Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 14 Dec 2022 14:48:28 -0800
From:   Kees Cook <keescook@chromium.org>
To:     Kristina Martsenko <kristina.martsenko@arm.com>
Cc:     Daniel =?iso-8859-1?Q?D=EDaz?= <daniel.diaz@linaro.org>,
        Dan Li <ashimida@linux.alibaba.com>,
        Arnd Bergmann <arnd@arndb.de>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org
Subject: Re: [PATCH v2] lkdtm: Add CFI_BACKWARD to test ROP mitigations
Message-ID: <202212141448.03552F3@keescook>
References: <20220416001103.1524653-1-keescook@chromium.org>
 <CAEUSe78kDPxQmQqCWW-_9LCgJDFhAeMoVBFnX9QLx18Z4uT4VQ@mail.gmail.com>
 <202212072221.A9FCC905CF@keescook>
 <ba52dac5-2ce7-a567-41af-841b857abbed@arm.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <ba52dac5-2ce7-a567-41af-841b857abbed@arm.com>
Precedence: bulk

On Fri, Dec 09, 2022 at 05:34:41PM +0000, Kristina Martsenko wrote:
> Subject: [PATCH] lkdtm: cfi: Make PAC test work with GCC 7 and 8
> 
> The CFI test uses the branch-protection=none compiler attribute to
> disable PAC return address protection on a function. While newer GCC
> versions support this attribute, older versions (GCC 7 and 8) instead
> supported the sign-return-address=none attribute, leading to a build
> failure when the test is built with older compilers. Fix it by checking
> which attribute is supported and using the correct one.
> 
> Fixes: 2e53b877dc12 ("lkdtm: Add CFI_BACKWARD to test ROP mitigations")
> Reported-by: Daniel D?az <daniel.diaz@linaro.org>
> Signed-off-by: Kristina Martsenko <kristina.martsenko@arm.com>
> Link: https://lore.kernel.org/all/CAEUSe78kDPxQmQqCWW-_9LCgJDFhAeMoVBFnX9QLx18Z4uT4VQ@mail.gmail.com/

Thanks! Added to my tree.

> ---
>  drivers/misc/lkdtm/cfi.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/misc/lkdtm/cfi.c b/drivers/misc/lkdtm/cfi.c
> index 5245cf6013c9..d4bb8e31a2fe 100644
> --- a/drivers/misc/lkdtm/cfi.c
> +++ b/drivers/misc/lkdtm/cfi.c
> @@ -54,7 +54,11 @@ static void lkdtm_CFI_FORWARD_PROTO(void)
>  # ifdef CONFIG_ARM64_BTI_KERNEL
>  #  define __no_pac             "branch-protection=bti"
>  # else
> -#  define __no_pac             "branch-protection=none"
> +#  ifdef CONFIG_CC_HAS_BRANCH_PROT_PAC_RET
> +#   define __no_pac             "branch-protection=none"
> +#  else
> +#   define __no_pac             "sign-return-address=none"
> +#  endif
>  # endif
>  # define __no_ret_protection   __noscs __attribute__((__target__(__no_pac)))
>  #else
> 

-- 
Kees Cook