The kernel seals the ENDBR64 of functions it never calls indirectly
(kallsyms_lookup_name, can_nice, the security_binder_* hooks...), so
stepping back over ENDBR64 is not enough: there is none left, and the
indirect call still raises #CP when binderfs is mounted. Reach these
functions with push+ret, which IBT does not track.
With IBT the kprobe address skips the ENDBR64 at function entry, so
calling it indirectly raises a control-protection fault (kernel BUG at
arch/x86/kernel/cet.c) the first time binderfs is mounted. Step back
over the ENDBR64 when it is there.
Over the last years, many fixes and changes have been applied to
Binder in the Linux kernel, but these fixes were never backported
to anbox-modules. The meant that the version of Binder in anbox-modules
was very outdated.
With this commit, Binder has been update to the latest state from
the Linux kernel. This should also fix the compile on kernel 5.12
and later.
On kernel 5.7 and later, kallsyms_lookup_name() can no longer be called from a kernel
module for reasons described here: https://lwn.net/Articles/813350/
As binder really needs to use kallsysms_lookup_name() to access some kernel
functions that otherwise wouldn't be accessible, KProbes are used on later
kernels to get the address of kallsysms_lookup_name(). The function is
afterwards used just as before. This is a very dirty hack though and the much
better solution would be if all the functions that are currently resolved
with kallsysms_lookup_name() would get an EXPORT_SYMBOL() annotation to
make them directly accessible to kernel modules.
