From f5fb1e4f4d60fbb9d8785bbc922d1a5ae442e56f Mon Sep 17 00:00:00 2001 From: diabl0w Date: Thu, 15 Oct 2026 14:49:50 -0400 Subject: [PATCH 01/17] Update dfroot.c --- lkm/dfroot.c | 42 +++++++++++------------------------------- 1 file changed, 11 insertions(+), 31 deletions(-) diff --git a/lkm/dfroot.c b/lkm/dfroot.c index 4a6ee4d2..52f79f67 100644 --- a/lkm/dfroot.c +++ b/lkm/dfroot.c @@ -24,38 +24,18 @@ static insn_patch_t insn_patch_text; static __nocfi void patch_fn_ret_zero(void *fn) { - u32 insn = *(u32 *)fn; - int skip = 0; - bool pac_a = false, pac_b = false; - void *addrs[2]; - u32 insns[2]; - - while (skip < 2) { - switch (insn) { - case 0xD503233F: pac_a = true; goto skip_insn; /* PACIASP */ - case 0xD503237F: pac_b = true; goto skip_insn; /* PACIBSP */ - case 0xD503241F: /* BTI */ - case 0xD503245F: /* BTI c */ - case 0xD503249F: /* BTI j */ - case 0xD50324DF: /* BTI jc */ - skip_insn: - insn = *(u32 *)((u8 *)fn + ++skip * 4); - continue; - } - break; - } + void *addrs[3]; + u32 insns[3]; + + addrs[0] = fn; + addrs[1] = (u8 *)fn + 4; + addrs[2] = (u8 *)fn + 8; + + insns[0] = 0xD503245F; // BTI C (valid landing pad, NOP when BTI not enforced) + insns[1] = 0xD2800000; // MOV x0, #0 + insns[2] = 0xD65F03C0; // RET - addrs[0] = (u8 *)fn + skip * 4; - addrs[1] = (u8 *)fn + skip * 4 + 4; - insns[0] = 0xD2800000; - /* PACIASP/PACIBSP are hint-space NOPs on CPUs without ARMv8.3 pointer auth, - * but RETAA/RETAB are not — they fault as undefined. Only emit them when - * hardware auth is actually present and the signed LR needs stripping. */ - insns[1] = (pac_b && system_supports_address_auth()) ? 0xD65F0FFF : - (pac_a && system_supports_address_auth()) ? 0xD65F0BFF : - 0xD65F03C0; - - if (insn_patch_text(addrs, insns, 2)) + if (aarch64_insn_patch_text(addrs, insns, 3)) pr_warn("dfroot: patch failed at %px\n", fn); } From d1e07e1ffe7341324474d3e4f60ee7660249cc42 Mon Sep 17 00:00:00 2001 From: diabl0w Date: Thu, 15 Oct 2026 15:10:25 -0400 Subject: [PATCH 02/17] Update dfroot.c --- lkm/dfroot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lkm/dfroot.c b/lkm/dfroot.c index 52f79f67..e3eabfdc 100644 --- a/lkm/dfroot.c +++ b/lkm/dfroot.c @@ -35,7 +35,7 @@ static __nocfi void patch_fn_ret_zero(void *fn) insns[1] = 0xD2800000; // MOV x0, #0 insns[2] = 0xD65F03C0; // RET - if (aarch64_insn_patch_text(addrs, insns, 3)) + if (insn_patch_text(addrs, insns, 3)) pr_warn("dfroot: patch failed at %px\n", fn); } From b85a9931ad45ff457c9e199228c5607564431f2a Mon Sep 17 00:00:00 2001 From: diabl0w Date: Thu, 15 Oct 2026 15:27:51 -0400 Subject: [PATCH 03/17] Update dfroot.c --- lkm/dfroot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lkm/dfroot.c b/lkm/dfroot.c index e3eabfdc..784f35eb 100644 --- a/lkm/dfroot.c +++ b/lkm/dfroot.c @@ -61,7 +61,7 @@ static int __nocfi __init dfroot_init(void) static char cmd[512]; static char *envp[] = { "PATH=/system/bin", NULL }; static char *argv[] = { (char *)sh, "-c", cmd, NULL }; - snprintf(cmd, sizeof(cmd), "touch /dev/dfm0; exec %s", bootstrap); + snprintf(cmd, sizeof(cmd), "touch /dev/dfm0; echo -n 'u:r:ksud:s0' > /proc/self/attr/exec; exec %s", bootstrap); // Symbol