Conversation

Have you seen Samsung's kernel CFI implementation from before they gave up and moved to Google's upstream Clang CFI? It's the most horrifying thing and by that I mean they pass compiled kernel code through a Python script using objdump to add CFI instrumentation as a total hack.
2
17
The only thing they actually implemented in the compiler (still GCC) was adding NOP padding for them to use in their post-processing Python script along with reserving at least one register. Extremely coarse-grained indirect call CFI + ret addr XOR with random value in register.
1
1
So, Clang CFI figures out all the functions that aren't indirectly callable from the fact that their address isn't taken and they aren't exported (works well with -fvisibility=hidden) and then enforces type-based CFI for the indirect calls where that's not the case.
1
1
Samsung's horrible CFI only prevented indirect calls not calling an actual function. It had no compiler analysis or anything since it was literally just a Python script post-processing the disassembled code (via objdump). Haven't seen many worse things done with computers.
1
4
Could talk about all the sketchy assembly code / instruction parsing and mangling with regular expressions, totally unexplained bit operations, etc. My nitpick is that they import the bisect module but then don't use it and roll their own binary search implementation instead.
3