linux-stable/include/crypto
Jason A. Donenfeld d2a02e3c8b lib/crypto: blake2s: avoid indirect calls to compression function for Clang CFI
blake2s_compress_generic is weakly aliased by blake2s_compress. The
current harness for function selection uses a function pointer, which is
ordinarily inlined and resolved at compile time. But when Clang's CFI is
enabled, CFI still triggers when making an indirect call via a weak
symbol. This seems like a bug in Clang's CFI, as though it's bucketing
weak symbols and strong symbols differently. It also only seems to
trigger when "full LTO" mode is used, rather than "thin LTO".

[    0.000000][    T0] Kernel panic - not syncing: CFI failure (target: blake2s_compress_generic+0x0/0x1444)
[    0.000000][    T0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.16.0-mainline-06981-g076c855b846e #1
[    0.000000][    T0] Hardware name: MT6873 (DT)
[    0.000000][    T0] Call trace:
[    0.000000][    T0]  dump_backtrace+0xfc/0x1dc
[    0.000000][    T0]  dump_stack_lvl+0xa8/0x11c
[    0.000000][    T0]  panic+0x194/0x464
[    0.000000][    T0]  __cfi_check_fail+0x54/0x58
[    0.000000][    T0]  __cfi_slowpath_diag+0x354/0x4b0
[    0.000000][    T0]  blake2s_update+0x14c/0x178
[    0.000000][    T0]  _extract_entropy+0xf4/0x29c
[    0.000000][    T0]  crng_initialize_primary+0x24/0x94
[    0.000000][    T0]  rand_initialize+0x2c/0x6c
[    0.000000][    T0]  start_kernel+0x2f8/0x65c
[    0.000000][    T0]  __primary_switched+0xc4/0x7be4
[    0.000000][    T0] Rebooting in 5 seconds..

Nonetheless, the function pointer method isn't so terrific anyway, so
this patch replaces it with a simple boolean, which also gets inlined
away. This successfully works around the Clang bug.

In general, I'm not too keen on all of the indirection involved here; it
clearly does more harm than good. Hopefully the whole thing can get
cleaned up down the road when lib/crypto is overhauled more
comprehensively. But for now, we go with a simple bandaid.

