We are planning to deploy Clang's control flow integrity mechanisms in Chrome. The current status:
To build Chrome with control flow integrity for virtual calls, indirect calls, and bad casts (Linux x86_64 only): gn gen out/cfi '--args=is_debug=false is_cfi=true use_cfi_icall=true use_cfi_cast=true use_thin_lto=true' --check ninja -C out/cfi chrome # Chrome will take 6 minutes or so to link. Building with additional diagnostics: gn gen out/cfi-diag '--args=is_debug=false is_cfi=true use_cfi_icall=true use_cfi_cast=true use_cfi_diag=true use_thin_lto=true' --check ninja -C out/cfi-diag chrome # Chrome will take 6 minutes or so to link. Meta bug: crbug.com/701937 Linux: crbug.com/464797 Android: crbug.com/469376 ChromeOS: crbug.com/537386 Diagnosing problems with the CFI instrumentationBy default, a program compiled with CFI will crash with SIGILL if it detects a CFI violation. For better error messages (but not for production use) add use_cfi_diag=true to your args.gn CFI indirect call (cfi-icall) failures are primarily caused by either bad functions casts or dynamically resolved function pointers:
Trophies (bugs found or prevented)- https://crbug.com/658955 - invalid cast in ProcessManagerBrowserTest.NestedURLNavigationsToAppBlocked- https://crbug.com/605337 - invalid cast in SkTArray.h - https://crbug.com/600808 - invalid cast in PaymentRequestTest.NullShippingOptionWhenNoOptionsAvailable - https://crbug.com/577972 - improper deserialization of cc::HeadsUpDisplayLayer - https://crbug.com/552699 - Bad-cast to webrtc::ProcessThreadImpl from invalid vptr;process_thread_impl.cc - https://crbug.com/569108 - invalid cast in browser_plugin_guest - https://crbug.com/541708 - invalid cast in net/http/http_proxy_client_socket_pool_unittest.cc - https://crbug.com/538952 - Bad-cast to Profile from invalid vptr;chrome_extensions_network_delegate.cc - https://crbug.com/528798 - Bad-cast to blink::ScriptWrappable from blink::WebGLRenderingContextBase::TypedExtensionTracker<blink::ANGLEInstancedArrays> - https://crbug.com/526339 - invalid cast in RenderFrameHostManagerTest - https://crbug.com/520699 - Invalid static_cast in ThreadLocalPointer::Get - https://crbug.com/515215 - Invalid cast in v8::internal::compiler::Typer::Visitor::Reduce - https://crbug.com/514817 - Invalid cast in SocketsTcpUnitTest - https://crbug.com/531057 - Bad-cast to blink::ScriptWrappable from blink::WorkerWebSocketChannel;DOMWrapperMap.h - https://crbug.com/530432 - CHECK failed: io_thread_.StartWithOptions(thread_options) in child_process.cc - https://crbug.com/586639 - Invalid cast in TabDesktopMediaListTest |
For Developers > Testing and infrastructure >
Control Flow Integrity
Subpages (1):
Overhead