diff mbox

use get_random_long for the per-task stack canary

Message ID 20170504133209.3053-1-danielmicay@gmail.com (mailing list archive)
State New, archived
Headers show

Commit Message

Daniel Micay May 4, 2017, 1:32 p.m. UTC 
The stack canary is an unsigned long and should be fully initialized to
random data rather than only 32 bits of random data.

Cc: stable@vger.kernel.org
Signed-off-by: Daniel Micay <danielmicay@gmail.com>
---
 kernel/fork.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Arjan van de Ven May 4, 2017, 1:33 p.m. UTC | #1 
On 5/4/2017 6:32 AM, Daniel Micay wrote:
> The stack canary is an unsigned long and should be fully initialized to
> random data rather than only 32 bits of random data.

that makes sense to me... ack
Rik van Riel May 4, 2017, 2:04 p.m. UTC | #2 
On Thu, 2017-05-04 at 09:32 -0400, Daniel Micay wrote:
> The stack canary is an unsigned long and should be fully initialized
> to
> random data rather than only 32 bits of random data.
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Daniel Micay <danielmicay@gmail.com>
> 
Acked-by: Rik van Riel <riel@redhat.com>
Kees Cook May 4, 2017, 2:29 p.m. UTC | #3 
On Thu, May 4, 2017 at 7:04 AM, Rik van Riel <riel@redhat.com> wrote:
> On Thu, 2017-05-04 at 09:32 -0400, Daniel Micay wrote:
>> The stack canary is an unsigned long and should be fully initialized
>> to
>> random data rather than only 32 bits of random data.
>>
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Daniel Micay <danielmicay@gmail.com>
>>
> Acked-by: Rik van Riel <riel@redhat.com>

Thanks! Ingo, should this go via tip?

Acked-by: Kees Cook <keescook@chromium.org>

-Kees
diff mbox

Patch

diff --git a/kernel/fork.c b/kernel/fork.c
index 56d85fd81411..ff84ff82f56a 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -537,7 +537,7 @@  static struct task_struct *dup_task_struct(struct task_struct *orig, int node)
 	set_task_stack_end_magic(tsk);
 
 #ifdef CONFIG_CC_STACKPROTECTOR
-	tsk->stack_canary = get_random_int();
+	tsk->stack_canary = get_random_long();
 #endif
 
 	/*