| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 9 Jul 2020 07:28:16 +0000
From: guoren@...nel.org
To: palmerdabbelt@...gle.com, paul.walmsley@...ive.com,
anup@...infault.org, greentime.hu@...ive.com, zong.li@...ive.com,
me@...ki.ch, bjorn.topel@...il.com, atish.patra@....com
Cc: linux-riscv@...ts.infradead.org, linux-kernel@...r.kernel.org,
linux-csky@...r.kernel.org, guoren@...nel.org,
Guo Ren <guoren@...ux.alibaba.com>,
Albert Ou <aou@...s.berkeley.edu>,
Masami Hiramatsu <mhiramat@...nel.org>,
Greentime Hu <green.hu@...il.com>
Subject: [PATCH v2 1/2] riscv: Add STACKPROTECTOR supported
From: Guo Ren <guoren@...ux.alibaba.com>
The -fstack-protector & -fstack-protector-strong features are from
gcc. The patch only add basic kernel support to stack-protector
feature and some arch could have its own solution such as
ARM64_PTR_AUTH.
After enabling STACKPROTECTOR and STACKPROTECTOR_STRONG, the .text
size is expanded from 0x7de066 to 0x81fb32 (only 5%) to add canary
checking code.
Signed-off-by: Guo Ren <guoren@...ux.alibaba.com>
Reviewed-by: Kees Cook <keescook@...omium.org>
Cc: Paul Walmsley <paul.walmsley@...ive.com>
Cc: Palmer Dabbelt <palmerdabbelt@...gle.com>
Cc: Albert Ou <aou@...s.berkeley.edu>
Cc: Masami Hiramatsu <mhiramat@...nel.org>
Cc: Björn Töpel <bjorn.topel@...il.com>
Cc: Greentime Hu <green.hu@...il.com>
Cc: Atish Patra <atish.patra@....com>
---
arch/riscv/Kconfig | 1 +
arch/riscv/include/asm/stackprotector.h | 33 +++++++++++++++++++++++++++++++++
arch/riscv/kernel/process.c | 6 ++++++
3 files changed, 40 insertions(+)
create mode 100644 arch/riscv/include/asm/stackprotector.h
diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
index f927a91..4b0e308 100644
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -63,6 +63,7 @@ config RISCV
select HAVE_PERF_EVENTS
select HAVE_PERF_REGS
select HAVE_PERF_USER_STACK_DUMP
+ select HAVE_STACKPROTECTOR
select HAVE_SYSCALL_TRACEPOINTS
select IRQ_DOMAIN
select MODULES_USE_ELF_RELA if MODULES
diff --git a/arch/riscv/include/asm/stackprotector.h b/arch/riscv/include/asm/stackprotector.h
new file mode 100644
index 00000000..8e1ef2c
--- /dev/null
+++ b/arch/riscv/include/asm/stackprotector.h
@@ -0,0 +1,33 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#ifndef _ASM_RISCV_STACKPROTECTOR_H
+#define _ASM_RISCV_STACKPROTECTOR_H
+
+#include <linux/random.h>
+#include <linux/version.h>
+#include <asm/timex.h>
+
+extern unsigned long __stack_chk_guard;
+
+/*
+ * Initialize the stackprotector canary value.
+ *
+ * NOTE: this must only be called from functions that never return,
+ * and it must always be inlined.
+ */
+static __always_inline void boot_init_stack_canary(void)
+{
+ unsigned long canary;
+ unsigned long tsc;
+
+ /* Try to get a semi random initial value. */
+ get_random_bytes(&canary, sizeof(canary));
+ tsc = get_cycles();
+ canary += tsc + (tsc << 32UL);
+ canary ^= LINUX_VERSION_CODE;
+ canary &= CANARY_MASK;
+
+ current->stack_canary = canary;
+ __stack_chk_guard = current->stack_canary;
+}
+#endif /* _ASM_RISCV_STACKPROTECTOR_H */
diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c
index 824d117..6548929 100644
--- a/arch/riscv/kernel/process.c
+++ b/arch/riscv/kernel/process.c
@@ -24,6 +24,12 @@
register unsigned long gp_in_global __asm__("gp");
+#ifdef CONFIG_STACKPROTECTOR
+#include <linux/stackprotector.h>
+unsigned long __stack_chk_guard __read_mostly;
+EXPORT_SYMBOL(__stack_chk_guard);
+#endif
+
extern asmlinkage void ret_from_fork(void);
extern asmlinkage void ret_from_kernel_thread(void);
--
2.7.4
Powered by blists - more mailing lists