cfi: add __cficanonical

With CONFIG_CFI_CLANG, the compiler replaces a function address taken
in C code with the address of a local jump table entry, which passes
runtime indirect call checks. However, the compiler won't replace
addresses taken in assembly code, which will result in a CFI failure
if we later jump to such an address in instrumented C code. The code
generated for the non-canonical jump table looks this:

  <noncanonical.cfi_jt>: /* In C, &noncanonical points here */
	jmp noncanonical
  ...
  <noncanonical>:        /* function body */
	...

This change adds the __cficanonical attribute, which tells the
compiler to use a canonical jump table for the function instead. This
means the compiler will rename the actual function to <function>.cfi
and points the original symbol to the jump table entry instead:

  <canonical>:           /* jump table entry */
	jmp canonical.cfi
  ...
  <canonical.cfi>:       /* function body */
	...

As a result, the address taken in assembly, or other non-instrumented
code always points to the jump table and therefore, can be used for
indirect calls in instrumented code without tripping CFI checks.

Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>   # pci.h
Tested-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20210408182843.1754385-3-samitolvanen@google.com

diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
index 6de9d0c9377e99f71aa95b074b8a00bdaf114e8a..adbe76b203e2fd27356d7cb772542c4e22e23ca1 100644 (file)
--- a/include/linux/compiler-clang.h
+++ b/include/linux/compiler-clang.h
@@ -63,3 +63,4 @@
 #endif
 
 #define __nocfi                __attribute__((__no_sanitize__("cfi")))
+#define __cficanonical __attribute__((__cfi_canonical_jump_table__))

diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
index 796935a37e373ea6ee66af6231369340ece16aff..d29bda7f6ebddf8141443801ceb553b3f57eb934 100644 (file)
--- a/include/linux/compiler_types.h
+++ b/include/linux/compiler_types.h
@@ -246,6 +246,10 @@ struct ftrace_likely_data {
 # define __nocfi
 #endif
 
+#ifndef __cficanonical
+# define __cficanonical
+#endif
+
 #ifndef asm_volatile_goto
 #define asm_volatile_goto(x...) asm goto(x)
 #endif

diff --git a/include/linux/init.h b/include/linux/init.h
index b3ea15348fbdcc1e7d761d33b421dabe6e1d9fee..045ad1650ed16dacf28f3894ef2414f279e20fe1 100644 (file)
--- a/include/linux/init.h
+++ b/include/linux/init.h
@@ -220,8 +220,8 @@ extern bool initcall_debug;
        __initcall_name(initstub, __iid, id)
 
 #define __define_initcall_stub(__stub, fn)                     \
-       int __init __stub(void);                                \
-       int __init __stub(void)                                 \
+       int __init __cficanonical __stub(void);                 \
+       int __init __cficanonical __stub(void)                  \
        {                                                       \
                return fn();                                    \
        }                                                       \

diff --git a/include/linux/pci.h b/include/linux/pci.h
index 86c799c97b7796665524666dc4a73f12ab81cbb3..39684b72db915a1deb00439dce8a82a0a54af064 100644 (file)
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1944,8 +1944,8 @@ enum pci_fixup_pass {
 #ifdef CONFIG_LTO_CLANG
 #define __DECLARE_PCI_FIXUP_SECTION(sec, name, vendor, device, class,  \
                                  class_shift, hook, stub)              \
-       void stub(struct pci_dev *dev);                                 \
-       void stub(struct pci_dev *dev)                                  \
+       void __cficanonical stub(struct pci_dev *dev);                  \
+       void __cficanonical stub(struct pci_dev *dev)                   \
        {                                                               \
                hook(dev);                                              \
        }                                                               \