Repository navigation
x86: fault: emulate trampolines that start with endbr - #87
Merged
Merged
Conversation
gcc built with -fcf-protection, the default on Ubuntu and Fedora, starts its nested-function trampolines with endbr64, or endbr32 for 32-bit code. The EMUTRAMP matchers compare the bytes at the faulting address against trampolines that start with a mov, so none of these match and the task is killed with SIGSEGV. Skip a leading endbr before matching. The only relative target, the 32-bit jmp, is computed from the address after it. Signed-off-by: Kavi <kavi@edera.dev>
alexandermerritt
approved these changes
Nov 5, 2026
| int err; | ||
|
|
||
| /* With -fcf-protection, gcc starts its trampolines with endbr32. */ | ||
| if (!get_user(endbr, (unsigned int __user *) ip) && endbr == 0xFB1E0FF3) |
3 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OpenPaX EMUTRAMP kills any program that calls a gcc nested function through its stack trampoline when gcc built it with
-fcf-protection, the default on Ubuntu and Fedora. gcc then starts the trampoline withendbr64, andopenpax_emulate_trampoline_64()compares the bytes at the faulting address against patterns that start with amov, so nothing matches and the task gets SIGSEGV.Both matchers now skip a leading
endbr64orendbr32before comparing. The 32-bit relative jump target is computed from the address after it.Tested on edera/6.18-lts in a Xen PV zone, where a CET-built nested-function trampoline went from SIGSEGV to running. The 32-bit path was not exercised.
COR-207