From: David Woodhouse Date: Thu, 9 Jan 2025 14:04:18 +0000 (+0000) Subject: x86/kexec: Mark machine_kexec() with __nocfi X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=2114796ca041;p=users%2Fdwmw2%2Flinux.git x86/kexec: Mark machine_kexec() with __nocfi A recent commit caused the relocate_kernel() function to be invoked through a function pointer, but it does not have CFI information. The resulting trap occurs after the IDT and GDT have been invalidated, leading to a triple-fault if CONFIG_CFI_CLANG is enabled. Using SYM_TYPED_FUNC_START() to provide the CFI information looks like it will require a prolonged battle with objtool. And is fairly pointless anyway, as the actual signature comes from a __kcfi_typeid_… symbol emitted from the C code based on the function prototype it thinks that relocate_kernel has, rendering the check somewhat tautological. The simple fix is just to mark machine_kexec() with __nocfi. Fixes: eeebbde57113 ("x86/kexec: Invoke copy of relocate_kernel() instead of the original") Reported-by: Nathan Chancellor Suggested-by: Nathan Chancellor Signed-off-by: David Woodhouse Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20250109140757.2841269-7-dwmw2@infradead.org --- diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c index 9232ad1562c88..1440f792a86dc 100644 --- a/arch/x86/kernel/machine_kexec_64.c +++ b/arch/x86/kernel/machine_kexec_64.c @@ -342,7 +342,7 @@ void machine_kexec_cleanup(struct kimage *image) * Do not allocate memory (or fail in any way) in machine_kexec(). * We are past the point of no return, committed to rebooting now. */ -void machine_kexec(struct kimage *image) +void __nocfi machine_kexec(struct kimage *image) { unsigned long (*relocate_kernel_ptr)(unsigned long indirection_page, unsigned long pa_control_page,