[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [PATCH v7 2/3] xen: arm: enable stack protector feature
Enable previously added CONFIG_STACK_PROTECTOR feature for ARM platform. Initialize stack protector magic value very early, at the very beginning of start_xen() function. We want to do this early because prior to that boot_stack_chk_guard_setup() call, default stack protector guard value is used. While it is fine for general development and testing, it does not provide highest security level, because potential attacker will know the default value and can alter a payload, so correct stack guard value will be placed in the correct position. Apart from that argument, boot_stack_chk_guard_setup() should be called prior to enabling secondary CPUs to avoid race with them. Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@xxxxxxxx> Acked-by: Julien Grall <jgrall@xxxxxxxxxx> --- Changes in v6: - Expanded the commit message - Added Julien's A-b tag Changes in v5: - Call boot_stack_chk_guard_setup() from start_xen() instead of early ASM --- xen/arch/arm/Kconfig | 1 + xen/arch/arm/setup.c | 3 +++ 2 files changed, 4 insertions(+) diff --git a/xen/arch/arm/Kconfig b/xen/arch/arm/Kconfig index ffdff1f0a3..5d6870c817 100644 --- a/xen/arch/arm/Kconfig +++ b/xen/arch/arm/Kconfig @@ -15,6 +15,7 @@ config ARM select GENERIC_UART_INIT select HAS_ALTERNATIVE if HAS_VMAP select HAS_DEVICE_TREE + select HAS_STACK_PROTECTOR select HAS_UBSAN config ARCH_DEFCONFIG diff --git a/xen/arch/arm/setup.c b/xen/arch/arm/setup.c index ffcae900d7..fa11e6be9f 100644 --- a/xen/arch/arm/setup.c +++ b/xen/arch/arm/setup.c @@ -30,6 +30,7 @@ #include <xen/virtual_region.h> #include <xen/version.h> #include <xen/vmap.h> +#include <xen/stack-protector.h> #include <xen/trace.h> #include <xen/libfdt/libfdt-xen.h> #include <xen/acpi.h> @@ -306,6 +307,8 @@ void asmlinkage __init start_xen(unsigned long fdt_paddr) struct domain *d; int rc, i; + boot_stack_chk_guard_setup(); + dcache_line_bytes = read_dcache_line_bytes(); percpu_init_areas(); -- 2.48.1
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |