projects/linux·commit 23a38e7b

Merge tag 'x86-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

23a38e7b · Linus Torvalds <[email protected]> · 2026-10-18 07:38:37 -10:00

Pull x86 fix from Ingo Molnar:

 - Fix kCFI decoding bug on CONFIG_FINEIBT=y kernels running in
   kCFI mode (Kees Cook)

* tag 'x86-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/kcfi: Decode the kCFI check from the trap address
Commit
23a38e7bb2f9ad99c317a9f4e4c349054de9dfff
Parents
88328f85 · 4505a262

Merge commit. Changes below are compared with the first parent: 88328f85.

Changes

1 files changed · +7 −7

FileStatusAddDelContent
arch/x86/kernel/cfi.cmodified+7−7View file

arch/x86/kernel/cfi.c

View file
diff --git a/arch/x86/kernel/cfi.c b/arch/x86/kernel/cfi.c
index 1df26df..8e5c4ed 100644
--- a/arch/x86/kernel/cfi.c
+++ b/arch/x86/kernel/cfi.c
@@ -10,11 +10,11 @@
#include <asm/insn-eval.h>
/*
- * Returns the target address and the expected type when regs->ip points
+ * Returns the target address and the expected type when addr points
* to a compiler-generated CFI trap.
*/
-static bool decode_cfi_insn(struct pt_regs *regs, unsigned long *target,
- u32 *type)
+static bool decode_cfi_insn(struct pt_regs *regs, unsigned long addr,
+ unsigned long *target, u32 *type)
{
char buffer[MAX_INSN_SIZE];
struct insn insn;
@@ -29,13 +29,13 @@ static bool decode_cfi_insn(struct pt_regs *regs, unsigned long *target,
*   movl -<id>, %r10d ; 6 bytes
* addl -<pos>(%reg), %r10d; 4 bytes
* je .Ltmp1 ; 2 bytes
- * ud2 ; <- regs->ip
+ * ud2 ; <- addr
* .Ltmp1:
*
* We can decode the expected type and the target address from the
* movl/addl instructions.
*/
- if (copy_from_kernel_nofault(buffer, (void *)regs->ip - 12, MAX_INSN_SIZE))
+ if (copy_from_kernel_nofault(buffer, (void *)addr - 12, MAX_INSN_SIZE))
return false;
if (insn_decode_kernel(&insn, &buffer[offset]))
return false;
@@ -44,7 +44,7 @@ static bool decode_cfi_insn(struct pt_regs *regs, unsigned long *target,
*type = -(u32)insn.immediate.value;
- if (copy_from_kernel_nofault(buffer, (void *)regs->ip - 6, MAX_INSN_SIZE))
+ if (copy_from_kernel_nofault(buffer, (void *)addr - 6, MAX_INSN_SIZE))
return false;
if (insn_decode_kernel(&insn, &buffer[offset]))
return false;
@@ -82,7 +82,7 @@ enum bug_trap_type handle_cfi_failure(struct pt_regs *regs)
return BUG_TRAP_TYPE_NONE;
}
- if (!decode_cfi_insn(regs, &target, &type))
+ if (!decode_cfi_insn(regs, addr, &target, &type))
return report_cfi_failure_noaddr(regs, addr);
break;