finder kln_kp = (struct kprobe){ .symbol_name = "kallsyms_lookup_name" }; From b55904a635440418786bb74f732e89f1f84a6be1 Mon Sep 17 00:00:00 2001 From: diabl0w Date: Thu, 15 Oct 2026 15:32:22 -0400 Subject: [PATCH 04/17] Update bootstrap.c --- app/src/main/jni/bootstrap.c | 35 +++++++++-------------------------- 1 file changed, 9 insertions(+), 26 deletions(-) diff --git a/app/src/main/jni/bootstrap.c b/app/src/main/jni/bootstrap.c index 9f379bc0..b05447c4 100644 --- a/app/src/main/jni/bootstrap.c +++ b/app/src/main/jni/bootstrap.c @@ -219,33 +219,16 @@ int main(void) } } - touch("/dev/dfm5"); - // ksu only allows init to switch to ksud context and we are in kernel context now - // once ksu starts, selinux is enforcing, but here its still permissive - // switch our context while we still can - pid_t pid = fork(); - if (pid < 0) - return 1; - if (pid == 0) { - int fd = open("/proc/self/attr/current", O_WRONLY); - if (fd >= 0) { - const char *ctx = "u:r:init:s0"; - write(fd, ctx, strlen(ctx)); - close(fd); + touch("/dev/dfm5"); + if (run_ctx(NULL, (char *[]){ KSUD_STAGE, "late-load", "--package-name", su_manager, NULL }) == 0) { + touch("/dev/dfm6"); + if (soft_reboot) { + while (late_load_running()) sleep(1); + run_ctx("u:r:ksu:s0", (char *[]){ KSUD, "soft-reboot", NULL }); } - if (run_ctx(NULL, (char *[]){ KSUD_STAGE, "late-load", "--package-name", su_manager, NULL }) == 0) { - touch("/dev/dfm6"); - if (soft_reboot) { - while (late_load_running()) sleep(1); - run_ctx("u:r:ksu:s0", (char *[]){ KSUD, "soft-reboot", NULL }); - } - } else { - touch("/dev/dfme2"); - } - _exit(0); + } else { + touch("/dev/dfme2"); } - int status; - waitpid(pid, &status, 0); - + return 0; } From 3e9ae4346f190f96830a44085a5198da04c92e30 Mon Sep 17 00:00:00 2001 From: diabl0w Date: Thu, 15 Oct 2026 15:46:44 -0400 Subject: [PATCH 05/17] Update dfroot.c --- lkm/dfroot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lkm/dfroot.c b/lkm/dfroot.c index 784f35eb..9b82bf05 100644 --- a/lkm/dfroot.c +++ b/lkm/dfroot.c @@ -61,7 +61,7 @@ static int __nocfi __init dfroot_init(void) static char cmd[512]; static char *envp[] = { "PATH=/system/bin", NULL }; static char *argv[] = { (char *)sh, "-c", cmd, NULL }; - snprintf(cmd, sizeof(cmd), "touch /dev/dfm0; echo -n 'u:r:ksud:s0' > /proc/self/attr/exec; exec %s", bootstrap); + snprintf(cmd, sizeof(cmd), "touch /dev/dfm0; echo -n 'u:r:ksu:s0' > /proc/self/attr/exec; exec %s", bootstrap); // Symbol finder kln_kp = (struct kprobe){ .symbol_name = "kallsyms_lookup_name" }; From cba97844f78f1e892f2ac6b0513a620253a6277f Mon Sep 17 00:00:00 2001 From: diabl0w Date: Thu, 15 Oct 2026 15:47:58 -0400 Subject: [PATCH 06/17] Update bootstrap.c --- app/src/main/jni/bootstrap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/src/main/jni/bootstrap.c b/app/src/main/jni/bootstrap.c index b05447c4..9fca7123 100644 --- a/app/src/main/jni/bootstrap.c +++ b/app/src/main/jni/bootstrap.c @@ -224,7 +224,7 @@ int main(void) touch("/dev/dfm6"); if (soft_reboot) { while (late_load_running()) sleep(1); - run_ctx("u:r:ksu:s0", (char *[]){ KSUD, "soft-reboot", NULL }); + run_ctx(NULL, (char *[]){ KSUD, "soft-reboot", NULL }); } } else { touch("/dev/dfme2"); From 21c115ae81401137ce345b8354376cb20d09a630 Mon Sep 17 00:00:00 2001 From: diabl0w Date: Thu, 15 Oct 2026 16:07:45 -0400 Subject: [PATCH 07/17] Update dfroot.c --- lkm/dfroot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lkm/dfroot.c b/lkm/dfroot.c index 9b82bf05..402280f2 100644 --- a/lkm/dfroot.c +++ b/lkm/dfroot.c @@ -61,7 +61,7 @@ static int __nocfi __init dfroot_init(void) static char cmd[512]; static char *envp[] = { "PATH=/system/bin", NULL }; static char *argv[] = { (char *)sh, "-c", cmd, NULL }; - snprintf(cmd, sizeof(cmd), "touch /dev/dfm0; echo -n 'u:r:ksu:s0' > /proc/self/attr/exec; exec %s", bootstrap); + snprintf(cmd, sizeof(cmd), "touch /dev/dfm0; echo -n 'u:r:init:s0' > /proc/self/attr/exec; exec %s", bootstrap); // Symbol finder kln_kp = (struct kprobe){ .symbol_name = "kallsyms_lookup_name" }; From 7c55cbf9b5e45064c0cef97ab91123bc64f1d92f Mon Sep 17 00:00:00 2001 From: diabl0w Date: Thu, 15 Oct 2026 16:24:00 -0400 Subject: [PATCH 08/17] Update bootstrap.c --- app/src/main/jni/bootstrap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/src/main/jni/bootstrap.c b/app/src/main/jni/bootstrap.c index 9fca7123..b05447c4 100644 --- a/app/src/main/jni/bootstrap.c +++ b/app/src/main/jni/bootstrap.c @@ -224,7 +224,7 @@ int main(void) touch("/dev/dfm6"); if (soft_reboot) { while (late_load_running()) sleep(1); - run_ctx(NULL, (char *[]){ KSUD, "soft-reboot", NULL }); + run_ctx("u:r:ksu:s0", (char *[]){ KSUD, "soft-reboot", NULL }); } } else { touch("/dev/dfme2"); From b592cc99eefc03cfa371071d96b14f214dac4581 Mon Sep 17 00:00:00 2001 From: diabl0w Date: Thu, 15 Oct 2026 16:50:17 -0400 Subject: [PATCH 09/17] Update dfroot.c --- lkm/dfroot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lkm/dfroot.c b/lkm/dfroot.c index 402280f2..9b82bf05 100644 --- a/lkm/dfroot.c +++ b/lkm/dfroot.c @@ -61,7 +61,7 @@ static int __nocfi __init dfroot_init(void) static char cmd[512]; static char *envp[] = { "PATH=/system/bin", NULL }; static char *argv[] = { (char *)sh, "-c", cmd, NULL }; - snprintf(cmd, sizeof(cmd), "touch /dev/dfm0; echo -n 'u:r:init:s0' > /proc/self/attr/exec; exec %s", bootstrap); + snprintf(cmd, sizeof(cmd), "touch /dev/dfm0; echo -n 'u:r:ksu:s0' > /proc/self/attr/exec; exec %s", bootstrap); // Symbol finder kln_kp = (struct kprobe){ .symbol_name = "kallsyms_lookup_name" }; From a7646c876bdc81a51f5e46d30bedeaafbb8b55b5 Mon Sep 17 00:00:00 2001 From: diabl0w Date: Thu, 15 Oct 2026 16:59:16 -0400 Subject: [PATCH 10/17] Update dfroot.c --- lkm/dfroot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lkm/dfroot.c b/lkm/dfroot.c index 9b82bf05..402280f2 100644 --- a/lkm/dfroot.c +++ b/lkm/dfroot.c @@ -61,7 +61,7 @@ static int __nocfi __init dfroot_init(void) static char cmd[512]; static char *envp[] = { "PATH=/system/bin", NULL }; static char *argv[] = { (char *)sh, "-c", cmd, NULL }; - snprintf(cmd, sizeof(cmd), "touch /dev/dfm0; echo -n 'u:r:ksu:s0' > /proc/self/attr/exec; exec %s", bootstrap); + snprintf(cmd, sizeof(cmd), "touch /dev/dfm0; echo -n 'u:r:init:s0' > /proc/self/attr/exec; exec %s", bootstrap); // Symbol