x86: implement x86_32 stack protector

Impact: stack protector for x86_32

Implement stack protector for x86_32.  GDT entry 28 is used for it.
It's set to point to stack_canary-20 and have the length of 24 bytes.
CONFIG_CC_STACKPROTECTOR turns off CONFIG_X86_32_LAZY_GS and sets %gs
to the stack canary segment on entry.  As %gs is otherwise unused by
the kernel, the canary can be anywhere.  It's defined as a percpu
variable.

x86_32 exception handlers take register frame on stack directly as
struct pt_regs.  With -fstack-protector turned on, gcc copies the
whole structure after the stack canary and (of course) doesn't copy
back on return thus losing all changed.  For now, -fno-stack-protector
is added to all files which contain those functions.  We definitely
need something better.

Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

1 files changed, 19 insertions, 1 deletions

diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index 24c0e5cd71e3..924e31615fb6 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -19,6 +19,7 @@
 #include <asm/asm-offsets.h>
 #include <asm/setup.h>
 #include <asm/processor-flags.h>
+#include <asm/percpu.h>
 
 /* Physical address */
 #define pa(X) ((X) - __PAGE_OFFSET)
@@ -437,8 +438,25 @@ is386:	movl $2,%ecx		# set MP
         movl $(__KERNEL_PERCPU), %eax
         movl %eax,%fs                   # set this cpu's percpu
 
-        xorl %eax,%eax                  # Clear GS and LDT
+#ifdef CONFIG_CC_STACKPROTECTOR
+        /*
+         * The linker can't handle this by relocation.  Manually set
+         * base address in stack canary segment descriptor.
+         */
+        cmpb $0,ready
+        jne 1f
+        movl $per_cpu__gdt_page,%eax
+        movl $per_cpu__stack_canary,%ecx
+        movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
+        shrl $16, %ecx
+        movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
+        movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax)
+1:
+#endif
+        movl $(__KERNEL_STACK_CANARY),%eax
         movl %eax,%gs
+
+        xorl %eax,%eax                  # Clear LDT
         lldt %ax
 
         cld                     # gcc2 wants the direction flag cleared at all times