Messages in this thread | | | Date | Wed, 23 Jun 2021 09:32:15 -0700 | From | Kees Cook <> | Subject | Re: [PATCH 1/2] ACPI: bgrt: Fix CFI violation |
| |
On Tue, Jun 22, 2021 at 06:38:01PM -0700, Nathan Chancellor wrote: > clang's Control Flow Integrity requires that every indirect call has a > valid target, which is based on the type of the function pointer. The > *_show() functions in this file are written as if they will be called > from dev_attr_show(); however, they will be called from > sysfs_kf_seq_show() because the files were created by > sysfs_create_group() and the sysfs ops are based on kobj_sysfs_ops > because of kobject_add_and_create(). Because the *_show() functions do > not match the type of the show() member in struct kobj_attribute, there > is a CFI violation. > > $ cat /sys/firmware/acpi/bgrt/{status,type,version,{x,y}offset}} > 1 > 0 > 1 > 522 > 307 > > $ dmesg | grep "CFI failure" > [ 267.761825] CFI failure (target: type_show.d5e1ad21498a5fd14edbc5c320906598.cfi_jt+0x0/0x8): > [ 267.762246] CFI failure (target: xoffset_show.d5e1ad21498a5fd14edbc5c320906598.cfi_jt+0x0/0x8): > [ 267.762584] CFI failure (target: status_show.d5e1ad21498a5fd14edbc5c320906598.cfi_jt+0x0/0x8): > [ 267.762973] CFI failure (target: yoffset_show.d5e1ad21498a5fd14edbc5c320906598.cfi_jt+0x0/0x8): > [ 267.763330] CFI failure (target: version_show.d5e1ad21498a5fd14edbc5c320906598.cfi_jt+0x0/0x8): > > Convert these functions to the type of the show() member in struct > kobj_attribute so that there is no more CFI violation. Because these > functions are all so similar, combine them into a macro. > > Fixes: d1ff4b1cdbab ("ACPI: Add support for exposing BGRT data") > Link: https://github.com/ClangBuiltLinux/linux/issues/1406 > Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Thanks for solving this!
Reviewed-by: Kees Cook <keescook@chromium.org>
-- Kees Cook
| |