Danny Milosavljevic <dan...@scratchpost.org> writes: > Hi, > > what do you all think of rebuilding the world with "-fstack-check" (either > now or later on) ? > > That would make gcc emit code to always grow the stack in a way that it > certainly touches each 4 KiB (parametrizable by > STACK_CHECK_PROBE_INTERVAL_EXP) page on the way. > > I think that would be the right and permanent fix - unlike the whack-a-mole > approach where we patch programs not to do what they are supposed to do, if > their stack allocation happens to grow. > > See also <https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt> and > <https://gcc.gnu.org/onlinedocs/gccint/Stack-Checking.html>.
Red Hat investigated this during the embargo[0] and found that the current implementation in GCC has problems[1]. We should wait until those issues are resolved first, but sounds good to me. [0] http://seclists.org/oss-sec/2017/q2/556 [1] http://seclists.org/oss-sec/2017/q2/505
signature.asc
Description: PGP signature
