[Top] [All Lists]

Re: [PATCH v3 2/2] provide -fstack-protector-strong build option

To: Kees Cook <>
Subject: Re: [PATCH v3 2/2] provide -fstack-protector-strong build option
From: Ingo Molnar <>
Date: Wed, 18 Dec 2013 10:59:05 +0100
Cc:, Michal Marek <>, Russell King <>, Ralf Baechle <>, Paul Mundt <>, Thomas Gleixner <>, Ingo Molnar <>, "H. Peter Anvin" <>, Andrew Morton <>, James Hogan <>, Stephen Rothwell <>, Shawn Guo <>,,,,,
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20120113; h=sender:date:from:to:cc:subject:message-id:references:mime-version :content-type:content-disposition:in-reply-to:user-agent; bh=do5+sgkkGRf4RkRY64kPTOkpVJ/rS6QocStXkAO5/kM=; b=x7CczRJjJRxbs3T184GRp78xoHy6+6SgscvxcLq+GqjtMCF4IhB7eUb0w4QkNge0Pd HM2y480IT9rLfZuC9gvjYEJ3m5Xv+0YRFC2HKrkIYrU3zbwnqyqwRIykK/0tApRLvDas Jsv0SZK4tMrqZ2ltfA5GmEPQEA/71oHxEXv4nSWWKjcu4oVmQQmM7A8Mmh5DgrQyNSRG 4t/55voZKQOAFr0Br6JW0pk/V7HlO3Ombc8VWGm8CbAW6eTmej3KMwmc6vTDx+PqrKzN JYb6HZCIIMSmYKN72e9oCURbgkbapAFCH3pVOZyLcZVBu41xuOQKIqmKUobTgBmrGG3O eEjA==
In-reply-to: <>
List-archive: <>
List-help: <>
List-id: linux-mips <>
List-owner: <>
List-post: <>
List-software: Ecartis version 1.0.0
List-subscribe: <>
List-unsubscribe: <>
Original-recipient: rfc822;
References: <> <>
User-agent: Mutt/1.5.21 (2010-09-15)
* Kees Cook <> wrote:

> This changes the stack protector config option into a choice of "None",
> "Regular", and "Strong". For "Strong", the kernel is built with
> -fstack-protector-strong (gcc 4.9 and later). This options increases
> the coverage of the stack protector without the heavy performance hit
> of -fstack-protector-all.
> For reference, the stack protector options available in gcc are:
> -fstack-protector-all:
> Adds the stack-canary saving prefix and stack-canary checking suffix to
> _all_ function entry and exit. Results in substantial use of stack space
> for saving the canary for deep stack users (e.g. historically xfs), and
> measurable (though shockingly still low) performance hit due to all the
> saving/checking. Really not suitable for sane systems, and was entirely
> removed as an option from the kernel many years ago.
> -fstack-protector:
> Adds the canary save/check to functions that define an 8
> (--param=ssp-buffer-size=N, N=8 by default) or more byte local char
> array. Traditionally, stack overflows happened with string-based
> manipulations, so this was a way to find those functions. Very few
> total functions actually get the canary; no measurable performance or
> size overhead.
> -fstack-protector-strong
> Adds the canary for a wider set of functions, since it's not just those
> with strings that have ultimately been vulnerable to stack-busting. With
> this superset, more functions end up with a canary, but it still
> remains small compared to all functions with no measurable change in
> performance. Based on the original design document, a function gets the
> canary when it contains any of:
> - local variable's address used as part of the RHS of an assignment or
>   function argument
> - local variable is an array (or union containing an array), regardless
>   of array type or length
> - uses register local variables
> Comparison of "size" output when built with gcc-4.9 in three configurations:
> - defconfig
> - defconfig + CONFIG_CC_STACKPROTECTOR (+0.33%)
> - defconfig + CONFIG_CC_STACKPROTECTOR_STRONG via this patch (+2.24%)
> text      data     bss      dec       hex     filename
> 11430641  1457584  1191936  14080161  d6d8a1  vmlinux
> 11468490  1457584  1191936  14118010  d76c7a  vmlinux.stackprotector
> 11692790  1457584  1191936  14342310  dad8a6  vmlinux.stackprotector-strong

Beyond the kernel size calculation, could you please also provide an 
estimation about the _number_ of functions affected, out of N kernel 
functions, so that the user has a rough picture about the scope and 
distribution of these variants?

I.e. something like:

                                                 # of canary checks
 - defconfig                                     0 functions out of 100k 
 - defconfig + STACKPROTECTOR                   1k functions out of 100k 
 - defconfig + STACKPROTECTOR_STRONG           20k functions out of 100k 


<Prev in Thread] Current Thread [Next in Thread>