Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1713238 > unrolled thread

[PATCH] init: Move stack canary initialization after setup_arch

Back to article view | Back to linux.kernel

Contents

  [PATCH] init: Move stack canary initialization after setup_arch Laura Abbott <labbott@redhat.com> - 2017-08-16 21:10 +0200
    Re: [PATCH] init: Move stack canary initialization after setup_arch Kees Cook <keescook@chromium.org> - 2017-08-16 21:30 +0200

#1713238 — [PATCH] init: Move stack canary initialization after setup_arch

From: Laura Abbott <lauraa@codeaurora.org>

Stack canary intialization involves getting a random number.
Getting this random number may involve accessing caches or other
architectural specific features which are not available until
after the architecture is setup. Move the stack canary initialization
later to accomodate this.

Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Laura Abbott <labbott@redhat.com>
---
This was a patch I did a while ago as part of some out of tree work to make the
stack canary randomized on arm. The overall work didn't really go anywhere
but there is interest in this part for other approaches to adding randomeness.

I can re-send with more Cc for anyone else who might have opinions.
---
 init/main.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/init/main.c b/init/main.c
index 052481fbe363..c71c4451094c 100644
--- a/init/main.c
+++ b/init/main.c
@@ -515,11 +515,7 @@ asmlinkage __visible void __init start_kernel(void)
 	smp_setup_processor_id();
 	debug_objects_early_init();
 
-	/*
-	 * Set up the initial canary ASAP:
-	 */
 	add_latent_entropy();
-	boot_init_stack_canary();
 
 	cgroup_init_early();
 
@@ -534,6 +530,10 @@ asmlinkage __visible void __init start_kernel(void)
 	page_address_init();
 	pr_notice("%s", linux_banner);
 	setup_arch(&command_line);
+	/*
+	 * Set up the the initial canary ASAP:
+	 */
+	boot_init_stack_canary();
 	mm_init_cpumask(&init_mm);
 	setup_command_line(command_line);
 	setup_nr_cpu_ids();
-- 
2.13.0

[toc] | [next] | [standalone]

#1713256

On Wed, Aug 16, 2017 at 12:09 PM, Laura Abbott <labbott@redhat.com> wrote:
> From: Laura Abbott <lauraa@codeaurora.org>
>
> Stack canary intialization involves getting a random number.
> Getting this random number may involve accessing caches or other
> architectural specific features which are not available until
> after the architecture is setup. Move the stack canary initialization
> later to accomodate this.
>
> Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
> Signed-off-by: Laura Abbott <labbott@redhat.com>
> ---
> This was a patch I did a while ago as part of some out of tree work to make the
> stack canary randomized on arm. The overall work didn't really go anywhere
> but there is interest in this part for other approaches to adding randomeness.
>
> I can re-send with more Cc for anyone else who might have opinions.

Combined with adding the kernel cmdline to entropy, this would be
desirable. This should probably go via -mm (as far a CCs go).

> ---
>  init/main.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/init/main.c b/init/main.c
> index 052481fbe363..c71c4451094c 100644
> --- a/init/main.c
> +++ b/init/main.c
> @@ -515,11 +515,7 @@ asmlinkage __visible void __init start_kernel(void)
>         smp_setup_processor_id();
>         debug_objects_early_init();
>
> -       /*
> -        * Set up the initial canary ASAP:
> -        */
>         add_latent_entropy();
> -       boot_init_stack_canary();

Please move the entropy call too, since that should be just before the
stack canary initialization (in an effort to gather as much as
possible).

>
>         cgroup_init_early();
>
> @@ -534,6 +530,10 @@ asmlinkage __visible void __init start_kernel(void)
>         page_address_init();
>         pr_notice("%s", linux_banner);
>         setup_arch(&command_line);
> +       /*
> +        * Set up the the initial canary ASAP:

Maybe change "ASAP" to "after reasonable entropy has been gathered"

> +        */
> +       boot_init_stack_canary();
>         mm_init_cpumask(&init_mm);
>         setup_command_line(command_line);
>         setup_nr_cpu_ids();
> --
> 2.13.0
>

Thanks!

-Kees


-- 
Kees Cook
Pixel Security

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web