linux-kernel - Re: [tip:x86/core 1/1] vmlinux.o: warning: objtool: rcar_pcie

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20251013200851.GA2969753@noisy.programming.kicks-ass.net>
Date: Mon, 13 Oct 2025 22:08:51 +0200
From: Peter Zijlstra <peterz@...radead.org>
To: Nathan Chancellor <nathan@...nel.org>
Cc: llvm@...ts.linux.dev, oe-kbuild-all@...ts.linux.dev,
	linux-kernel@...r.kernel.org, x86@...nel.org,
	Ingo Molnar <mingo@...nel.org>, Kees Cook <kees@...nel.org>,
	kernel test robot <lkp@...el.com>,
	Josh Poimboeuf <jpoimboe@...hat.com>
Subject: Re: [tip:x86/core 1/1] vmlinux.o: warning: objtool:
 rcar_pcie_probe+0x13e: no-cfi indirect call!

On Mon, Oct 13, 2025 at 08:50:12PM +0200, Peter Zijlstra wrote:
> On Mon, Oct 13, 2025 at 11:30:59AM -0700, Nathan Chancellor wrote:
> 
> > Is there any way for objtool to detect these instances and emit a
> > slightly differently worded message? Figured it was worth asking ;)
> 
> Objtool doesn't really do value tracking, but I'll see if I can hack
> something together.
> 
> That is, as long as its always:
> 
>   xor %r11, %r11
>   cs call __x86_indirect_thunk_r11
> 
> without any instructions in between, it should be relatively straight
> forward. But the moment there can be anything in between we need to
> track the value of r11 back from the call or something.

vmlinux.o: warning: objtool: rcar_pcie_probe+0x13e: (*NULL)() FTW!

---
diff --git a/tools/objtool/arch/x86/decode.c b/tools/objtool/arch/x86/decode.c
index 0ad5cc70ecbe..2fb92d944d8c 100644
--- a/tools/objtool/arch/x86/decode.c
+++ b/tools/objtool/arch/x86/decode.c
@@ -236,6 +236,19 @@ int arch_decode_instruction(struct objtool_file *file, const struct section *sec
 		}
 		break;
 
+	case 0x31: /* XOR */
+		if (!opts.cfi)
+			break;
+
+		/* kCFI requires all indirect calls through r11 */
+
+		if (modrm_mod == 3 && modrm_reg == modrm_rm) {
+			/* XOR %reg, %reg */
+			if (modrm_reg == 11)
+				insn->type = INSN_ZERO_INDIRECT;
+		}
+		break;
+
 	case 0x50 ... 0x57:
 
 		/* push reg */
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index a5770570b106..9382d5d18885 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -4029,7 +4029,13 @@ static int validate_retpoline(struct objtool_file *file)
 			struct instruction *prev =
 				prev_insn_same_sym(file, insn);
 
-			if (!prev || prev->type != INSN_BUG) {
+			if (!prev) {
+				WARN_INSN(insn, "indirect call as first instruction!");
+				warnings++;
+			} else if (prev->type == INSN_ZERO_INDIRECT) {
+				WARN_INSN(insn, "(*NULL)() FTW!");
+				warnings++;
+			} else if (prev->type != INSN_BUG) {
 				WARN_INSN(insn, "no-cfi indirect call!");
 				warnings++;
 			}
diff --git a/tools/objtool/include/objtool/arch.h b/tools/objtool/include/objtool/arch.h
index be33c7b43180..d9fea571a455 100644
--- a/tools/objtool/include/objtool/arch.h
+++ b/tools/objtool/include/objtool/arch.h
@@ -30,6 +30,7 @@ enum insn_type {
 	INSN_TRAP,
 	INSN_ENDBR,
 	INSN_LEA_RIP,
+	INSN_ZERO_INDIRECT,
 	INSN_OTHER,
 };