On Wed, Jan 11, 2017 at 6:56 AM, Arnd Bergmann <a...@arndb.de> wrote:
> After the latest change to make sure the compiler actually does a memset,
> it is now smart enough to flag the stack overflow at compile time,
> at least with gcc-7.0:
>
> drivers/misc/lkdtm_bugs.c: In function 'lkdtm_CORRUPT_STACK':
> drivers/misc/lkdtm_bugs.c:88:144: warning: 'memset' writing 64 bytes into a
> region of size 8 overflows the destination [-Wstringop-overflow=]
>
> To outsmart the compiler again, this moves the memset into a noinline
> function where (for now) it doesn't see that we intentionally write
> broken code here.
>
> Fixes: c55d240003ae ("lkdtm: Prevent the compiler from optimising
> lkdtm_CORRUPT_STACK()")
> Signed-off-by: Arnd Bergmann <a...@arndb.de>
Hah. Yes, works for me. :)
Acked-by: Kees Cook <keesc...@chromium.org>
-Kees
> ---
> drivers/misc/lkdtm_bugs.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/misc/lkdtm_bugs.c b/drivers/misc/lkdtm_bugs.c
> index 91edd0b55e5c..bb3bb8ef5f44 100644
> --- a/drivers/misc/lkdtm_bugs.c
> +++ b/drivers/misc/lkdtm_bugs.c
> @@ -80,12 +80,17 @@ void lkdtm_OVERFLOW(void)
> (void) recursive_loop(recur_count);
> }
>
> +static noinline void __lkdtm_CORRUPT_STACK(void *stack)
> +{
> + memset(stack, 'a', 64);
> +}
> +
> noinline void lkdtm_CORRUPT_STACK(void)
> {
> /* Use default char array length that triggers stack protection. */
> char data[8];
> + __lkdtm_CORRUPT_STACK(&data);
>
> - memset((void *)data, 'a', 64);
> pr_info("Corrupted stack with '%16s'...\n", data);
> }
>
> --
> 2.9.0
>
--
Kees Cook
Nexus Security
