On 7/1/26 14:04, Xiang Mei wrote: > Peter's explanation is correct: this technique makes CFH->ACE easier. > > I think both ways can mitigate it, but I would like to hear your > (maintainers') idea of which one we should proceed: > > 1. supervisor-ENTER-#UD + Peter's objtool check. Cleanest for ENTER, > but it needs a new bit from Intel/AMD, so future CPUs only. > 2. Kill the landing zone with a 0x11-page guard area.
Or: 3. Do nothing. Normal kernel IBT is good enough. The hardest part of #1 IMNHO is convincing people that we need "a new bit" *PLUS* the two CET technologies (indirect branch tracking and shadow stacks). If I were a hardware guy, I'd be complaining that those silly kernel developers aren't even doing supervisor shadow stacks, so maybe they should use what they have before we starting building new things. Also, I kinda gave you a route forward. I think someone can both make the vmalloc gaps more flexible, less hacky, simpler and cleaner. Then, once that has been done, it's dirt simple for any individual vmalloc user to have a custom-sized gap. Or, to have a universal, larger, tunable vmalloc gap. Get that series put together and I'm open to an 0x11-page gap that x86 pokes in to place in some way.
