• Kees Cook's avatar
    stackprotector: Introduce CONFIG_CC_STACKPROTECTOR_STRONG · 8779657d
    Kees Cook authored
    This changes the stack protector config option into a choice of
    "None", "Regular", and "Strong":
    
       CONFIG_CC_STACKPROTECTOR_NONE
       CONFIG_CC_STACKPROTECTOR_REGULAR
       CONFIG_CC_STACKPROTECTOR_STRONG
    
    "Regular" means the old CONFIG_CC_STACKPROTECTOR=y option.
    
    "Strong" is a new mode introduced by this patch. With "Strong" the
    kernel is built with -fstack-protector-strong (available in
    gcc 4.9 and later). This option increases the coverage of the stack
    protector without the heavy performance hit of -fstack-protector-all.
    
    For reference, the stack protector options available in gcc are:
    
    -fstack-protector-all:
      Adds the stack-canary saving prefix and stack-canary checking
      suffix to _all_ function entry and exit. Results in substantial
      use of stack space for saving the canary for deep stack users
      (e.g. historically xfs), and measurable (though shockingly still
      low) performance hit due to all the saving/checking. Really not
      suitable for sane systems, and was entirely removed as an option
      from the kernel many years ago.
    
    -fstack-protector:
      Adds the canary save/check to functions that define an 8
      (--param=ssp-buffer-size=N, N=8 by default) or more byte local
      char array. Traditionally, stack overflows happened with
      string-based manipulations, so this was a way to find those
      functions. Very few total functions actually get the canary; no
      measurable performance or size overhead.
    
    -fstack-protector-strong
      Adds the canary for a wider set of functions, since it's not
      just those with strings that have ultimately been vulnerable to
      stack-busting. With this superset, more functions end up with a
      canary, but it still remains small compared to all functions
      with only a small change in performance. Based on the original
      design document, a function gets the canary when it contains any
      of:
    
        - local variable's address used as part of the right hand side
          of an assignment or function argument
        - local variable is an array (or union containing an array),
          regardless of array type or length
        - uses register local variables
    
      https://docs.google.com/a/google.com/document/d/1xXBH6rRZue4f296vGt9YQcuLVQHeE516stHwt8M9xyU
    
    Find below a comparison of "size" and "objdump" output when built with
    gcc-4.9 in three configurations:
    
      - defconfig
    	11430641 kernel text size
    	36110 function bodies
    
      - defconfig + CONFIG_CC_STACKPROTECTOR_REGULAR
    	11468490 kernel text size (+0.33%)
    	1015 of 36110 functions are stack-protected (2.81%)
    
      - defconfig + CONFIG_CC_STACKPROTECTOR_STRONG via this patch
    	11692790 kernel text size (+2.24%)
    	7401 of 36110 functions are stack-protected (20.5%)
    
    With -strong, ARM's compressed boot code now triggers stack
    protection, so a static guard was added. Since this is only used
    during decompression and was never used before, the exposure
    here is very small. Once it switches to the full kernel, the
    stack guard is back to normal.
    
    Chrome OS has been using -fstack-protector-strong for its kernel
    builds for the last 8 months with no problems.
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    Cc: Arjan van de Ven <arjan@linux.intel.com>
    Cc: Michal Marek <mmarek@suse.cz>
    Cc: Russell King <linux@arm.linux.org.uk>
    Cc: Ralf Baechle <ralf@linux-mips.org>
    Cc: Paul Mundt <lethal@linux-sh.org>
    Cc: James Hogan <james.hogan@imgtec.com>
    Cc: Stephen Rothwell <sfr@canb.auug.org.au>
    Cc: Shawn Guo <shawn.guo@linaro.org>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: linux-arm-kernel@lists.infradead.org
    Cc: linux-mips@linux-mips.org
    Cc: linux-arch@vger.kernel.org
    Link: http://lkml.kernel.org/r/1387481759-14535-3-git-send-email-keescook@chromium.org
    [ Improved the changelog and descriptions some more. ]
    Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
    8779657d
Kconfig 15.2 KB