android CFI

CFI

cfi_slowpath_handler/__cfi_slowpath

kernel/cfi.c

/* Compiler-defined handler names */
#ifdef CONFIG_CFI_PERMISSIVE
#define cfi_failure_handler    __ubsan_handle_cfi_check_fail
#define cfi_slowpath_handler    __cfi_slowpath_diag
#else /* enforcing */
#define cfi_failure_handler    __ubsan_handle_cfi_check_fail_abort
#define cfi_slowpath_handler    __cfi_slowpath   //替换为__cfi_slowpath

#endif /* CONFIG_CFI_PERMISSIVE */

 

static inline cfi_check_fn find_cfi_check(void *ptr)
{
    bool rcu;
    cfi_check_fn f;
    rcu = rcu_is_watching();
    if (!rcu)
        rcu_nmi_enter();
#ifdef CONFIG_CFI_CLANG_SHADOW
    /* Look up the __cfi_check function to use */
    rcu_read_lock_sched();
    f = ptr_to_check_fn(rcu_dereference_sched(cfi_shadow),
                (unsigned long)ptr);
    rcu_read_unlock_sched();
    if (f)
        goto out;
    /*
     * Fall back to find_module_cfi_check, which works also for a larger
     * module address space, but is slower.
     */
#endif /* CONFIG_CFI_CLANG_SHADOW */
    f = find_module_cfi_check(ptr);
out:
    if (!rcu)
        rcu_nmi_exit();
    return f;
}

 

void cfi_slowpath_handler(uint64_t id, void *ptr, void *diag)
{
    cfi_check_fn check = find_cfi_check(ptr);
    if (likely(check))
        check(id, ptr, diag);
    else /* Don't allow unchecked modules */
        handle_cfi_failure(ptr);
}