Commit 2114796c authored by David Woodhouse's avatar David Woodhouse Committed by Borislav Petkov (AMD)
Browse files

x86/kexec: Mark machine_kexec() with __nocfi 



A recent commit caused the relocate_kernel() function to be invoked through
a function pointer, but it does not have CFI information. The resulting trap
occurs after the IDT and GDT have been invalidated, leading to a triple-fault
if CONFIG_CFI_CLANG is enabled.

Using SYM_TYPED_FUNC_START() to provide the CFI information looks like it will
require a prolonged battle with objtool. And is fairly pointless anyway, as
the actual signature comes from a __kcfi_typeid_… symbol emitted from the
C code based on the function prototype it thinks that relocate_kernel has,
rendering the check somewhat tautological.

The simple fix is just to mark machine_kexec() with __nocfi.

Fixes: eeebbde5 ("x86/kexec: Invoke copy of relocate_kernel() instead of the original")
Reported-by: default avatarNathan Chancellor <nathan@kernel.org>
Suggested-by: default avatarNathan Chancellor <nathan@kernel.org>
Signed-off-by: default avatarDavid Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: default avatarBorislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20250109140757.2841269-7-dwmw2@infradead.org
parent eeed9150

arch/x86/kernel/machine_kexec_64.c

+1 −1
Original line number Diff line number Diff line
@@ -342,7 +342,7 @@ void machine_kexec_cleanup(struct kimage *image) 
 * Do not allocate memory (or fail in any way) in machine_kexec().

 * We are past the point of no return, committed to rebooting now.

 */

void machine_kexec(struct kimage *image)

void __nocfi machine_kexec(struct kimage *image)

{

	unsigned long (*relocate_kernel_ptr)(unsigned long indirection_page,

					     unsigned long pa_control_page,