| Message ID | 20210312004919.669614-6-samitolvanen@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Add support for Clang CFI | expand |
On Thu, Mar 11, 2021 at 04:49:07PM -0800, Sami Tolvanen wrote: > With CONFIG_CFI_CLANG, a callback function passed to > __queue_delayed_work from a module points to a jump table entry > defined in the module instead of the one used in the core kernel, > which breaks function address equality in this check: > > WARN_ON_ONCE(timer->function != delayed_work_timer_fn); > > Disable the warning when CFI and modules are enabled. Reviewed-by: Kees Cook <keescook@chromium.org>
diff --git a/kernel/workqueue.c b/kernel/workqueue.c index 0d150da252e8..4db267e5ad2d 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -1630,7 +1630,14 @@ static void __queue_delayed_work(int cpu, struct workqueue_struct *wq, struct work_struct *work = &dwork->work; WARN_ON_ONCE(!wq); - WARN_ON_ONCE(timer->function != delayed_work_timer_fn); + /* + * With CFI, timer->function can point to a jump table entry in a module, + * which fails the comparison. Disable the warning if CFI and modules are + * both enabled. + */ + if (!IS_ENABLED(CONFIG_CFI_CLANG) || !IS_ENABLED(CONFIG_MODULES)) + WARN_ON_ONCE(timer->function != delayed_work_timer_fn); + WARN_ON_ONCE(timer_pending(timer)); WARN_ON_ONCE(!list_empty(&work->entry));
With CONFIG_CFI_CLANG, a callback function passed to __queue_delayed_work from a module points to a jump table entry defined in the module instead of the one used in the core kernel, which breaks function address equality in this check: WARN_ON_ONCE(timer->function != delayed_work_timer_fn); Disable the warning when CFI and modules are enabled. Signed-off-by: Sami Tolvanen <samitolvanen@google.com> --- kernel/workqueue.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)