From patchwork Sat Mar 10 06:40:59 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Joao Moreira X-Patchwork-Id: 10273191 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 21B4E605CE for ; Sat, 10 Mar 2018 06:41:26 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0A92329D3F for ; Sat, 10 Mar 2018 06:41:26 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id F37FD29D6F; Sat, 10 Mar 2018 06:41:25 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 2C04D29D3F for ; Sat, 10 Mar 2018 06:41:24 +0000 (UTC) Received: (qmail 3637 invoked by uid 550); 10 Mar 2018 06:41:23 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 3599 invoked from network); 10 Mar 2018 06:41:22 -0000 X-Virus-Scanned: by amavisd-new at test-mx.suse.de From: Joao Moreira To: kernel-hardening@lists.openwall.com Cc: linux-kernel@vger.kernel.org, danielmicay@gmail.com, keescook@chromium.org Subject: [PATCH] vgacon: fix function prototypes Date: Sat, 10 Mar 2018 03:40:59 -0300 Message-Id: <20180310064059.12720-1-jmoreira@suse.de> X-Mailer: git-send-email 2.13.6 MIME-Version: 1.0 X-Virus-Scanned: ClamAV using ClamSMTP It is possible to indirectly invoke functions with prototypes that do not match those of the respectively used function pointers by using void types. Despite widely used as a feature for relaxing function invocation, this should be avoided when possible as it may prevent the use of heuristics such as prototype matching-based Control-Flow Integrity, which can be used to prevent ROP-based attacks. Given the above, the current efforts to improve the Linux security, and the upcoming kernel support to compilers with CFI features, fix prototypes in vgacon console driver. Another similar fix can be seen in [1]. [1] https://android-review.googlesource.com/c/kernel/common/+/602010 Signed-off-by: João Moreira Acked-by: Kees Cook Acked-by: Bartlomiej Zolnierkiewicz --- drivers/video/console/vgacon.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c index a17ba1465815..f00b630f6839 100644 --- a/drivers/video/console/vgacon.c +++ b/drivers/video/console/vgacon.c @@ -1407,21 +1407,29 @@ static bool vgacon_scroll(struct vc_data *c, unsigned int t, unsigned int b, * The console `switch' structure for the VGA based console */ -static int vgacon_dummy(struct vc_data *c) +static int vgacon_clear(struct vc_data *c) { return 0; } -#define DUMMY (void *) vgacon_dummy +static void vgacon_putc(struct vc_data *c, int a, int b, int d) +{ + return; +} + +static void vgacon_putcs(struct vc_data *c, ushort *s, int a, int b, int d) +{ + return; +} const struct consw vga_con = { .owner = THIS_MODULE, .con_startup = vgacon_startup, .con_init = vgacon_init, .con_deinit = vgacon_deinit, - .con_clear = DUMMY, - .con_putc = DUMMY, - .con_putcs = DUMMY, + .con_clear = vgacon_clear, + .con_putc = vgacon_putc, + .con_putcs = vgacon_putcs, .con_cursor = vgacon_cursor, .con_scroll = vgacon_scroll, .con_switch = vgacon_switch,