ANDROID: gki_defconfig: do not use FineIBT on x86

The kernel is currently configured to patch itself to use FineIBT
instead of the traditional kCFI implementation when the hardware
supports IBT. However, due to recent security concerns with the design
of FineIBT [1], enabling FineIBT is currently considered a security
downgrade. Thus, disable this option and always use traditional kCFI.

This issue was discovered in relation to an issue with Rust drivers (see
the referenced bug). That issue has already been fixed [2][3][4].

The enablement of FineIBT happens at runtime, and it's controlled by
the cfi= kernel parameter. cfi=auto always enables FineIBT if the CPU
supports IBT, whereas cfi=kcfi tells the kernel not to use FineIBT.
The default value for this parameter depends on CONFIG_CFI_AUTO_DEFAULT.
If set, it's cfi=auto, if unset, it's cfi=kcfi.

This patch does not modify arch/arm64/configs/gki_defconfig because
FineIBT does not exist on ARM, as it relies on the hardware feature IBT
that only exists on x86.

Link: https://lore.kernel.org/linux-hardening/Z60NwR4w%2F28Z7XUa@ubun/ [1]
Link: rust-lang/rust#139632 [2]
Link: https://r.android.com/3602350 [3]
Link: https://lore.kernel.org/all/[email protected] [4]
Bug: 404795641
Change-Id: Idfb23c122e53d2d46612cceff0d1dbf5c1c0c813
Signed-off-by: Paweł Anikiel <[email protected]>

Author: panikiel

arch/x86/configs/gki_defconfig

@@ -70,6 +70,7 @@ CONFIG_NR_CPUS=32
 CONFIG_EFI=y
 CONFIG_CMDLINE_BOOL=y
 CONFIG_CMDLINE="console=ttynull stack_depot_disable=on cgroup_disable=pressure bootconfig"
+# CONFIG_CFI_AUTO_DEFAULT is not set
 CONFIG_HIBERNATION=y
 CONFIG_PM_WAKELOCKS=y
 CONFIG_PM_WAKELOCKS_LIMIT=0