From 63e80d8ea7267ca66b255f840c210d1f53ff0fd3 Mon Sep 17 00:00:00 2001
From: Anthony <dedeanth@gmail.com>
Date: Tue, 13 Oct 2026 22:28:42 +0200
Subject: [PATCH] binder: fix kallsyms_lookup_name address with X86_KERNEL_IBT

With IBT the kprobe address skips the ENDBR64 at function entry, so
calling it indirectly raises a control-protection fault (kernel BUG at
arch/x86/kernel/cet.c) the first time binderfs is mounted. Step back
over the ENDBR64 when it is there.
---
 binder/deps.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/binder/deps.c b/binder/deps.c
index 63accc0..cc2da65 100644
--- a/binder/deps.c
+++ b/binder/deps.c
@@ -42,6 +42,20 @@ static kallsyms_lookup_name_t get_kallsyms_lookup_name_ptr(void)
 	addr = (kallsyms_lookup_name_t) probe.addr;
 	unregister_kprobe(&probe);
 
+#ifdef CONFIG_X86_KERNEL_IBT
+	/*
+	 * With IBT, kprobes skip the function's ENDBR64, so probe.addr is 4
+	 * bytes past the entry. An indirect call there raises #CP; step back.
+	 */
+	{
+		const u8 endbr64[] = { 0xf3, 0x0f, 0x1e, 0xfa };
+		u8 *p = (u8 *)addr - sizeof(endbr64);
+
+		if (!memcmp(p, endbr64, sizeof(endbr64)))
+			addr = (kallsyms_lookup_name_t)p;
+	}
+#endif
+
 	return addr;
 }
 #endif