linux-mips
[Top] [All Lists]

Re: [PATCH] MIPS: ZBOOT: implement stack protector in compressed boot ph

To: Ben Chan <benchan@chromium.org>
Subject: Re: [PATCH] MIPS: ZBOOT: implement stack protector in compressed boot phase
From: Kees Cook <keescook@chromium.org>
Date: Tue, 24 Jun 2014 16:55:00 -0700
Cc: Ralf Baechle <ralf@linux-mips.org>, linux-mips@linux-mips.org, LKML <linux-kernel@vger.kernel.org>, Olof Johansson <olofj@chromium.org>
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc:content-type; bh=YekSIZRQ3QnkLAwIJxqv05Gz8Gv46xg6ugZ7lSl0fSU=; b=bbArQaaEqDg35DMi3AbXkyo31vKOcwvJhjzZRrmbiDVYb5X/dLkFlJ0afTmvm+IqvB JjQB29g0lMV8UppJzYjjp0qs2WcNXY4kpn63ZIdg7bTJy+vI6jOcQjGWWTqOjWSAPSun GQAWn9uGsJkdgvKciFXOYhS3chZMtq+4zue07kMkX5ksgkLvyCiHTmuKz5oG3uwV63oX JrSwG6EhTQonlECGpzXosf0f+GFRo0K2EeiEfIpKFfPtQutKeRXJ+qWSNVfp0sa1Frli Y35pSWEv6bMRArfYzdqSIcCR650cfwEWCzu+II9oU21lG0G05znZDtZzitxDnHHdUaV9 Lfsw==
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc:content-type; bh=YekSIZRQ3QnkLAwIJxqv05Gz8Gv46xg6ugZ7lSl0fSU=; b=cu1UpqxxbEOUc6yVqo6NxbhDmF/T71wfuHX5/AuPS3FPZMmRDHNlC5BqrT8kUTMwOC PSVMIybl3GEREc6W3bDrGKOsFU/Ird64LO+lut1nAxvHeZDhOBppNxZjIXgnxW860CY1 vzRFCEy6AD++Spw2V/Z/DjqT0Ld+G6VpdemiY=
In-reply-to: <1403650817-21641-1-git-send-email-benchan@chromium.org>
List-archive: <http://www.linux-mips.org/archives/linux-mips/>
List-help: <mailto:ecartis@linux-mips.org?Subject=help>
List-id: linux-mips <linux-mips.eddie.linux-mips.org>
List-owner: <mailto:ralf@linux-mips.org>
List-post: <mailto:linux-mips@linux-mips.org>
List-software: Ecartis version 1.0.0
List-subscribe: <mailto:ecartis@linux-mips.org?subject=subscribe%20linux-mips>
List-unsubscribe: <mailto:ecartis@linux-mips.org?subject=unsubscribe%20linux-mips>
Original-recipient: rfc822;linux-mips@linux-mips.org
References: <1403650817-21641-1-git-send-email-benchan@chromium.org>
Sender: linux-mips-bounce@linux-mips.org
On Tue, Jun 24, 2014 at 4:00 PM, Ben Chan <benchan@chromium.org> wrote:
> This patch implements the stack protector code in MIPS compressed boot
> phase based on the same code added to arm in commit
> 8779657d29c0ebcc0c94ede4df2f497baf1b563f "stackprotector: Introduce
> CONFIG_CC_STACKPROTECTOR_STRONG" by Kees Cook <keescook@chromium.org>
>
> Signed-off-by: Ben Chan <benchan@chromium.org>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Olof Johansson <olofj@chromium.org>
> ---
>  arch/mips/boot/compressed/decompress.c | 14 ++++++++++++++
>  1 file changed, 14 insertions(+)
>
> diff --git a/arch/mips/boot/compressed/decompress.c 
> b/arch/mips/boot/compressed/decompress.c
> index c00c4dd..b49c7ad 100644
> --- a/arch/mips/boot/compressed/decompress.c
> +++ b/arch/mips/boot/compressed/decompress.c
> @@ -67,10 +67,24 @@ void error(char *x)
>  #include "../../../../lib/decompress_unxz.c"
>  #endif
>
> +unsigned long __stack_chk_guard;
> +
> +void __stack_chk_guard_setup(void)
> +{
> +       __stack_chk_guard = 0x000a0dff;
> +}
> +
> +void __stack_chk_fail(void)
> +{
> +       error("stack-protector: Kernel stack is corrupted\n");
> +}
> +
>  void decompress_kernel(unsigned long boot_heap_start)
>  {
>         unsigned long zimage_start, zimage_size;
>
> +       __stack_chk_guard_setup();
> +
>         zimage_start = (unsigned long)(&__image_begin);
>         zimage_size = (unsigned long)(&__image_end) -
>             (unsigned long)(&__image_begin);
> --
> 2.0.0.526.g5318336

Yup, that looks correct to me. As in the ARM case, gathering entropy
for the canary here is overkill, so this is sufficient to build and
provide basic canary support in the decompression phase of boot.

Reviewed-by: Kees Cook <keescook@chromium.org>

Thanks!

-Kees

-- 
Kees Cook
Chrome OS Security

<Prev in Thread] Current Thread [Next in Thread>