1470264 - (cfi-icall) Resolve CFI icall errors

Status: NEW

(Core :: Security, enhancement, P3)

Description

[Tom Ritter [:tjr]]

Attachment: initial-startup-errors.log

Attached is a file that contains sorted and uniq-ed runtime icall errors. We need to clean these up.

Bug 1468382 tracks removing -fsanitize-cfi-icall-generalize-pointers which currently silences ~70 startup lines (which are _not_ included in the attached log).  

Bug 1465863 tracks fixing _in the correct way_ dynamically resolved cross-DSO calls. These errors _are_ included in the attached log.

So to close out this bug we have the following options for each icall error we generate:

1: Allow it through without protection using the CFI blacklist (generally going to be our best option for third party code)
2: Allow it through using __attribute__((no_sanitize("cfi-icall"))) (this is ugly, better to use the blacklist)
3: If it's a dynamically-resolved cross-DSO call, develop a solution in/for Bug 1465863 and use it (this will be our preferred solution for Mozilla code, but as a stopgap we may choose to do Option 1 temporarily)
4: Fix whatever strange and potentially incorrect behavior we're doing (If it's Mozilla code and #3 doesn't apply, #4 should.)

I believe the majority of our issues here are going to be dynamically resolved cross-DSO in third party code and we'll use Option 1.

Comment 1

[Tom Ritter [:tjr]]

Attachment: Bug 1470264 CFI icall

Review commit: https://reviewboard.mozilla.org/r/252434/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/252434/

Comment 3

[Tom Ritter [:tjr]]

Comment on attachment 8987190 [details]
Bug 1470264 CFI icall

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/252434/diff/1-2/

Comment 5

[Tom Ritter [:tjr]]

Comment on attachment 8987190 [details]
Bug 1470264 CFI icall

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/252434/diff/2-3/

Comment 6

[Tom Ritter [:tjr]]

Comment on attachment 8987190 [details]
Bug 1470264 CFI icall

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/252434/diff/3-4/

Comment 7

[Tom Ritter [:tjr]]

Comment on attachment 8987190 [details]
Bug 1470264 CFI icall

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/252434/diff/4-5/

Comment 8

[Tom Ritter [:tjr]]

Comment on attachment 8987190 [details]
Bug 1470264 CFI icall

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/252434/diff/5-6/

Comment 9

[Tom Ritter [:tjr]]

Comment on attachment 8987190 [details]
Bug 1470264 CFI icall

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/252434/diff/6-7/

Comment 10

[Tom Ritter [:tjr]]

Attachment: Bug 1470264 Enable cfi-icall on the LTO build r=Alex_Gaynor

Comment 11

[Tom Ritter [:tjr]]

Attachment: Bug 1470264 Switch the -lto build over to using a cfi-specific clang toolchain that is a much newer rev r=Alex_Gaynor

Depends on D3048

Comment 12

[Tom Ritter [:tjr]]

Attachment: Bug 1470264 Enable cfi-icall on the LTO build r=Alex_Gaynor

Comment 13

[Tom Ritter [:tjr]]

Attachment: Bug 1470264 Switch the -lto build over to using a cfi-specific clang toolchain that is a much newer rev r=Alex_Gaynor

Depends on D3246

Comment 14

[BugBot [:suhaib / :marco/ :calixte]]

The following patches are waiting for review from an inactive reviewer:

ID	Title	Author	Reviewer Status
D3048	Bug 1470264 Enable cfi-icall on the LTO build r=Alex_Gaynor	tjr	Alex_Gaynor: Inactive
D3049	Bug 1470264 Switch the -lto build over to using a cfi-specific clang toolchain that is a much newer rev r=Alex_Gaynor	tjr	Alex_Gaynor: Inactive
D3246	Bug 1470264 Enable cfi-icall on the LTO build r=Alex_Gaynor	tjr	Alex_Gaynor: Inactive
D3247	Bug 1470264 Switch the -lto build over to using a cfi-specific clang toolchain that is a much newer rev r=Alex_Gaynor	tjr	Alex_Gaynor: Inactive

:tjr, could you please find another reviewer or abandon the patch if it is no longer relevant?

For more information, please visit auto_nag documentation.