bughz/anbox-modules
1
0
Fork 0
mirror of https://github.com/choff/anbox-modules.git synced 2026-10-17 16:55:48 +08:00
Code Issues Packages Projects Releases Wiki Activity

binder: fix kallsyms_lookup_name address with X86_KERNEL_IBT

Browse Source 
With IBT the kprobe address skips the ENDBR64 at function entry, so
calling it indirectly raises a control-protection fault (kernel BUG at
arch/x86/kernel/cet.c) the first time binderfs is mounted. Step back
over the ENDBR64 when it is there.
This commit is contained in:
Anthony 2026-10-13 22:28:42 +02:00
parent 0ee331db89
commit 63e80d8ea7
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
binder/deps.c
View File

@ -42,6 +42,20 @@ static kallsyms_lookup_name_t get_kallsyms_lookup_name_ptr(void)
addr = (kallsyms_lookup_name_t) probe.addr; addr = (kallsyms_lookup_name_t) probe.addr;
unregister_kprobe(&probe); unregister_kprobe(&probe);
#ifdef CONFIG_X86_KERNEL_IBT
/*
* With IBT, kprobes skip the function's ENDBR64, so probe.addr is 4
* bytes past the entry. An indirect call there raises #CP; step back.
*/
{
const u8 endbr64[] = { 0xf3, 0x0f, 0x1e, 0xfa };
u8 *p = (u8 *)addr - sizeof(endbr64);
if (!memcmp(p, endbr64, sizeof(endbr64)))
addr = (kallsyms_lookup_name_t)p;
}
#endif
return addr; return addr;
} }
#endif #endif