On Wed, Sep 10, 2025 at 08:05:11PM -0700, Kees Cook wrote:
> > > +/* Check if a function needs KCFI preamble generation.
> > > + ALL functions get preambles when -fsanitize=kcfi is enabled,
> > > regardless
> > > + of no_sanitize("kcfi") attribute. */
> >
> > Why no_sanitize(“kcfi”) is not considered here?
>
> no_sanitize(“kcfi”) is strictly about whether call-site checking
> is performed within the function. It is not used to mark a function as
> not being the target of a KCFI call.
I'll once again argue that __attribute__((nocf_check)) (aka. __noendbr)
should have that effect.
If there is no ENDBR, then no amount of kCFI preamble will make the
function (indirectly) callable.
