[lkml]   [2006]   [Mar]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Subject[Patch 0/8] Port of -fstack-protector to the kernel
    This patch series adds support for the gcc 4.1 -fstack-protector feature to
    the kernel. Unfortunately this needs a gcc patch before it can work, so at
    this point these patches are just for comment, not for merging.

    -fstack-protector is a security feature in gcc that causes "selected" functions
    to store a special "canary" value at the start of the function, just below
    the return address. At the end of the function, just before using this
    return address with the "ret" instruction, this canary value is compared to
    the reference value again. If the value of the stack canary has changed, it is a sign
    that there has been some stack corruption (most likely due to a buffer overflow) that
    has compromised the integrity of the return address.

    Standard, the "selected" functions are those that actually have stack
    buffers of at least 8 bytes, this selection is done to limit the overhead to
    only those functions with the highest risk potential. There is an override to enable this
    for all functions.

    On first sight this would not be needed for the kernel, because the kernel
    is "perfect" and "has no buffer overflows on the stack". I thought that too
    for a long time, but the last year has shown a few cases where that would
    have been overly naive.

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2006-03-17 17:19    [W:0.034 / U:6.396 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site