docs(invariants): narrow IBT and FORTIFY scope to silent-bypass invar…

[zjy-dev]

…iants

Apply the same radical rewrite pattern as stack-canary.md to endbr-ibt.md and fortify-source.md: drop preconditions, level semantics, coverage lists, and project-coupled fields; keep only invariants whose violation causes a silent bypass (defense appears active but attacker overflow / control-flow hijack succeeds without trap or chk_fail).

Each entry follows README.md field convention; oracle_mapping replaced by observation. Added known silent-bypass case tables and programmability screening results based on publicly verifiable evidence (LLVM #44527, D84862, GCC PR 102953/104816, FineIBT LWN, glibc dl-cet permissive, GCC PR 101836/113514, LLVM PR #110497/#112636, kernel a28a6e860c6c "Work around Clang inlining bugs", hxp 2017 hardened_flag_store, CVE-2012-0864, sourceware 24987).

Summary by Sourcery

Narrow the fortify-source and endbr-ibt invariant docs to focus on silent-bypass scenarios and update terminology, structure, and known-case coverage accordingly.

Documentation:

• Rewrite _FORTIFY_SOURCE invariants documentation to focus solely on invariants whose violation leads to silent fortify bypass, adding updated terminology, case tables, and programmability screening results.
• Rewrite Intel CET-IBT (endbr32/endbr64) invariants documentation to cover only silent-bypass-relevant invariants, including updated placement rules, NOTRACK usage, metadata handling, and known bypass cases.

[sourcery-ai]

Reviewer's Guide

Refactors the fortify-source and endbr-IBT invariants docs to focus exclusively on invariants whose violation yields a silent bypass of the defense, removing configuration/precondition/semantics material, and rewriting them around concrete compiler/runtime bugs, landing-pad placement, and programmability screening based on public bug reports and research like FineIBT and hxp 2017.

File-Level Changes

Change	Details	Files
Retarget _FORTIFY_SOURCE invariants to only cover compiler/runtime behaviors that cause silent fortify bypass rather than configuration or level semantics.	Rewrites the introduction and terminology to define FORT, BOS/BDOS, fall back, and silent bypass, and to scope the document explicitly to cases where overflows succeed without __chk_fail/__fortify_fail. Drops sections on static preconditions, level semantics, coverage lists, general BOS/BDOS semantics, interaction with other defenses, and non-silent failure modes, keeping only invariants directly tied to silent bypass outcomes. Adds or reframes invariants around BOS/BDOS object-size overestimation (e.g., struct tail array BOS=-1, __counted_by BDOS miscalculation, BDOS using stale size variables), wrapper inlining losing BOS context, runtime checks failing open (e.g., __readonly_area on /proc errors), and missing or inconsistent wrapper coverage (printf-family and err/warn paths). Introduces a concise table of known silent-bypass cases (specific GCC/LLVM PRs, CVEs, hxp 2017) and maps them to the new invariants. Adds a programmatic screening section that classifies each invariant as statically or dynamically checkable and records which prior invariants were intentionally dropped as non-silent-bypass.	docs/tech-docs/invariants/fortify-source.md
Retarget IBT (endbr32/endbr64) invariants to only cover conditions that silently defeat IBT enforcement, focusing on landing pad coverage, NOTRACK usage, FineIBT, and loader behavior.	Rewrites the introduction and terminology to define IBT, landing pads, CET tracker, NOTRACK, GNU property, FineIBT, and silent bypass, and to scope the document only to cases where indirect branches succeed without #CP despite IBT being configured on. Removes broad configuration/precondition sections (e.g., -fcf-protection modes, -mibt/-mshstk, NOP compatibility, mixed-TU semantics) and generic runtime semantics, retaining only invariants where compiler or runtime behavior enables an indirect jump to land on a non-endbr or forged landing pad. Adds or refocuses invariants on landing-pad placement for all indirectly reachable code (functions, setjmp/longjmp return sites, EH landing pads, IFUNC resolvers, GCC trampolines) and on preventing backend scheduling from separating endbr from its target. Strengthens the byte-pattern invariant that endbr sequences must not appear as immediates/displacements in .text and notes historical GCC regressions, tying them to potential forged landing pads. Adds invariants around constrained NOTRACK use (especially switch/jumptable handling and the -mcet-switch mitigation), FineIBT hash-collision behavior, and glibc ld.so CET enforcement behavior that can silently disable IBT for a process when loading non-IBT DSOs. Introduces a table of known IBT silent-bypass issues (LLVM landing-pad bugs, GCC NOTRACK PR, FineIBT holes, glibc dl-cet permissive policy) and a programmatic screening section similar to fortify-source, marking which invariants are static vs dynamic and explicitly dropping non-silent-bypass content.	docs/tech-docs/invariants/endbr-ibt.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}