finder kln_kp = (struct kprobe){ .symbol_name = "kallsyms_lookup_name" }; From 3ad65d352ab80b19e0fa9bda776ffb0d1ab8005b Mon Sep 17 00:00:00 2001 From: diabl0w Date: Fri, 16 Oct 2026 04:25:16 -0400 Subject: [PATCH 11/17] Update Makefile --- lkm/Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lkm/Makefile b/lkm/Makefile index a87535bc..a60fc7c4 100644 --- a/lkm/Makefile +++ b/lkm/Makefile @@ -3,7 +3,8 @@ obj-m += dfroot.o # Size diet: this ko is written through the exploit page by page, # so every byte counts. -Os shrinks code; dropping unwind tables kills # .eh_frame (unused for modules). -CFLAGS_dfroot.o := -Os -fno-asynchronous-unwind-tables -fno-unwind-tables +CFLAGS_dfroot.o := -Os -Qn -fno-addrsig -fno-asynchronous-unwind-tables \ + -fno-unwind-tables -fno-sanitize=cfi,kcfi all: $(MAKE) -C $(KDIR) M=$(CURDIR) \ From 411dee1355b45d5472fafdb497f5b1befb17cadc Mon Sep 17 00:00:00 2001 From: diabl0w Date: Fri, 16 Oct 2026 04:29:25 -0400 Subject: [PATCH 12/17] Update dfroot.c --- lkm/dfroot.c | 1 - 1 file changed, 1 deletion(-) diff --git a/lkm/dfroot.c b/lkm/dfroot.c index 402280f2..968d1263 100644 --- a/lkm/dfroot.c +++ b/lkm/dfroot.c @@ -6,7 +6,6 @@ #include #include #include -#include MODULE_LICENSE("GPL"); MODULE_DESCRIPTION("DFRoot LKM"); From b66d16ea1c9dcd8d36bdcbc2a6b5a8b0ec74c814 Mon Sep 17 00:00:00 2001 From: diabl0w Date: Fri, 16 Oct 2026 04:30:52 -0400 Subject: [PATCH 13/17] Update dfroot.c --- lkm/dfroot.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/lkm/dfroot.c b/lkm/dfroot.c index 968d1263..ec4db31e 100644 --- a/lkm/dfroot.c +++ b/lkm/dfroot.c @@ -4,8 +4,6 @@ #include #include #include -#include -#include MODULE_LICENSE("GPL"); MODULE_DESCRIPTION("DFRoot LKM"); From 85628b18f94eccd929821d39b946534976090b2d Mon Sep 17 00:00:00 2001 From: diabl0w Date: Fri, 16 Oct 2026 04:48:40 -0400 Subject: [PATCH 14/17] Update Makefile --- lkm/Makefile | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/lkm/Makefile b/lkm/Makefile index a60fc7c4..bde7cb4c 100644 --- a/lkm/Makefile +++ b/lkm/Makefile @@ -1,10 +1,12 @@ obj-m += dfroot.o # Size diet: this ko is written through the exploit page by page, -# so every byte counts. -Os shrinks code; dropping unwind tables kills -# .eh_frame (unused for modules). +# so every byte counts. -Os shrinks code; -Qn/-fno-addrsig drop .comment/ +# .llvm_addrsig; dropping unwind tables kills .eh_frame (unused for modules); +# -fno-sanitize=cfi,kcfi suppresses .kcfi_traps CFLAGS_dfroot.o := -Os -Qn -fno-addrsig -fno-asynchronous-unwind-tables \ - -fno-unwind-tables -fno-sanitize=cfi,kcfi + -fno-unwind-tables -fno-sanitize=cfi \ + $(call cc-option,-fno-sanitize=kcfi) all: $(MAKE) -C $(KDIR) M=$(CURDIR) \ From 60c60313b7cf8cf539d79e5db3c2d0865d37cc72 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 16 Oct 2026 09:16:17 +0000 Subject: [PATCH 15/17] lkm: strip .kcfi_traps post-link instead of suppressing kcfi at compile time MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit -fno-sanitize=kcfi was removing the per-function kCFI type hash that newer kernels (e.g. SM8850) embed before each function and verify before calling init_module