diff options
| author |   Alexander Popov <alex.popov@linux.com> | 2018-08-17 01:16:59 +0300 |
|---|---|---|
| committer |   Kees Cook <keescook@chromium.org> | 2018-09-04 10:35:47 -0700 |
| commit | 10e9ae9fabaf96c8e5227c1cd4827d58b3aa406d (patch) | |
| tree | 910b011e7c95ba67dba361b876f79328151f202f /scripts/gcc-plugins/Kconfig | |
| parent | x86/entry: Add STACKLEAK erasing the kernel stack at the end of syscalls (diff) | |
| download | linux-dev-10e9ae9fabaf96c8e5227c1cd4827d58b3aa406d.tar.xz linux-dev-10e9ae9fabaf96c8e5227c1cd4827d58b3aa406d.zip | |
gcc-plugins: Add STACKLEAK plugin for tracking the kernel stack
The STACKLEAK feature erases the kernel stack before returning from
syscalls. That reduces the information which kernel stack leak bugs can
reveal and blocks some uninitialized stack variable attacks.
This commit introduces the STACKLEAK gcc plugin. It is needed for
tracking the lowest border of the kernel stack, which is important
for the code erasing the used part of the kernel stack at the end
of syscalls (comes in a separate commit).
The STACKLEAK feature is ported from grsecurity/PaX. More information at:
https://grsecurity.net/
https://pax.grsecurity.net/
This code is modified from Brad Spengler/PaX Team's code in the last
public patch of grsecurity/PaX based on our understanding of the code.
Changes or omissions from the original code are ours and don't reflect
the original grsecurity/PaX code.
Signed-off-by: Alexander Popov <alex.popov@linux.com>
Tested-by: Laura Abbott <labbott@redhat.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Diffstat (limited to '')
| -rw-r--r-- | scripts/gcc-plugins/Kconfig | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/scripts/gcc-plugins/Kconfig b/scripts/gcc-plugins/Kconfig index 977b84e69787..c65fdd823591 100644 --- a/scripts/gcc-plugins/Kconfig +++ b/scripts/gcc-plugins/Kconfig @@ -158,4 +158,16 @@ config GCC_PLUGIN_STACKLEAK * https://grsecurity.net/ * https://pax.grsecurity.net/ +config STACKLEAK_TRACK_MIN_SIZE + int "Minimum stack frame size of functions tracked by STACKLEAK" + default 100 + range 0 4096 + depends on GCC_PLUGIN_STACKLEAK + help + The STACKLEAK gcc plugin instruments the kernel code for tracking + the lowest border of the kernel stack (and for some other purposes). + It inserts the stackleak_track_stack() call for the functions with + a stack frame size greater than or equal to this parameter. + If unsure, leave the default value 100. + endif |