Re: [PATCH 3/3] objtool: Skip jump table jumps in the kCFI indirect call check

[Kees Cook <kees@kernel.org>]

On Tue, Oct 13, 2026 at 08:44:05AM +0200, Peter Zijlstra wrote:
> On Mon, Oct 12, 2026 at 11:41:03AM -0700, Kees Cook wrote:
> > Clang never has this jump: with retpolines, LLVM's IndirectBrExpand pass
> > turns the label addresses into indexes and the "goto *" into a switch,
> > which Clang's -fno-jump-tables then makes a compare tree. So it's only
> > constructed this way under GCC, but since now we can turn on kCFI with
> > GCC, the objtool warning about indirects without kcfi protection trips.
> 
> OK, then the next question; do we *want* to allow a 'naked' indirect
> branch to survive?

I originally struggled about this. I'd really rather that GCC not codgen
like this at all. On the other hand, it's a bounded load and jump through
an .rodata table, so that's kind of a manual CFI. :P (And if it gets
targeted via ROP, it doesn't matter: everything is a target then.)

> We can simply disable the whole interpreter when kcfi=y. Isn't that
> thing recommended disabled anyway?

I don't think that's realistic, as every GCC-building distro will (I
hope) enable KCFI as soon as it's in GCC. It's present with
CONFIG_BPF_JIT_ALWAYS_ON=y, and only Debian has it off:

  │ Debian sid and trixie                      │ not set
  │ Ubuntu noble                               │ y
  │ Fedora, CentOS Stream 9 and 10             │ y
  │ Arch                                       │ y
  │ openSUSE Tumbleweed, SLE15-SP7             │ y
  │ Alpine (lts and virt)                      │ y
  │ Android GKI android16-6.12 (arm64 and x86) │ y


-- 
Kees Cook