linux-kernel - [patch 3/5] Add the canary field to the PDA area and the task struct

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Fri, 28 Jul 2006 18:04:32 +0200
From:	Arjan van de Ven <arjan@...ux.intel.com>
To:	linux-kernel@...r.kernel.org
Cc:	akpm@...l.org, ak@...e.de
Subject: [patch 3/5] Add the canary field to the PDA area and the task
	struct

Subject: [patch 3/5] Add the canary field to the PDA area and the task struct
From: Arjan van de Ven <arjan@...ux.intel.com>

This patch adds the per thread cookie field to the task struct and the PDA.
Also it makes sure that the PDA value gets the new cookie value at context
switch, and that a new task gets a new cookie at task creation time.

Signed-off-by: Arjan van Ven <arjan@...ux.intel.com>
Signed-off-by: Ingo Molnar <mingo@...e.hu>
CC: Andi Kleen <ak@...e.de>
---
 arch/x86_64/kernel/process.c |    3 +++
 include/asm-x86_64/pda.h     |    6 +++++-
 include/linux/sched.h        |    5 +++++
 kernel/fork.c                |    4 ++++
 4 files changed, 17 insertions(+), 1 deletion(-)

Index: linux-2.6.18-rc2-git5-stackprot/arch/x86_64/kernel/process.c
===================================================================
--- linux-2.6.18-rc2-git5-stackprot.orig/arch/x86_64/kernel/process.c
+++ linux-2.6.18-rc2-git5-stackprot/arch/x86_64/kernel/process.c
@@ -584,6 +584,9 @@ __switch_to(struct task_struct *prev_p, 
 	unlazy_fpu(prev_p);
 	write_pda(kernelstack,
 		  task_stack_page(next_p) + THREAD_SIZE - PDA_STACKOFFSET);
+#ifdef CONFIG_CC_STACKPROTECTOR
+	write_pda(stack_canary, next_p->stack_canary);
+#endif
 
 	/*
 	 * Now maybe reload the debug registers
Index: linux-2.6.18-rc2-git5-stackprot/include/asm-x86_64/pda.h
===================================================================
--- linux-2.6.18-rc2-git5-stackprot.orig/include/asm-x86_64/pda.h
+++ linux-2.6.18-rc2-git5-stackprot/include/asm-x86_64/pda.h
@@ -14,7 +14,11 @@ struct x8664_pda {
 	unsigned long kernelstack;	/* 16 */  /* top of kernel stack for current */
 	unsigned long oldrsp;		/* 24 */  /* user rsp for system call */
 	unsigned long debugstack;	/* 32 */  /* #DB/#BP stack. */
-	int irqcount;			/* 40 */  /* Irq nesting counter. Starts with -1 */
+#ifdef CONFIG_CC_STACKPROTECTOR
+	unsigned long stack_canary;	/* 40 */  /* stack canary value */
+					/* gcc-ABI: this canary MUST be at offset 40!!! */
+#endif
+	int irqcount;			/* 48 */  /* Irq nesting counter. Starts with -1 */
 	int cpunumber;		    /* Logical CPU number */
 	char *irqstackptr;	/* top of irqstack */
 	int nodenumber;		    /* number of current node */
Index: linux-2.6.18-rc2-git5-stackprot/include/linux/sched.h
===================================================================
--- linux-2.6.18-rc2-git5-stackprot.orig/include/linux/sched.h
+++ linux-2.6.18-rc2-git5-stackprot/include/linux/sched.h
@@ -819,6 +819,11 @@ struct task_struct {
 	unsigned did_exec:1;
 	pid_t pid;
 	pid_t tgid;
+
+#ifdef CONFIG_CC_STACKPROTECTOR
+	/* Canary value for the -fstack-protector gcc feature */
+	unsigned long stack_canary;
+#endif
 	/* 
 	 * pointers to (original) parent process, youngest child, younger sibling,
 	 * older sibling, respectively.  (p->father can be replaced with 
Index: linux-2.6.18-rc2-git5-stackprot/kernel/fork.c
===================================================================
--- linux-2.6.18-rc2-git5-stackprot.orig/kernel/fork.c
+++ linux-2.6.18-rc2-git5-stackprot/kernel/fork.c
@@ -174,6 +174,10 @@ static struct task_struct *dup_task_stru
 	tsk->thread_info = ti;
 	setup_thread_stack(tsk, orig);
 
+#ifdef CONFIG_CC_STACKPROTECTOR
+	tsk->stack_canary = get_random_int();
+#endif
+
 	/* One for us, one for whoever does the "release_task()" (usually parent) */
 	atomic_set(&tsk->usage,2);
 	atomic_set(&tsk->fs_excl, 0);

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/