On Tue, Oct 13, 2026 at 01:37:03AM -0700, Kees Cook wrote: > On Tue, Oct 13, 2026 at 08:44:05AM +0200, Peter Zijlstra wrote: > > On Mon, Oct 12, 2026 at 11:41:03AM -0700, Kees Cook wrote: > > > Clang never has this jump: with retpolines, LLVM's IndirectBrExpand pass > > > turns the label addresses into indexes and the "goto *" into a switch, > > > which Clang's -fno-jump-tables then makes a compare tree. So it's only > > > constructed this way under GCC, but since now we can turn on kCFI with > > > GCC, the objtool warning about indirects without kcfi protection trips. > > > > OK, then the next question; do we *want* to allow a 'naked' indirect > > branch to survive? > > I originally struggled about this. I'd really rather that GCC not codgen > like this at all. On the other hand, it's a bounded load and jump through > an .rodata table, so that's kind of a manual CFI. :P (And if it gets > targeted via ROP, it doesn't matter: everything is a target then.)
With IBT enabled, I would image GCC will also spray ENDBR around like there is no tomorrow :/ > > We can simply disable the whole interpreter when kcfi=y. Isn't that > > thing recommended disabled anyway? > > I don't think that's realistic, as every GCC-building distro will (I > hope) enable KCFI as soon as it's in GCC. It's present with > CONFIG_BPF_JIT_ALWAYS_ON=y, and only Debian has it off: > > │ Debian sid and trixie │ not set > │ Ubuntu noble │ y > │ Fedora, CentOS Stream 9 and 10 │ y > │ Arch │ y > │ openSUSE Tumbleweed, SLE15-SP7 │ y > │ Alpine (lts and virt) │ y > │ Android GKI android16-6.12 (arm64 and x86) │ y > What an unfortunate situation this is :( But I don't have a better suggestion. Your patch it is then.
