linux-kernel - Re: [RESEND PATCH] arch: arm64: set __nocfi on swsusp_arch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aXIW_U72IIEETsi0@willie-the-truck>
Date: Thu, 22 Jan 2026 12:24:29 +0000
From: Will Deacon <will@...nel.org>
To: Zhaoyang Huang <huangzhaoyang@...il.com>
Cc: "zhaoyang.huang" <zhaoyang.huang@...soc.com>,
	Catalin Marinas <catalin.marinas@....com>,
	James Morse <james.morse@....com>,
	linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
	steve.kang@...soc.com, jeson.gao@...soc.com, xuewen.yan@...soc.com
Subject: Re: [RESEND PATCH] arch: arm64: set __nocfi on swsusp_arch_resume

On Thu, Jan 22, 2026 at 07:39:34PM +0800, Zhaoyang Huang wrote:
> On Thu, Jan 22, 2026 at 6:32 PM Will Deacon <will@...nel.org> wrote:
> > On Tue, Jan 20, 2026 at 02:06:19PM +0800, zhaoyang.huang wrote:
> > > diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
> > > index 18749e9a6c2d..9717568518ba 100644
> > > --- a/arch/arm64/kernel/hibernate.c
> > > +++ b/arch/arm64/kernel/hibernate.c
> > > @@ -402,7 +402,7 @@ int swsusp_arch_suspend(void)
> > >   * Memory allocated by get_safe_page() will be dealt with by the hibernate code,
> > >   * we don't need to free it here.
> > >   */
> > > -int swsusp_arch_resume(void)
> > > +int __nocfi swsusp_arch_resume(void)
> > >  {
> > >       int rc;
> > >       void *zero_page;
> >
> > Why does is the '__nocfi' annotation here rather than on the
> > 'hibernate_exit' pointer?
> Our first try is to have the callee function(swsusp_arch_suspend_exit)
> waived by set __nocfi but failed. It seems like the CFI watched the
> caller of function pointer and plant stub code.

Thinking about this some more, you're right that the '__nocfi'
annotation has to happen at the call-site, because that's where the
check takes place.

I did start looking at what it would take to emit the CFI type prefix
for swsusp_arch_suspend_exit() using SYM_TYPED_FUNC_START() but it's a
bit grotty having to offset into .hibernate_exit.text when jumping to
the copy and, given that trans_pgd_idmap_page doesn't seem to bother
with BTI at all, your patch looks like the simplest point fix.

I'll ack the resend...

Will