Messages in this thread Patch in this message | | | Date | Wed, 14 Dec 2022 14:48:28 -0800 | From | Kees Cook <> | Subject | Re: [PATCH v2] lkdtm: Add CFI_BACKWARD to test ROP mitigations |
| |
On Fri, Dec 09, 2022 at 05:34:41PM +0000, Kristina Martsenko wrote: > Subject: [PATCH] lkdtm: cfi: Make PAC test work with GCC 7 and 8 > > The CFI test uses the branch-protection=none compiler attribute to > disable PAC return address protection on a function. While newer GCC > versions support this attribute, older versions (GCC 7 and 8) instead > supported the sign-return-address=none attribute, leading to a build > failure when the test is built with older compilers. Fix it by checking > which attribute is supported and using the correct one. > > Fixes: 2e53b877dc12 ("lkdtm: Add CFI_BACKWARD to test ROP mitigations") > Reported-by: Daniel Díaz <daniel.diaz@linaro.org> > Signed-off-by: Kristina Martsenko <kristina.martsenko@arm.com> > Link: https://lore.kernel.org/all/CAEUSe78kDPxQmQqCWW-_9LCgJDFhAeMoVBFnX9QLx18Z4uT4VQ@mail.gmail.com/
Thanks! Added to my tree.
> --- > drivers/misc/lkdtm/cfi.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/drivers/misc/lkdtm/cfi.c b/drivers/misc/lkdtm/cfi.c > index 5245cf6013c9..d4bb8e31a2fe 100644 > --- a/drivers/misc/lkdtm/cfi.c > +++ b/drivers/misc/lkdtm/cfi.c > @@ -54,7 +54,11 @@ static void lkdtm_CFI_FORWARD_PROTO(void) > # ifdef CONFIG_ARM64_BTI_KERNEL > # define __no_pac "branch-protection=bti" > # else > -# define __no_pac "branch-protection=none" > +# ifdef CONFIG_CC_HAS_BRANCH_PROT_PAC_RET > +# define __no_pac "branch-protection=none" > +# else > +# define __no_pac "sign-return-address=none" > +# endif > # endif > # define __no_ret_protection __noscs __attribute__((__target__(__no_pac))) > #else >
-- Kees Cook
| |