On Wed, May 24, 2017 at 8:57 AM, <r...@redhat.com> wrote: > From: Rik van Riel <r...@redhat.com> > > Use the ascii-armor canary to prevent unterminated C string overflows > from being able to successfully overwrite the canary, even if they > somehow obtain the canary value. > > Inspired by execshield ascii-armor and Daniel Micay's linux-hardened tree. > > Signed-off-by: Rik van Riel <r...@redhat.com>
Acked-by: Kees Cook <keesc...@chromium.org> -Kees > --- > kernel/fork.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/kernel/fork.c b/kernel/fork.c > index aa1076c5e4a9..b3591e9250a8 100644 > --- a/kernel/fork.c > +++ b/kernel/fork.c > @@ -560,7 +560,7 @@ static struct task_struct *dup_task_struct(struct > task_struct *orig, int node) > set_task_stack_end_magic(tsk); > > #ifdef CONFIG_CC_STACKPROTECTOR > - tsk->stack_canary = get_random_long(); > + tsk->stack_canary = get_random_canary(); > #endif > > /* > -- > 2.9.3 > -- Kees Cook Pixel Security
