Messages in this thread | | | Date | Tue, 23 Nov 2021 10:02:53 +0100 | From | Peter Zijlstra <> | Subject | Re: [RFC][PATCH 0/6] x86: Kernel IBT beginnings |
| |
On Mon, Nov 22, 2021 at 11:58:43PM -0800, Christoph Hellwig wrote: > What is "IBT"?
Fair enough; it's Indirect Branch Tracking, it's a hardware feature that ensures any indirect JMP/CALL can only ever land on an ENDBR instruction. It's a form of Control Flow Integrity, albeit a weak one. (FineIBT is a software improvement that combines this with a hash value to further narrow the allowed branches. People are working on that, but basics first etc..)
More practical, by stripping ENDBR instruction from functions that are never called indirectly, we insta kill the tried and true method of:
func = kallsym_lookup_name("unexported_function"); (*func)(args);
favoured by pretty much every out of tree piece-of-cra^Wmodule.
| |