summaryrefslogtreecommitdiffstats
path: root/arch
diff options
context:
space:
mode:
authorIngo Molnar <mingo@elte.hu>2008-02-14 09:22:34 +0100
committerThomas Gleixner <tglx@linutronix.de>2008-05-26 16:15:31 +0200
commit7e09b2a02dae4616a5a26000169964b32f86cd35 (patch)
tree5dc54ff304fa9c73bd49cc8d93dfc0af1eb52e26 /arch
parentx86: setup stack canary for the idle threads (diff)
downloadlinux-7e09b2a02dae4616a5a26000169964b32f86cd35.tar.xz
linux-7e09b2a02dae4616a5a26000169964b32f86cd35.zip
x86: fix canary of the boot CPU's idle task
the boot CPU's idle task has a zero stackprotector canary value. this is a special task that is never forked, so the fork code does not randomize its canary. Do it when we hit cpu_idle(). Academic sidenote: this means that the early init code runs with a zero canary and hence the canary becomes predictable for this short, boot-only amount of time. Although attack vectors against early init code are very rare, it might make sense to move this initialization to an earlier point. (to one of the early init functions that never return - such as start_kernel()) Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Diffstat (limited to 'arch')
-rw-r--r--arch/x86/kernel/process_64.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index 9e69e223023e..d4c7ac7aa430 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -150,9 +150,13 @@ void cpu_idle(void)
#ifdef CONFIG_CC_STACKPROTECTOR
/*
* If we're the non-boot CPU, nothing set the PDA stack
- * canary up for us. This is as good a place as any for
- * doing that.
+ * canary up for us - and if we are the boot CPU we have
+ * a 0 stack canary. This is a good place for updating
+ * it, as we wont ever return from this function (so the
+ * invalid canaries already on the stack wont ever
+ * trigger):
*/
+ current->stack_canary = get_random_int();
write_pda(stack_canary, current->stack_canary);
#endif
/* endless idle loop with no priority at all */