| Date | Wed, 13 Oct 2021 12:07:51 -0700 | From | Kees Cook <> | Subject | Re: [PATCH v5 00/15] x86: Add support for Clang CFI |
| |
On Wed, Oct 13, 2021 at 11:16:43AM -0700, Sami Tolvanen wrote: > This series adds support for Clang's Control-Flow Integrity (CFI) > checking to x86_64. With CFI, the compiler injects a runtime > check before each indirect function call to ensure the target is > a valid function with the correct static type. This restricts > possible call targets and makes it more difficult for an attacker > to exploit bugs that allow the modification of stored function > pointers. For more details, see: > > https://clang.llvm.org/docs/ControlFlowIntegrity.html > > Note that v5 is based on tip/master. The first two patches contain > objtool support for CFI, the remaining patches change function > declarations to use opaque types, fix type mismatch issues that > confuse the compiler, and disable CFI where it can't be used.
x86 folks: I'd prefer this series went via -tip, but I can carry it for -next as well. What would you like to do here? I think it's ready.
Thanks!
-Kees
-- Kees Cook
|