tree a7aa3294c32eccdcc4631b8ba5905afebb22239b
parent dd4372a1e5f941c893ac4e907bfa9cff17815210
author André Kempe <andre.kempe@arm.com> 1714552102 +0000
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> 1714552102 +0000

Remove dependency on base::CPU when dealing with MTE or BTI

Various security features depend on detecting support by the cpu.
For speed, those checks use base::CPU::GetInstanceNoAllocation(),
making the feature attackable by modifying the data stored in this
instance.

To mitigate against this kind of attacks, this CL uses the fact
that cpu support is constant through a processes' runtime and
implements a solution using the runtime linker to resolve the
correct functions by using ifuncs. The runtime linker will ensure the
ifuncs are protected from modifications after program start, i.e. when
linking with "-z relo".

Bug: 1521272
Change-Id: I013cecf1a55d03cdd9503ae8c217b842e323a3b0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5453915
Reviewed-by: Keishi Hattori <keishi@chromium.org>
Commit-Queue: Andre Kempe <andre.kempe@arm.com>
Cr-Commit-Position: refs/heads/main@{#1294816}