Skip to content

CFI: function type mismatches in indirect calls optimized into direct calls #1705

Open
@samitolvanen

Description

@samitolvanen

With KCFI and -mllvm -debug-only=instcombine-kcfi, Clang prints out a list of indirect calls that were converted into direct calls (and possibly later inlined), but whose function type didn't exactly match the original indirect call function pointer:

  • drivers/char/tpm/tpm-chip.c: devm_add_action_or_reset -> put_device
  • drivers/mmc/host/meson-mx-sdhc-mmc.c: devm_add_action_or_reset -> mmc_free_host
  • drivers/net/ethernet/brocade/bna/bfa_ioc.c: bfa_nw_ioc_attach -> bfa_ioc_sm_uninit
  • drivers/net/ethernet/brocade/bna/bna_enet.c: bna_enet_enable -> bna_enet_sm_stopped
  • drivers/net/ethernet/brocade/bna/bna_enet.c: bna_ioceth_enable -> bna_ioceth_sm_stopped
  • drivers/net/ethernet/brocade/bna/bna_tx_rx.c: bna_rx_enable -> bna_rx_sm_stopped
  • drivers/net/ethernet/brocade/bna/bna_tx_rx.c: bna_tx_enable -> bna_tx_sm_stopped
  • drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c: devm_add_action_or_reset -> clk_disable_unprepare
  • drivers/net/ethernet/ti/cpts.c: cpts_of_mux_clk_setup -> clk_hw_unregister_mux
  • drivers/net/ethernet/ti/cpts.c: cpts_of_mux_clk_setup -> of_clk_del_provider
  • drivers/nvmem/meson-efuse.c: devm_add_action_or_reset -> clk_disable_unprepare
  • drivers/pci/controller/dwc/pcie-keembay.c: devm_add_action_or_reset -> clk_disable_unprepare
  • drivers/pci/controller/dwc/pci-meson.c: devm_add_action_or_reset -> clk_disable_unprepare
  • drivers/pci/controller/pcie-microchip-host.c: devm_add_action_or_reset -> clk_disable_unprepare
  • drivers/rtc/rtc-msc313.c: devm_add_action_or_reset -> clk_disable_unprepare
  • drivers/rtc/rtc-ti-k3.c: devm_add_action_or_reset -> clk_disable_unprepare
  • drivers/scsi/bfa/bfad.c: bfad_sm_failed -> bfad_sm_fcs_exit
  • drivers/scsi/bfa/bfa_fcs_lport.c: bfa_fcs_lport_init -> bfa_fcs_lport_sm_uninit
  • drivers/scsi/bfa/bfa_fcs_lport.c: bfa_fcs_lport_ms_fabric_rscn -> bfa_fcs_lport_ms_sm_online
  • drivers/scsi/bfa/bfa_fcs_lport.c: bfa_fcs_lport_ns_query -> bfa_fcs_lport_ns_sm_online
  • drivers/scsi/bfa/bfa_ioc.c: bfa_ioc_attach -> bfa_ioc_sm_uninit
  • drivers/soc/apple/rtkit.c: devm_add_action_or_reset -> apple_rtkit_free
  • drivers/soc/apple/sart.c: devm_add_action_or_reset -> put_device
  • drivers/soc/ti/pruss.c: pruss_clk_mux_setup -> clk_unregister_mux
  • drivers/tty/serial/meson_uart.c: devm_add_action_or_reset -> clk_disable_unprepare
  • drivers/tty/serial/sccnxp.c: devm_add_action_or_reset -> clk_disable_unprepare
  • sound/pci/ctxfi/ctatc.c: atc_create_hw_devs -> amixer_mgr_create
  • sound/pci/ctxfi/ctatc.c: atc_create_hw_devs -> daio_mgr_create
  • sound/pci/ctxfi/ctatc.c: atc_create_hw_devs -> srcimp_mgr_create
  • sound/pci/ctxfi/ctatc.c: atc_create_hw_devs -> src_mgr_create
  • sound/pci/ctxfi/ctatc.c: atc_create_hw_devs -> sum_mgr_create
  • sound/pci/ctxfi/ctatc.c: ct_atc_destroy -> amixer_mgr_destroy
  • sound/pci/ctxfi/ctatc.c: ct_atc_destroy -> daio_mgr_destroy
  • sound/pci/ctxfi/ctatc.c: ct_atc_destroy -> srcimp_mgr_destroy
  • sound/pci/ctxfi/ctatc.c: ct_atc_destroy -> src_mgr_destroy
  • sound/pci/ctxfi/ctatc.c: ct_atc_destroy -> sum_mgr_destroy
  • sound/soc/meson/aiu.c: devm_add_action_or_reset -> clk_disable_unprepare
  • sound/soc/meson/t9015.c: devm_add_action_or_reset -> clk_disable_unprepare
  • virt/kvm/kvm_main.c: kvm_mmu_notifier_invalidate_range_end -> kvm_null_fn

Should the compiler at a later time not perform this optimization, these calls will trip CFI checking. Ideally they should be fixed for correctness either way.

Metadata

Metadata

Assignees

Labels

[FEATURE] CFIRelated to building the kernel with Clang Control Flow Integrity

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions