This is a note to let you know that I've just added the patch titled
lkdtm: isolate stack corruption test
to the 3.12-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
lkdtm-isolate-stack-corruption-test.patch
and it can be found in the queue-3.12 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 629c66a22c21b692b6e58b9c1d8fa56a60ccb52d Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@xxxxxxxxxxxx>
Date: Thu, 24 Oct 2013 18:05:42 -0700
Subject: lkdtm: isolate stack corruption test
From: Kees Cook <keescook@xxxxxxxxxxxx>
commit 629c66a22c21b692b6e58b9c1d8fa56a60ccb52d upstream.
When tests were added to lkdtm that grew the stack frame, the stack
corruption test stopped working. This isolates the test in its own
function, and forces it not to be inlined.
Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
Fixes: cc33c537c12f ("lkdtm: add "EXEC_*" triggers")
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/misc/lkdtm.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
--- a/drivers/misc/lkdtm.c
+++ b/drivers/misc/lkdtm.c
@@ -297,6 +297,14 @@ static void do_nothing(void)
return;
}
+static noinline void corrupt_stack(void)
+{
+ /* Use default char array length that triggers stack protection. */
+ char data[8];
+
+ memset((void *)data, 0, 64);
+}
+
static void execute_location(void *dst)
{
void (*func)(void) = dst;
@@ -327,13 +335,9 @@ static void lkdtm_do_action(enum ctype w
case CT_OVERFLOW:
(void) recursive_loop(0);
break;
- case CT_CORRUPT_STACK: {
- /* Make sure the compiler creates and uses an 8 char array. */
- volatile char data[8];
-
- memset((void *)data, 0, 64);
+ case CT_CORRUPT_STACK:
+ corrupt_stack();
break;
- }
case CT_UNALIGNED_LOAD_STORE_WRITE: {
static u8 data[5] __attribute__((aligned(4))) = {1, 2,
3, 4, 5};
Patches currently in stable-queue which might be from keescook@xxxxxxxxxxxx are
queue-3.12/libertas-potential-oops-in-debugfs.patch
queue-3.12/lkdtm-isolate-stack-corruption-test.patch
queue-3.12/aacraid-prevent-invalid-pointer-dereference.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html