From: Sami Tolvanen Date: Thu, 8 Apr 2021 18:28:33 +0000 (-0700) Subject: bpf: disable CFI in dispatcher functions X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=9f5b4009980f369acb80b72235b2d66c3fd6eca6;p=linux.git bpf: disable CFI in dispatcher functions BPF dispatcher functions are patched at runtime to perform direct instead of indirect calls. Disable CFI for the dispatcher functions to avoid conflicts. Signed-off-by: Sami Tolvanen Reviewed-by: Kees Cook Tested-by: Nathan Chancellor Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20210408182843.1754385-9-samitolvanen@google.com --- diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 3625f019767df..2f46f98479e14 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -650,7 +650,7 @@ struct bpf_dispatcher { struct bpf_ksym ksym; }; -static __always_inline unsigned int bpf_dispatcher_nop_func( +static __always_inline __nocfi unsigned int bpf_dispatcher_nop_func( const void *ctx, const struct bpf_insn *insnsi, unsigned int (*bpf_func)(const void *, @@ -678,7 +678,7 @@ void bpf_trampoline_put(struct bpf_trampoline *tr); } #define DEFINE_BPF_DISPATCHER(name) \ - noinline unsigned int bpf_dispatcher_##name##_func( \ + noinline __nocfi unsigned int bpf_dispatcher_##name##_func( \ const void *ctx, \ const struct bpf_insn *insnsi, \ unsigned int (*bpf_func)(const void *, \