1 files changed, 67 insertions, 0 deletions

diff --git a/arch/Kconfig b/arch/Kconfig
index f1cf895c040f..80bbb8ccd0d1 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -336,6 +336,73 @@ config SECCOMP_FILTER
 
           See Documentation/prctl/seccomp_filter.txt for details.
 
+config HAVE_CC_STACKPROTECTOR
+        bool
+        help
+          An arch should select this symbol if:
+          - its compiler supports the -fstack-protector option
+          - it has implemented a stack canary (e.g. __stack_chk_guard)
+
+config CC_STACKPROTECTOR
+        def_bool n
+        help
+          Set when a stack-protector mode is enabled, so that the build
+          can enable kernel-side support for the GCC feature.
+
+choice
+        prompt "Stack Protector buffer overflow detection"
+        depends on HAVE_CC_STACKPROTECTOR
+        default CC_STACKPROTECTOR_NONE
+        help
+          This option turns on the "stack-protector" GCC feature. This
+          feature puts, at the beginning of functions, a canary value on
+          the stack just before the return address, and validates
+          the value just before actually returning.  Stack based buffer
+          overflows (that need to overwrite this return address) now also
+          overwrite the canary, which gets detected and the attack is then
+          neutralized via a kernel panic.
+
+config CC_STACKPROTECTOR_NONE
+        bool "None"
+        help
+          Disable "stack-protector" GCC feature.
+
+config CC_STACKPROTECTOR_REGULAR
+        bool "Regular"
+        select CC_STACKPROTECTOR
+        help
+          Functions will have the stack-protector canary logic added if they
+          have an 8-byte or larger character array on the stack.
+
+          This feature requires gcc version 4.2 or above, or a distribution
+          gcc with the feature backported ("-fstack-protector").
+
+          On an x86 "defconfig" build, this feature adds canary checks to
+          about 3% of all kernel functions, which increases kernel code size
+          by about 0.3%.
+
+config CC_STACKPROTECTOR_STRONG
+        bool "Strong"
+        select CC_STACKPROTECTOR
+        help
+          Functions will have the stack-protector canary logic added in any
+          of the following conditions:
+
+          - local variable's address used as part of the right hand side of an
+            assignment or function argument
+          - local variable is an array (or union containing an array),
+            regardless of array type or length
+          - uses register local variables
+
+          This feature requires gcc version 4.9 or above, or a distribution
+          gcc with the feature backported ("-fstack-protector-strong").
+
+          On an x86 "defconfig" build, this feature adds canary checks to
+          about 20% of all kernel functions, which increases the kernel code
+          size by about 2%.
+
+endchoice
+
 config HAVE_CONTEXT_TRACKING
         bool
         help