Messages in this thread Patch in this message | | | From | Brian Gerst <> | Subject | [PATCH 2/9] x86/boot: Disable stack protector for early boot code | Date | Mon, 23 Oct 2023 17:17:23 -0400 |
| |
On 64-bit, this will prevent crashes when the canary access is changed from %gs:40 to %gs:__stack_chk_guard(%rip). RIP-relative addresses from the identity-mapped early boot code will target the wrong address with zero-based percpu. KASLR could then shift that address to an unmapped page causing a crash on boot.
This early boot code runs well before userspace is active and does not need stack protector enabled.
Signed-off-by: Brian Gerst <brgerst@gmail.com> --- arch/x86/kernel/Makefile | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile index 0000325ab98f..aff619054e17 100644 --- a/arch/x86/kernel/Makefile +++ b/arch/x86/kernel/Makefile @@ -39,6 +39,8 @@ KMSAN_SANITIZE_nmi.o := n KCOV_INSTRUMENT_head$(BITS).o := n KCOV_INSTRUMENT_sev.o := n +CFLAGS_head32.o := -fno-stack-protector +CFLAGS_head64.o := -fno-stack-protector CFLAGS_irq.o := -I $(srctree)/$(src)/../include/asm/trace obj-y += head_$(BITS).o -- 2.41.0
| |