Patch "x86/fineibt: Poison ENDBR at +0" has been added to the 6.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    x86/fineibt: Poison ENDBR at +0

to the 6.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     x86-fineibt-poison-endbr-at-0.patch
and it can be found in the queue-6.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 79f7f4bdb8ae801346e94933d8c848c76e4ea88b
Author: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
Date:   Thu Jun 15 21:35:48 2023 +0200

    x86/fineibt: Poison ENDBR at +0
    
    [ Upstream commit 04505bbbbb15da950ea0239e328a76a3ad2376e0 ]
    
    Alyssa noticed that when building the kernel with CFI_CLANG+IBT and
    booting on IBT enabled hardware to obtain FineIBT, the indirect
    functions look like:
    
      __cfi_foo:
            endbr64
            subl    $hash, %r10d
            jz      1f
            ud2
            nop
      1:
      foo:
            endbr64
    
    This is because the compiler generates code for kCFI+IBT. In that case
    the caller does the hash check and will jump to +0, so there must be
    an ENDBR there. The compiler doesn't know about FineIBT at all; also
    it is possible to actually use kCFI+IBT when booting with 'cfi=kcfi'
    on IBT enabled hardware.
    
    Having this second ENDBR however makes it possible to elide the CFI
    check. Therefore, we should poison this second ENDBR when switching to
    FineIBT mode.
    
    Fixes: 931ab63664f0 ("x86/ibt: Implement FineIBT")
    Reported-by: "Milburn, Alyssa" <alyssa.milburn@xxxxxxxxx>
    Signed-off-by: Peter Zijlstra (Intel) <peterz@xxxxxxxxxxxxx>
    Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>
    Reviewed-by: Sami Tolvanen <samitolvanen@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230615193722.194131053@xxxxxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index f615e0cb6d932..4e2c70f88e05b 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -940,6 +940,17 @@ static int cfi_rewrite_preamble(s32 *start, s32 *end)
 	return 0;
 }
 
+static void cfi_rewrite_endbr(s32 *start, s32 *end)
+{
+	s32 *s;
+
+	for (s = start; s < end; s++) {
+		void *addr = (void *)s + *s;
+
+		poison_endbr(addr+16, false);
+	}
+}
+
 /* .retpoline_sites */
 static int cfi_rand_callers(s32 *start, s32 *end)
 {
@@ -1034,14 +1045,19 @@ static void __apply_fineibt(s32 *start_retpoline, s32 *end_retpoline,
 		return;
 
 	case CFI_FINEIBT:
+		/* place the FineIBT preamble at func()-16 */
 		ret = cfi_rewrite_preamble(start_cfi, end_cfi);
 		if (ret)
 			goto err;
 
+		/* rewrite the callers to target func()-16 */
 		ret = cfi_rewrite_callers(start_retpoline, end_retpoline);
 		if (ret)
 			goto err;
 
+		/* now that nobody targets func()+0, remove ENDBR there */
+		cfi_rewrite_endbr(start_cfi, end_cfi);
+
 		if (builtin)
 			pr_info("Using FineIBT CFI\n");
 		return;