On Tue, Oct 13, 2026 at 08:44:05AM +0200, Peter Zijlstra wrote: > On Mon, Oct 12, 2026 at 11:41:03AM -0700, Kees Cook wrote: > > Clang never has this jump: with retpolines, LLVM's IndirectBrExpand pass > > turns the label addresses into indexes and the "goto *" into a switch, > > which Clang's -fno-jump-tables then makes a compare tree. So it's only > > constructed this way under GCC, but since now we can turn on kCFI with > > GCC, the objtool warning about indirects without kcfi protection trips. > > OK, then the next question; do we *want* to allow a 'naked' indirect > branch to survive?
I originally struggled about this. I'd really rather that GCC not codgen like this at all. On the other hand, it's a bounded load and jump through an .rodata table, so that's kind of a manual CFI. :P (And if it gets targeted via ROP, it doesn't matter: everything is a target then.) > We can simply disable the whole interpreter when kcfi=y. Isn't that > thing recommended disabled anyway? I don't think that's realistic, as every GCC-building distro will (I hope) enable KCFI as soon as it's in GCC. It's present with CONFIG_BPF_JIT_ALWAYS_ON=y, and only Debian has it off: │ Debian sid and trixie │ not set │ Ubuntu noble │ y │ Fedora, CentOS Stream 9 and 10 │ y │ Arch │ y │ openSUSE Tumbleweed, SLE15-SP7 │ y │ Alpine (lts and virt) │ y │ Android GKI android16-6.12 (arm64 and x86) │ y -- Kees Cook
