iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

lkdtm: cfi: Make PAC test work with GCC 7 and 8

Browse Source 
The CFI test uses the branch-protection=none compiler attribute to
disable PAC return address protection on a function. While newer GCC
versions support this attribute, older versions (GCC 7 and 8) instead
supported the sign-return-address=none attribute, leading to a build
failure when the test is built with older compilers. Fix it by checking
which attribute is supported and using the correct one.

Fixes: 2e53b877dc ("lkdtm: Add CFI_BACKWARD to test ROP mitigations")
Reported-by: Daniel Díaz <daniel.diaz@linaro.org>
Signed-off-by: Kristina Martsenko <kristina.martsenko@arm.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/CAEUSe78kDPxQmQqCWW-_9LCgJDFhAeMoVBFnX9QLx18Z4uT4VQ@mail.gmail.com/
This commit is contained in:
Kristina Martsenko 2022-12-09 17:34:41 +00:00 committed by Kees Cook
parent 00dd027f72
commit f68022ae0a
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/misc/lkdtm/cfi.c
View File

@ -54,7 +54,11 @@ static void lkdtm_CFI_FORWARD_PROTO(void)
# ifdef CONFIG_ARM64_BTI_KERNEL
# define __no_pac "branch-protection=bti"
# else
# define __no_pac "branch-protection=none"
# ifdef CONFIG_CC_HAS_BRANCH_PROT_PAC_RET
# define __no_pac "branch-protection=none"
# else
# define __no_pac "sign-return-address=none"
# endif
# endif
# define __no_ret_protection __noscs __attribute__((__target__(__no_pac)))
#else