Re: [PATCH] x86/kexec: Type relocate_kernel() to drop __nocfi

[Josh Poimboeuf]

On Wed, Nov 11, 2026 at 03:26:59PM -0800, Ben Cressey wrote:
> machine_kexec() calls the control page's copy of relocate_kernel()
> indirectly. The routine has no kCFI type, so all of machine_kexec() is
> exempt since commit 2114796ca041 ("x86/kexec: Mark machine_kexec() with
> __nocfi"), and ANNOTATE_NOCFI_SYM() silences objtool.
> 
> No other call there loses its check today, but one added later would.
> Review of that mark on arm64 preferred a typed entry, and objected to
> covering a whole function, on x86 too [1].
> 
> Typing the routine was set aside in 2025 as not worth it [2]: a type
> from the caller cannot catch a prototype that drifts, and
> machine_kexec() seemed unlikely to follow a stray pointer.
> 
> Type the routine with SYM_TYPED_START(), emit an ENDBR only under
> CONFIG_FINEIBT, whose boot-time rewrite skips a function without one,
> and drop both exemptions, along with kexec as a valid use in annotate.h.
> 
> The check guards only the pointer, and not reliably under plain FineIBT,
> which checks in the callee with IBT off. A failed check panics or hangs
> with no CFI report, since load_segments() has reset GS.
> 
> Link: https://lore.kernel.org/202609241804.BB23BF10@keescook # [1]
> Link: https://lore.kernel.org/9c41ab61efc573e3ab5a75b6e4031f81db84a846.camel@xxxxxxxxxxxxx # [2]
> Signed-off-by: Ben Cressey <ben@xxxxxxxxxxx>
> ---
> This follows Kees Cook's review [1] of the arm64 kexec fix, which goes
> separately. It is not a security fix, and nothing faults here today.
> The copy gains a type hash and, with CONFIG_FINEIBT=y, an ENDBR, bare
> under cfi=kcfi or cfi=off. SYM_TYPED_FUNC_START() is not used, since it
> would put an ENDBR in every IBT build. Code built with CONFIG_CFI=n is
> unchanged. A failed check stops crash kexec too.
> 
> An LLM wrote the patch and drafted the changelog.

No objection to the change itself, but PLEASE no LLM-written changelogs
or comments, they tend to read like Rube Goldberg machines and these are
no exception...

-- 
Josh