Skip to content

Commit f37ccf8

Browse files
nathanchancerafaeljw
authored andcommitted
ACPI: bgrt: Fix CFI violation
clang's Control Flow Integrity requires that every indirect call has a valid target, which is based on the type of the function pointer. The *_show() functions in this file are written as if they will be called from dev_attr_show(); however, they will be called from sysfs_kf_seq_show() because the files were created by sysfs_create_group() and the sysfs ops are based on kobj_sysfs_ops because of kobject_add_and_create(). Because the *_show() functions do not match the type of the show() member in struct kobj_attribute, there is a CFI violation. $ cat /sys/firmware/acpi/bgrt/{status,type,version,{x,y}offset}} 1 0 1 522 307 $ dmesg | grep "CFI failure" [ 267.761825] CFI failure (target: type_show.d5e1ad21498a5fd14edbc5c320906598.cfi_jt+0x0/0x8): [ 267.762246] CFI failure (target: xoffset_show.d5e1ad21498a5fd14edbc5c320906598.cfi_jt+0x0/0x8): [ 267.762584] CFI failure (target: status_show.d5e1ad21498a5fd14edbc5c320906598.cfi_jt+0x0/0x8): [ 267.762973] CFI failure (target: yoffset_show.d5e1ad21498a5fd14edbc5c320906598.cfi_jt+0x0/0x8): [ 267.763330] CFI failure (target: version_show.d5e1ad21498a5fd14edbc5c320906598.cfi_jt+0x0/0x8): Convert these functions to the type of the show() member in struct kobj_attribute so that there is no more CFI violation. Because these functions are all so similar, combine them into a macro. Fixes: d1ff4b1 ("ACPI: Add support for exposing BGRT data") Link: ClangBuiltLinux#1406 Signed-off-by: Nathan Chancellor <nathan@kernel.org> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
1 parent dd9eaa2 commit f37ccf8

1 file changed

Lines changed: 18 additions & 39 deletions

File tree

drivers/acpi/bgrt.c

Lines changed: 18 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -15,40 +15,19 @@
1515
static void *bgrt_image;
1616
static struct kobject *bgrt_kobj;
1717

18-
static ssize_t version_show(struct device *dev,
19-
struct device_attribute *attr, char *buf)
20-
{
21-
return snprintf(buf, PAGE_SIZE, "%d\n", bgrt_tab.version);
22-
}
23-
static DEVICE_ATTR_RO(version);
24-
25-
static ssize_t status_show(struct device *dev,
26-
struct device_attribute *attr, char *buf)
27-
{
28-
return snprintf(buf, PAGE_SIZE, "%d\n", bgrt_tab.status);
29-
}
30-
static DEVICE_ATTR_RO(status);
31-
32-
static ssize_t type_show(struct device *dev,
33-
struct device_attribute *attr, char *buf)
34-
{
35-
return snprintf(buf, PAGE_SIZE, "%d\n", bgrt_tab.image_type);
36-
}
37-
static DEVICE_ATTR_RO(type);
38-
39-
static ssize_t xoffset_show(struct device *dev,
40-
struct device_attribute *attr, char *buf)
41-
{
42-
return snprintf(buf, PAGE_SIZE, "%d\n", bgrt_tab.image_offset_x);
43-
}
44-
static DEVICE_ATTR_RO(xoffset);
45-
46-
static ssize_t yoffset_show(struct device *dev,
47-
struct device_attribute *attr, char *buf)
48-
{
49-
return snprintf(buf, PAGE_SIZE, "%d\n", bgrt_tab.image_offset_y);
50-
}
51-
static DEVICE_ATTR_RO(yoffset);
18+
#define BGRT_SHOW(_name, _member) \
19+
static ssize_t _name##_show(struct kobject *kobj, \
20+
struct kobj_attribute *attr, char *buf) \
21+
{ \
22+
return snprintf(buf, PAGE_SIZE, "%d\n", bgrt_tab._member); \
23+
} \
24+
struct kobj_attribute bgrt_attr_##_name = __ATTR_RO(_name)
25+
26+
BGRT_SHOW(version, version);
27+
BGRT_SHOW(status, status);
28+
BGRT_SHOW(type, image_type);
29+
BGRT_SHOW(xoffset, image_offset_x);
30+
BGRT_SHOW(yoffset, image_offset_y);
5231

5332
static ssize_t image_read(struct file *file, struct kobject *kobj,
5433
struct bin_attribute *attr, char *buf, loff_t off, size_t count)
@@ -60,11 +39,11 @@ static ssize_t image_read(struct file *file, struct kobject *kobj,
6039
static BIN_ATTR_RO(image, 0); /* size gets filled in later */
6140

6241
static struct attribute *bgrt_attributes[] = {
63-
&dev_attr_version.attr,
64-
&dev_attr_status.attr,
65-
&dev_attr_type.attr,
66-
&dev_attr_xoffset.attr,
67-
&dev_attr_yoffset.attr,
42+
&bgrt_attr_version.attr,
43+
&bgrt_attr_status.attr,
44+
&bgrt_attr_type.attr,
45+
&bgrt_attr_xoffset.attr,
46+
&bgrt_attr_yoffset.attr,
6847
NULL,
6948
};
7049

0 commit comments

Comments
 (0)