Re: [PATCH 3/3] objtool: Skip jump table jumps in the kCFI indirect call check

[Peter Zijlstra]

On Tue, Oct 13, 2026 at 01:37:03AM -0700, Kees Cook wrote:
> On Tue, Oct 13, 2026 at 08:44:05AM +0200, Peter Zijlstra wrote:
> > On Mon, Oct 12, 2026 at 11:41:03AM -0700, Kees Cook wrote:
> > > Clang never has this jump: with retpolines, LLVM's IndirectBrExpand pass
> > > turns the label addresses into indexes and the "goto *" into a switch,
> > > which Clang's -fno-jump-tables then makes a compare tree. So it's only
> > > constructed this way under GCC, but since now we can turn on kCFI with
> > > GCC, the objtool warning about indirects without kcfi protection trips.
> > 
> > OK, then the next question; do we *want* to allow a 'naked' indirect
> > branch to survive?
> 
> I originally struggled about this. I'd really rather that GCC not codgen
> like this at all. On the other hand, it's a bounded load and jump through
> an .rodata table, so that's kind of a manual CFI. :P (And if it gets
> targeted via ROP, it doesn't matter: everything is a target then.)

With IBT enabled, I would image GCC will also spray ENDBR around like
there is no tomorrow :/

> > We can simply disable the whole interpreter when kcfi=y. Isn't that
> > thing recommended disabled anyway?
> 
> I don't think that's realistic, as every GCC-building distro will (I
> hope) enable KCFI as soon as it's in GCC. It's present with
> CONFIG_BPF_JIT_ALWAYS_ON=y, and only Debian has it off:
> 
>   │ Debian sid and trixie                      │ not set
>   │ Ubuntu noble                               │ y
>   │ Fedora, CentOS Stream 9 and 10             │ y
>   │ Arch                                       │ y
>   │ openSUSE Tumbleweed, SLE15-SP7             │ y
>   │ Alpine (lts and virt)                      │ y
>   │ Android GKI android16-6.12 (arm64 and x86) │ y
> 

What an unfortunate situation this is :(

But I don't have a better suggestion. Your patch it is then.