5fba0717efc3638ffe0f9c8590b390ae4c68f 100644 (file)
--- a/arch/x86/platform/efi/efi_stub_64.S
+++ b/arch/x86/platform/efi/efi_stub_64.S
@@ -11,6 +11,10 @@
 #include <asm/nospec-branch.h>
 
 SYM_FUNC_START(__efi_call)
+       /*
+        * The EFI code doesn't have any CFI, annotate away the CFI violation.
+        */
+       ANNOTATE_NOCFI_SYM
        pushq %rbp
        movq %rsp, %rbp
        and $~0xf, %rsp

diff --git a/drivers/misc/lkdtm/perms.c b/drivers/misc/lkdtm/perms.c
index 6c24426104ba6f5e125a4e2d7258781b0b83c2c9..e1f5e9abb30193d24898208865dc259ce1336b5f 100644 (file)
--- a/drivers/misc/lkdtm/perms.c
+++ b/drivers/misc/lkdtm/perms.c
@@ -9,6 +9,7 @@
 #include <linux/vmalloc.h>
 #include <linux/mman.h>
 #include <linux/uaccess.h>
+#include <linux/objtool.h>
 #include <asm/cacheflush.h>
 #include <asm/sections.h>
 
@@ -86,6 +87,10 @@ static noinline __nocfi void execute_location(void *dst, bool write)
        func();
        pr_err("FAIL: func returned\n");
 }
+/*
+ * Explicitly doing the wrong thing for testing.
+ */
+ANNOTATE_NOCFI_SYM(execute_location);
 
 static void execute_user_location(void *dst)
 {

diff --git a/include/linux/objtool.h b/include/linux/objtool.h
index 366ad004d794b739fbc1a269cb498d29485a03d5..46ebaa46e6c5832efed6d420a664c35b27e6d404 100644 (file)
--- a/include/linux/objtool.h
+++ b/include/linux/objtool.h
@@ -184,6 +184,15 @@
  * WARN using UD2.
  */
 #define ANNOTATE_REACHABLE(label)      __ASM_ANNOTATE(label, ANNOTYPE_REACHABLE)
+/*
+ * This should not be used; it annotates away CFI violations. There are a few
+ * valid use cases like kexec handover to the next kernel image, and there is
+ * no security concern there.
+ *
+ * There are also a few real issues annotated away, like EFI because we can't
+ * control the EFI code.
+ */
+#define ANNOTATE_NOCFI_SYM(sym)                asm(__ASM_ANNOTATE(sym, ANNOTYPE_NOCFI))
 
 #else
 #define ANNOTATE_NOENDBR               ANNOTATE type=ANNOTYPE_NOENDBR
@@ -194,6 +203,7 @@
 #define ANNOTATE_INTRA_FUNCTION_CALL   ANNOTATE type=ANNOTYPE_INTRA_FUNCTION_CALL
 #define ANNOTATE_UNRET_BEGIN           ANNOTATE type=ANNOTYPE_UNRET_BEGIN
 #define ANNOTATE_REACHABLE             ANNOTATE type=ANNOTYPE_REACHABLE
+#define ANNOTATE_NOCFI_SYM             ANNOTATE type=ANNOTYPE_NOCFI
 #endif
 
 #if defined(CONFIG_NOINSTR_VALIDATION) && \

diff --git a/include/linux/objtool_types.h b/include/linux/objtool_types.h
index df5d9fa84dba339b7c14a57667f8e534db3e236e..aceac94632c8a85898ae135c95d04f7f6fcc1835 100644 (file)
--- a/include/linux/objtool_types.h
+++ b/include/linux/objtool_types.h
@@ -65,5 +65,6 @@ struct unwind_hint {
 #define ANNOTYPE_IGNORE_ALTS           6
 #define ANNOTYPE_INTRA_FUNCTION_CALL   7
 #define ANNOTYPE_REACHABLE             8
+#define ANNOTYPE_NOCFI                 9
 
 #endif /* _LINUX_OBJTOOL_TYPES_H */

diff --git a/tools/include/linux/objtool_types.h b/tools/include/linux/objtool_types.h
index df5d9fa84dba339b7c14a57667f8e534db3e236e..aceac94632c8a85898ae135c95d04f7f6fcc1835 100644 (file)
--- a/tools/include/linux/objtool_types.h
+++ b/tools/include/linux/objtool_types.h
@@ -65,5 +65,6 @@ struct unwind_hint {
 #define ANNOTYPE_IGNORE_ALTS           6
 #define ANNOTYPE_INTRA_FUNCTION_CALL   7
 #define ANNOTYPE_REACHABLE             8
+#define ANNOTYPE_NOCFI                 9
 
 #endif /* _LINUX_OBJTOOL_TYPES_H */

diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index d14f20ef1db13f0d8a9ce711d524bac06b48579e..79eab61cd9445dc1665d89169b002dbecc79ca7d 100644 (file)
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -2392,6 +2392,8 @@ static int __annotate_ifc(struct objtool_file *file, int type, struct instructio
 
 static int __annotate_late(struct objtool_file *file, int type, struct instruction *insn)
 {
+       struct symbol *sym;
+
        switch (type) {
        case ANNOTYPE_NOENDBR:
                /* early */
@@ -2433,6 +2435,15 @@ static int __annotate_late(struct objtool_file *file, int type, struct instructi
                insn->dead_end = false;
                break;
 
+       case ANNOTYPE_NOCFI:
+               sym = insn->sym;
+               if (!sym) {
+                       ERROR_INSN(insn, "dodgy NOCFI annotation");
+                       return -1;
+               }
+               insn->sym->nocfi = 1;
+               break;
+
        default:
                ERROR_INSN(insn, "Unknown annotation type: %d", type);
                return -1;
@@ -4002,6 +4013,37 @@ static int validate_retpoline(struct objtool_file *file)
                warnings++;
        }
 
+       if (!opts.cfi)
+               return warnings;
+
+       /*
+        * kCFI call sites look like:
+        *
+        *     movl $(-0x12345678), %r10d
+        *     addl -4(%r11), %r10d
+        *     jz 1f
+        *     ud2
+        *  1: cs call __x86_indirect_thunk_r11
+        *
+        * Verify all indirect calls are kCFI adorned by checking for the
+        * UD2. Notably, doing __nocfi calls to regular (cfi) functions is
+        * broken.
+        */
+       list_for_each_entry(insn, &file->retpoline_call_list, call_node) {
+               struct symbol *sym = insn->sym;
+
+               if (sym && (sym->type == STT_NOTYPE ||
+                           sym->type == STT_FUNC) && !sym->nocfi) {
+                       struct instruction *prev =
+                               prev_insn_same_sym(file, insn);
+
+                       if (!prev || prev->type != INSN_BUG) {
+                               WARN_INSN(insn, "no-cfi indirect call!");
+                               warnings++;
+                       }
+               }
+       }
+
        return warnings;
 }
 

diff --git a/tools/objtool/include/objtool/elf.h b/tools/objtool/include/objtool/elf.h
index 0a2fa3ac00793055a6a558640fa53916465c7e01..df8434d3b74400bd913d47f71ba5e2d29578130b 100644 (file)
--- a/tools/objtool/include/objtool/elf.h
+++ b/tools/objtool/include/objtool/elf.h
@@ -70,6 +70,7 @@ struct symbol {
        u8 local_label       : 1;
        u8 frame_pointer     : 1;
        u8 ignore            : 1;
+       u8 nocfi             : 1;
        struct list_head pv_target;
        struct reloc *relocs;
        struct section *group_sec;