Skip to content

Commit

Permalink
docs: Correct some misstatements in the control flow integrity docs.
Browse files Browse the repository at this point in the history
These were true at one point but haven't been true for a long time.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@334669 91177308-0d34-0410-b5e6-96231b3b80d8
  • Loading branch information
pcc committed Jun 13, 2018
1 parent 54984ff commit d23eb76
Showing 1 changed file with 10 additions and 9 deletions.
19 changes: 10 additions & 9 deletions docs/ControlFlowIntegrity.rst
Original file line number Diff line number Diff line change
Expand Up @@ -104,10 +104,10 @@ dynamic type; that is, the dynamic type of the called object must be a
derived class of the static type of the object used to make the call.
This CFI scheme can be enabled on its own using ``-fsanitize=cfi-vcall``.

For this scheme to work, all translation units containing the definition
of a virtual member function (whether inline or not), other than members
of :ref:`blacklisted <cfi-blacklist>` types, must be compiled with
``-fsanitize=cfi-vcall`` enabled and be statically linked into the program.
For this scheme to work, all translation units containing the definition of
a virtual member function (whether inline or not), other than members of
:ref:`blacklisted <cfi-blacklist>` types, must be compiled with ``-flto``
or ``-flto=thin`` enabled and be statically linked into the program.

Performance
-----------
Expand Down Expand Up @@ -152,9 +152,9 @@ functions may be :ref:`blacklisted <cfi-blacklist>`.

For this scheme to work, all translation units containing the definition
of a virtual member function (whether inline or not), other than members
of :ref:`blacklisted <cfi-blacklist>` types, must be compiled with
``-fsanitize=cfi-derived-cast`` or ``-fsanitize=cfi-unrelated-cast`` enabled
and be statically linked into the program.
of :ref:`blacklisted <cfi-blacklist>` types or types with public :doc:`LTO
visibility <LTOVisibility>`, must be compiled with ``-flto`` or ``-flto=thin``
enabled and be statically linked into the program.

Non-Virtual Member Function Call Checking
=========================================
Expand All @@ -168,8 +168,9 @@ polymorphic class type. This CFI scheme can be enabled on its own using

For this scheme to work, all translation units containing the definition
of a virtual member function (whether inline or not), other than members
of :ref:`blacklisted <cfi-blacklist>` types, must be compiled with
``-fsanitize=cfi-nvcall`` enabled and be statically linked into the program.
of :ref:`blacklisted <cfi-blacklist>` types or types with public :doc:`LTO
visibility <LTOVisibility>`, must be compiled with ``-flto`` or ``-flto=thin``
enabled and be statically linked into the program.

.. _cfi-strictness:

Expand Down

0 comments on commit d23eb76

Please sign in to comment.