Fixes: 6048fdcc5f ("lib/crypto: blake2s: include as built-in")
Link: https://github.com/ClangBuiltLinux/linux/issues/1567
Reported-by: Miles Chen <miles.chen@mediatek.com>
Tested-by: Miles Chen <miles.chen@mediatek.com>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Tested-by: John Stultz <john.stultz@linaro.org>
Acked-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2022-02-04 19:22:32 +01:00
..
internal lib/crypto: blake2s: avoid indirect calls to compression function for Clang CFI 2022-02-04 19:22:32 +01:00
acompress.h crypto: api - check for ERR pointers in crypto_destroy_tfm() 2021-03-13 00:04:01 +11:00
aead.h crypto: api - Replace kernel.h with the necessary inclusions 2021-12-17 16:59:48 +11:00
aes.h crypto: aes - helper function to validate key length for AES algorithms 2019-08-09 15:11:43 +10:00
akcipher.h crypto: api - check for ERR pointers in crypto_destroy_tfm() 2021-03-13 00:04:01 +11:00
algapi.h crypto: api - Replace kernel.h with the necessary inclusions 2021-12-17 16:59:48 +11:00
arc4.h crypto: arc4 - refactor arc4 core code into separate library 2019-06-20 14:18:33 +08:00
asym_tpm_subtype.h
authenc.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
b128ops.h
blake2b.h crypto: api - Replace kernel.h with the necessary inclusions 2021-12-17 16:59:48 +11:00
blake2s.h lib/crypto: blake2s: move hmac construction into wireguard 2022-01-18 13:03:55 +01:00
blowfish.h
cast5.h
cast6.h crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN 2020-01-09 11:30:53 +08:00
cast_common.h
chacha.h random: early initialization of ChaCha constants 2022-01-07 00:25:25 +01:00
chacha20poly1305.h crypto: lib/chacha20poly1305 - Add missing function declaration 2020-07-16 21:49:04 +10:00
cryptd.h crypto: api - Replace kernel.h with the necessary inclusions 2021-12-17 16:59:48 +11:00
ctr.h crypto: ctr - add helper for performing a CTR encryption walk 2019-07-26 14:56:07 +10:00
curve25519.h crypto: lib/curve25519 - Move selftest prototype into header file 2020-11-20 14:45:33 +11:00
des.h crypto: des - remove now unused __des3_ede_setkey() 2019-08-22 14:57:33 +10:00
dh.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
drbg.h crypto: drbg - reseed 'nopr' drbgs periodically from get_random_bytes() 2021-11-26 16:16:50 +11:00
ecc_curve.h crypto: ecc - add curve25519 params and expose them 2021-03-13 00:04:04 +11:00
ecdh.h Merge branch 'ecc' 2021-03-26 19:55:55 +11:00
engine.h crypto: api - Replace kernel.h with the necessary inclusions 2021-12-17 16:59:48 +11:00
gcm.h crypto: gcm - helper functions for assoclen/authsize check 2019-08-09 15:11:41 +10:00
gf128mul.h mm, treewide: rename kzfree() to kfree_sensitive() 2020-08-07 11:33:22 -07:00
ghash.h crypto: ghash - add comment and improve help text 2019-07-27 21:08:38 +10:00
hash.h crypto: header - Fix spelling errors 2021-05-28 14:21:08 +08:00
hash_info.h crypto: sha - split sha.h into sha1.h and sha2.h 2020-11-20 14:45:33 +11:00
hmac.h
if_alg.h crypto: af_alg - add extra parameters for DRBG interface 2020-09-25 17:48:52 +10:00
kdf_sp800108.h crypto: kdf - add SP800-108 counter key derivation function 2021-11-26 16:25:17 +11:00
kpp.h crypto: api - check for ERR pointers in crypto_destroy_tfm() 2021-03-13 00:04:01 +11:00
md5.h
nhpoly1305.h crypto: poly1305 - add new 32 and 64-bit generic versions 2020-01-16 15:18:12 +08:00
null.h
padlock.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
pcrypt.h crypto: api - Replace kernel.h with the necessary inclusions 2021-12-17 16:59:48 +11:00
pkcs7.h PKCS#7: Introduce pkcs7_get_digest() 2019-08-05 18:40:19 -04:00
poly1305.h crypto: poly1305 - fix poly1305_core_setkey() declaration 2021-04-02 18:28:12 +11:00
public_key.h keys: X.509 public key issuer lookup without AKID 2022-01-09 00:18:42 +02:00
rng.h crypto: api - check for ERR pointers in crypto_destroy_tfm() 2021-03-13 00:04:01 +11:00
scatterwalk.h crypto: api - Replace kernel.h with the necessary inclusions 2021-12-17 16:59:48 +11:00
serpent.h crypto: x86 - Regularize glue function prototypes 2019-12-11 16:36:54 +08:00
sha1.h crypto: sha - split sha.h into sha1.h and sha2.h 2020-11-20 14:45:33 +11:00
sha1_base.h crypto: sha - split sha.h into sha1.h and sha2.h 2020-11-20 14:45:33 +11:00
sha2.h crypto: sha - split sha.h into sha1.h and sha2.h 2020-11-20 14:45:33 +11:00
sha3.h
sha256_base.h crypto: sha - split sha.h into sha1.h and sha2.h 2020-11-20 14:45:33 +11:00
sha512_base.h crypto: sha - split sha.h into sha1.h and sha2.h 2020-11-20 14:45:33 +11:00
skcipher.h crypto: api - Replace kernel.h with the necessary inclusions 2021-12-17 16:59:48 +11:00
sm2.h crypto: sm2 - introduce OSCCA SM2 asymmetric cipher algorithm 2020-09-25 17:48:54 +10:00
sm3.h crypto: sm3 - export crypto_sm3_final function 2020-09-25 17:48:53 +10:00
sm3_base.h crypto: hash - Use memzero_explicit() for clearing state 2020-10-30 17:35:03 +11:00
sm4.h crypto: arm64/sm4-ce - Make dependent on sm4 library instead of sm4-generic 2021-07-30 10:58:30 +08:00
streebog.h
twofish.h crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN 2020-01-09 11:30:53 +08:00
xts.h crypto: remove CRYPTO_TFM_RES_WEAK_KEY 2020-01-09 11:30:53 +08:00