Date: Wed, 7 Apr 2021 22:35:03 +0100 From: Will Deacon <will@...nel.org> To: Kees Cook <keescook@...omium.org> Cc: Thomas Gleixner <tglx@...utronix.de>, Elena Reshetova <elena.reshetova@...el.com>, x86@...nel.org, Andy Lutomirski <luto@...nel.org>, Peter Zijlstra <peterz@...radead.org>, Catalin Marinas <catalin.marinas@....com>, Mark Rutland <mark.rutland@....com>, Alexander Potapenko <glider@...gle.com>, Alexander Popov <alex.popov@...ux.com>, Ard Biesheuvel <ard.biesheuvel@...aro.org>, Jann Horn <jannh@...gle.com>, Vlastimil Babka <vbabka@...e.cz>, David Hildenbrand <david@...hat.com>, Mike Rapoport <rppt@...ux.ibm.com>, Andrew Morton <akpm@...ux-foundation.org>, Jonathan Corbet <corbet@....net>, Randy Dunlap <rdunlap@...radead.org>, kernel-hardening@...ts.openwall.com, linux-hardening@...r.kernel.org, linux-arm-kernel@...ts.infradead.org, linux-mm@...ck.org, linux-kernel@...r.kernel.org Subject: Re: [PATCH v10 5/6] arm64: entry: Enable random_kstack_offset support On Thu, Apr 01, 2021 at 04:23:46PM -0700, Kees Cook wrote: > Allow for a randomized stack offset on a per-syscall basis, with roughly > 5 bits of entropy. (And include AAPCS rationale AAPCS thanks to Mark > Rutland.) > > In order to avoid unconditional stack canaries on syscall entry (due to > the use of alloca()), also disable stack protector to avoid triggering > needless checks and slowing down the entry path. As there is no general > way to control stack protector coverage with a function attribute, > this must be disabled at the compilation unit level. This isn't a problem > here, though, since stack protector was not triggered before: examining > the resulting syscall.o, there are no changes in canary coverage (none > before, none now). > >  a working __attribute__((no_stack_protector)) has been added to GCC > and Clang but has not been released in any version yet: > https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=346b302d09c1e6db56d9fe69048acb32fbb97845 > https://reviews.llvm.org/rG4fbf84c1732fca596ad1d6e96015e19760eb8a9b > > Signed-off-by: Kees Cook <keescook@...omium.org> > --- > arch/arm64/Kconfig | 1 + > arch/arm64/kernel/Makefile | 5 +++++ > arch/arm64/kernel/syscall.c | 16 ++++++++++++++++ > 3 files changed, 22 insertions(+) Acked-by: Will Deacon <will@...nel.org> Will
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.