2022-06-11 00:10:47

by Sami Tolvanen

Subject: [RFC PATCH v3 07/20] lkdtm: Emit an indirect call for CFI tests

Clang can convert the indirect calls in lkdtm_CFI_FORWARD_PROTO into
direct calls. Move the call into a noinline function that accepts the
target address as an argument to ensure the compiler actually emits an
indirect call instead.

Signed-off-by: Sami Tolvanen <[email protected]>
---
drivers/misc/lkdtm/cfi.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/drivers/misc/lkdtm/cfi.c b/drivers/misc/lkdtm/cfi.c
index 666a7f4bc137..b6b375112a2a 100644
--- a/drivers/misc/lkdtm/cfi.c
+++ b/drivers/misc/lkdtm/cfi.c
@@ -20,6 +20,13 @@ static noinline int lkdtm_increment_int(int *counter)

return *counter;
}
+
+/* Don't allow the compiler to inline the calls. */
+static noinline void lkdtm_indirect_call(void (*func)(int *))
+{
+ func(&called_count);
+}
+
/*
* This tries to call an indirect function with a mismatched prototype.
*/
@@ -29,15 +36,11 @@ static void lkdtm_CFI_FORWARD_PROTO(void)
* Matches lkdtm_increment_void()'s prototype, but not
* lkdtm_increment_int()'s prototype.
*/
- void (*func)(int *);
-
pr_info("Calling matched prototype ...\n");
- func = lkdtm_increment_void;
- func(&called_count);
+ lkdtm_indirect_call(lkdtm_increment_void);

pr_info("Calling mismatched prototype ...\n");
- func = (void *)lkdtm_increment_int;
- func(&called_count);
+ lkdtm_indirect_call((void *)lkdtm_increment_int);

pr_err("FAIL: survived mismatched prototype function call!\n");
pr_expected_config(CONFIG_CFI_CLANG);
--
2.36.1.476.g0c4daa206d-goog

2022-06-11 09:33:37

by Kees Cook

Subject: Re: [RFC PATCH v3 07/20] lkdtm: Emit an indirect call for CFI tests

On Fri, Jun 10, 2022 at 04:35:00PM -0700, Sami Tolvanen wrote:
> Clang can convert the indirect calls in lkdtm_CFI_FORWARD_PROTO into
> direct calls. Move the call into a noinline function that accepts the
> target address as an argument to ensure the compiler actually emits an
> indirect call instead.
>
> Signed-off-by: Sami Tolvanen <[email protected]>

Acked-by: Kees Cook <[email protected]>

--
Kees Cook