Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7c9f8861 authored by Eric Sandeen's avatar Eric Sandeen Committed by Thomas Gleixner
Browse files

stackprotector: use canary at end of stack to indicate overruns at oops time 



(Updated with a common max-stack-used checker that knows about
the canary, as suggested by Joe Perches)

Use a canary at the end of the stack to clearly indicate
at oops time whether the stack has ever overflowed.

This is a very simple implementation with a couple of
drawbacks:

1) a thread may legitimately use exactly up to the last
   word on the stack

 -- but the chances of doing this and then oopsing later seem slim

2) it's possible that the stack usage isn't dense enough
   that the canary location could get skipped over

 -- but the worst that happens is that we don't flag the overrun
 -- though this happens fairly often in my testing :(

With the code in place, an intentionally-bloated stack oops might
do:

BUG: unable to handle kernel paging request at ffff8103f84cc680
IP: [<ffffffff810253df>] update_curr+0x9a/0xa8
PGD 8063 PUD 0
Thread overran stack or stack corrupted
Oops: 0000 [1] SMP
CPU 0
...

... unless the stack overrun is so bad that it corrupts some other
thread.

Signed-off-by: default avatarEric Sandeen <sandeen@redhat.com>
Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
parent b40a4392

arch/x86/mm/fault.c

+7 −0
Original line number Diff line number Diff line
@@ -25,6 +25,7 @@ 
#include <linux/kprobes.h>

#include <linux/uaccess.h>

#include <linux/kdebug.h>

#include <linux/magic.h>



#include <asm/system.h>

#include <asm/desc.h>
@@ -581,6 +582,8 @@ void __kprobes do_page_fault(struct pt_regs *regs, unsigned long error_code) 
	unsigned long address;

	int write, si_code;

	int fault;

	unsigned long *stackend;



#ifdef CONFIG_X86_64

	unsigned long flags;

#endif
@@ -850,6 +853,10 @@ void __kprobes do_page_fault(struct pt_regs *regs, unsigned long error_code) 


	show_fault_oops(regs, error_code, address);



 	stackend = end_of_stack(tsk);

	if (*stackend != STACK_END_MAGIC)

		printk(KERN_ALERT "Thread overran stack, or stack corrupted\n");



	tsk->thread.cr2 = address;

	tsk->thread.trap_no = 14;

	tsk->thread.error_code = error_code;

include/linux/magic.h

+1 −0
Original line number Diff line number Diff line
@@ -42,4 +42,5 @@ 
#define FUTEXFS_SUPER_MAGIC	0xBAD1DEA

#define INOTIFYFS_SUPER_MAGIC	0x2BAD1DEA



#define STACK_END_MAGIC		0x57AC6E9D

#endif /* __LINUX_MAGIC_H__ */

include/linux/sched.h

+13 −0
Original line number Diff line number Diff line
@@ -1969,6 +1969,19 @@ static inline unsigned long *end_of_stack(struct task_struct *p) 


extern void thread_info_cache_init(void);



#ifdef CONFIG_DEBUG_STACK_USAGE

static inline unsigned long stack_not_used(struct task_struct *p)

{

	unsigned long *n = end_of_stack(p);



	do { 	/* Skip over canary */

		n++;

	} while (!*n);



	return (unsigned long)n - (unsigned long)end_of_stack(p);

}

#endif



/* set thread flags in other task's structures

 * - see asm/thread_info.h for TIF_xxxx flags available

 */

kernel/exit.c

+1 −4
Original line number Diff line number Diff line
@@ -899,12 +899,9 @@ static void check_stack_usage(void) 
{

	static DEFINE_SPINLOCK(low_water_lock);

	static int lowest_to_date = THREAD_SIZE;

	unsigned long *n = end_of_stack(current);

	unsigned long free;



	while (*n == 0)

		n++;

	free = (unsigned long)n - (unsigned long)end_of_stack(current);

	free = stack_not_used(current);



	if (free >= lowest_to_date)

		return;

kernel/fork.c

+5 −0
Original line number Diff line number Diff line
@@ -54,6 +54,7 @@ 
#include <linux/tty.h>

#include <linux/proc_fs.h>

#include <linux/blkdev.h>

#include <linux/magic.h>



#include <asm/pgtable.h>

#include <asm/pgalloc.h>
@@ -186,6 +187,8 @@ static struct task_struct *dup_task_struct(struct task_struct *orig) 
{

	struct task_struct *tsk;

	struct thread_info *ti;

	unsigned long *stackend;



	int err;



	prepare_to_copy(orig);
@@ -211,6 +214,8 @@ static struct task_struct *dup_task_struct(struct task_struct *orig) 
		goto out;



	setup_thread_stack(tsk, orig);

	stackend = end_of_stack(tsk);

	*stackend = STACK_END_MAGIC;	/* for overflow detection */



#ifdef CONFIG_CC_STACKPROTECTOR

	tsk->stack_canary = get_random_int();