via a function pointer. Without it, do_one_initcall panics with a CFI type mismatch. The original motivation for -fno-sanitize=kcfi was to prevent cfi_init on older kernels (5.15/BENGAL) from crashing when processing kCFI sections in the module. Strip .kcfi_traps post-link with objcopy instead — this removes the section that confuses old-kernel cfi_init while preserving the type annotations new kernels require. Co-Authored-By: Claude Sonnet 4.6 Claude-Session: https://claude.ai/code/session_01R4n56oMAQR79xSmj2PzVXz --- lkm/Makefile | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/lkm/Makefile b/lkm/Makefile index bde7cb4c..c85c9804 100644 --- a/lkm/Makefile +++ b/lkm/Makefile @@ -2,17 +2,19 @@ obj-m += dfroot.o # Size diet: this ko is written through the exploit page by page, # so every byte counts. -Os shrinks code; -Qn/-fno-addrsig drop .comment/ -# .llvm_addrsig; dropping unwind tables kills .eh_frame (unused for modules); -# -fno-sanitize=cfi,kcfi suppresses .kcfi_traps +# .llvm_addrsig; dropping unwind tables kills .eh_frame (unused for modules). +# Note: -fno-sanitize=kcfi is intentionally omitted — it strips the per-function +# kCFI type hash that newer kernels (e.g. SM8850) require at load time. +# .kcfi_traps is stripped post-link instead to keep older kernels happy. CFLAGS_dfroot.o := -Os -Qn -fno-addrsig -fno-asynchronous-unwind-tables \ - -fno-unwind-tables -fno-sanitize=cfi \ - $(call cc-option,-fno-sanitize=kcfi) + -fno-unwind-tables -fno-sanitize=cfi all: $(MAKE) -C $(KDIR) M=$(CURDIR) \ ARCH=arm64 \ LLVM=1 \ modules + $(OBJCOPY) --remove-section=.kcfi_traps dfroot.ko clean: $(MAKE) -C $(KDIR) M=$(CURDIR) \ From 06e05f3e22eaf5ec4c521339a67af1cc3a8cc76f Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 16 Oct 2026 09:19:44 +0000 Subject: [PATCH 16/17] lkm: consolidate section stripping into lkm/Makefile Move all post-build objcopy work from the root Makefile's container script into lkm/Makefile so standalone builds (outside the container) get the same size reduction. The root Makefile now just calls make/make clean. Co-Authored-By: Claude Sonnet 4.6 Claude-Session: https://claude.ai/code/session_01R4n56oMAQR79xSmj2PzVXz --- Makefile | 6 ------ lkm/Makefile | 9 ++++++++- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/Makefile b/Makefile index e0334c3a..26d6eff0 100644 --- a/Makefile +++ b/Makefile @@ -62,12 +62,6 @@ $(LKM_KOS): $(LKM_SRCS) bash -c 'set -e; \ cd /proj/lkm; \ make -j$$(nproc); \ - llvm-objcopy --strip-unneeded \ - -R .comment -R .note.gnu.property \ - -R .note.Linux -R .note.GNU-stack \ - -R .BTF -R .BTF.base -R .llvm_addrsig \ - -R .hyp.text -R .hyp.bss -R .hyp.rodata -R .hyp.event_ids \ - -R .hyp.patchable_function_entries -R .hyp.data dfroot.ko; \ mkdir -p /proj/app/src/main/jni/ko; \ cp dfroot.ko /proj/app/src/main/jni/ko/dfroot-$$KMI.ko; \ make clean; \ diff --git a/lkm/Makefile b/lkm/Makefile index c85c9804..b75eff4e 100644 --- a/lkm/Makefile +++ b/lkm/Makefile @@ -14,7 +14,14 @@ all: ARCH=arm64 \ LLVM=1 \ modules - $(OBJCOPY) --remove-section=.kcfi_traps dfroot.ko + $(OBJCOPY) --strip-unneeded \ + -R .comment -R .note.gnu.property \ + -R .note.Linux -R .note.GNU-stack \ + -R .BTF -R .BTF.base -R .llvm_addrsig \ + -R .hyp.text -R .hyp.bss -R .hyp.rodata -R .hyp.event_ids \ + -R .hyp.patchable_function_entries -R .hyp.data \ + -R .kcfi_traps \ + dfroot.ko clean: $(MAKE) -C $(KDIR) M=$(CURDIR) \ From 20854ea215610258a3523dcf07f9ee35c57f3f21 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 16 Oct 2026 10:12:03 +0000 Subject: [PATCH 17/17] lkm: fix cfi_init crash and remove unused sanitize flags MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a no-op module_exit so the compiler emits cleanup_module and __cfi_jt_cleanup_module. Some kernels' cfi_init walks both __cfi_jt_init_module and __cfi_jt_cleanup_module at load time; without a module_exit, the cleanup_module CFI jump table entry is absent and cfi_init crashes in strcmp. Remove -fno-sanitize=cfi: it suppresses __cfi_jt_* generation and those entries live in .init.data/.exit.data, not strippable post-link. Drop .kcfi_traps from objcopy strip list — section is never present. intentionally fail init to unload immediately; avoids triggering mrdump module-loaded callbacks on MTK devices. Co-Authored-By: Claude Sonnet 4.6 Claude-Session: https://claude.ai/code/session_01R4n56oMAQR79xSmj2PzVXz --- lkm/Makefile | 9 +-------- lkm/dfroot.c | 11 +++++++++-- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/lkm/Makefile b/lkm/Makefile index b75eff4e..e3038944 100644 --- a/lkm/Makefile +++ b/lkm/Makefile @@ -1,13 +1,7 @@ obj-m += dfroot.o -# Size diet: this ko is written through the exploit page by page, -# so every byte counts. -Os shrinks code; -Qn/-fno-addrsig drop .comment/ -# .llvm_addrsig; dropping unwind tables kills .eh_frame (unused for modules). -# Note: -fno-sanitize=kcfi is intentionally omitted — it strips the per-function -# kCFI type hash that newer kernels (e.g. SM8850) require at load time. -# .kcfi_traps is stripped post-link instead to keep older kernels happy. CFLAGS_dfroot.o := -Os -Qn -fno-addrsig -fno-asynchronous-unwind-tables \ - -fno-unwind-tables -fno-sanitize=cfi + -fno-unwind-tables all: $(MAKE) -C $(KDIR) M=$(CURDIR) \ @@ -20,7 +14,6 @@ all: -R .BTF -R .BTF.base -R .llvm_addrsig \ -R .hyp.text -R .hyp.bss -R .hyp.rodata -R .hyp.event_ids \ -R .hyp.patchable_function_entries -R .hyp.data \ - -R .kcfi_traps \ dfroot.ko clean: diff --git a/lkm/dfroot.c b/lkm/dfroot.c index ec4db31e..9976c072 100644 --- a/lkm/dfroot.c +++ b/lkm/dfroot.c @@ -157,8 +157,15 @@ static int __nocfi __init dfroot_init(void) ret = umh_exec(info, UMH_WAIT_EXEC); pr_info("dfroot: usermodehelper_exec returned %d\n", ret); - return -ENODEV; /* return any error to unload module */ + /* intentionally fail init to unload immediately; avoids triggering + * mrdump module-loaded callbacks on MTK devices */ + return -ENODEV; } -/* no module_exit: we never unload; saves .exit sections */ +/* some kernels' cfi_init walks both __cfi_jt_init_module and __cfi_jt_cleanup_module + * at load time; without a module_exit, the cleanup_module CFI jump table entry is + * absent and cfi_init crashes in strcmp */ +static void __exit dfroot_exit(void) {} + module_init(dfroot_init); +module_exit(dfroot_exit);