[PATCH] Add the canary field to the PDA area and the task struct

This patch adds the per thread cookie field to the task struct and the PDA.
Also it makes sure that the PDA value gets the new cookie value at context
switch, and that a new task gets a new cookie at task creation time.

Signed-off-by: Arjan van Ven <arjan@linux.intel.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andi Kleen <ak@suse.de>
CC: Andi Kleen <ak@suse.de>

diff --git a/arch/x86_64/kernel/process.c b/arch/x86_64/kernel/process.c
index 9e9a70e50c72aed73cd2c465af6f7252b6d7e8df..fba8dfeda67c8107885533c474d058d4612d500a 100644 (file)
--- a/arch/x86_64/kernel/process.c
+++ b/arch/x86_64/kernel/process.c
@@ -625,6 +625,14 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
        unlazy_fpu(prev_p);
        write_pda(kernelstack,
                  task_stack_page(next_p) + THREAD_SIZE - PDA_STACKOFFSET);
+#ifdef CONFIG_CC_STACKPROTECTOR
+       write_pda(stack_canary, next_p->stack_canary);
+       /*
+        * Build time only check to make sure the stack_canary is at
+        * offset 40 in the pda; this is a gcc ABI requirement
+        */
+       BUILD_BUG_ON(offsetof(struct x8664_pda, stack_canary) != 40);
+#endif
 
        /*
         * Now maybe reload the debug registers and handle I/O bitmaps

diff --git a/include/asm-x86_64/pda.h b/include/asm-x86_64/pda.h
index 6794ffaae433e09fa89bc2238329c0913b9fe3d7..e7773e0af8657fc2b14c307135ebd292068f8a2f 100644 (file)
--- a/include/asm-x86_64/pda.h
+++ b/include/asm-x86_64/pda.h
@@ -16,7 +16,12 @@ struct x8664_pda {
        unsigned long oldrsp;       /* 24 user rsp for system call */
         int irqcount;              /* 32 Irq nesting counter. Starts with -1 */
        int cpunumber;              /* 36 Logical CPU number */
-       char *irqstackptr;      /* 40 top of irqstack */
+#ifdef CONFIG_CC_STACKPROTECTOR
+       unsigned long stack_canary;     /* 40 stack canary value */
+                                       /* gcc-ABI: this canary MUST be at
+                                          offset 40!!! */
+#endif
+       char *irqstackptr;
        int nodenumber;             /* number of current node */
        unsigned int __softirq_pending;
        unsigned int __nmi_count;       /* number of NMI on this CPUs */

diff --git a/include/linux/sched.h b/include/linux/sched.h
index 807556c5bcd26e1ce74471e931a63e3ad915be91..9d4aa7f95bc8a9172b021f5d1c5137290f51c336 100644 (file)
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -819,6 +819,11 @@ struct task_struct {
        unsigned did_exec:1;
        pid_t pid;
        pid_t tgid;
+
+#ifdef CONFIG_CC_STACKPROTECTOR
+       /* Canary value for the -fstack-protector gcc feature */
+       unsigned long stack_canary;
+#endif
        /* 
         * pointers to (original) parent process, youngest child, younger sibling,
         * older sibling, respectively.  (p->father can be replaced with 

diff --git a/kernel/fork.c b/kernel/fork.c
index f9b014e3e7002e243ca8120f8f81aa33bf0f0f81..a0dad84567c9c7effe6b46f98bf077ee5d9f5e22 100644 (file)
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -45,6 +45,7 @@
 #include <linux/cn_proc.h>
 #include <linux/delayacct.h>
 #include <linux/taskstats_kern.h>
+#include <linux/random.h>
 
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
@@ -175,6 +176,10 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
        tsk->thread_info = ti;
        setup_thread_stack(tsk, orig);
 
+#ifdef CONFIG_CC_STACKPROTECTOR
+       tsk->stack_canary = get_random_int();
+#endif
+
        /* One for us, one for whoever does the "release_task()" (usually parent) */
        atomic_set(&tsk->usage,2);
        atomic_set(&tsk->fs_excl, 0);