Re: [RFC PATCH v2 06/21] cfi: Switch to -fsanitize=kcfi
From: Kees Cook <hidden>
Date: 2022-05-15 03:41:54
Also in:
linux-hardening, lkml, llvm
On Fri, May 13, 2022 at 01:21:44PM -0700, Sami Tolvanen wrote:
Switch from Clang's original forward-edge control-flow integrity implementation to -fsanitize=kcfi, which is better suited for the kernel, as it doesn't require LTO, doesn't use a jump table that requires altering function references, and won't break cross-module function address equality. Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Looks good on arm64 with LKDTM, too: [ 96.904483] lkdtm: Performing direct entry CFI_FORWARD_PROTO [ 96.904718] lkdtm: Calling matched prototype ... [ 96.904829] lkdtm: Calling mismatched prototype ... [ 96.905250] CFI failure at lkdtm_CFI_FORWARD_PROTO+0x54/0x94 [lkdtm] (target: lkdtm_increment_int+0x0/0x20 [lkdtm]; expected type: 0x7e0c52a5) Tested-by: Kees Cook <redacted> -Kees -- Kees Cook _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel