Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
randstruct: Fix gcc-plugin performance mode to stay in group
The performance mode of the gcc-plugin randstruct was shuffling struct
members outside of the cache-line groups. Limit the range to the
specified group indexes.
Cc: linux-hardening@vger.kernel.org
Cc: stable@vger.kernel.org
Reported-by: Lukas Loidolt <e1634039@student.tuwien.ac.at>
Closes: https://lore.kernel.org/all/f3ca77f0-e414-4065-83a5-ae4c4d25545d@student.tuwien.ac.at
Fixes: 313dd1b62921 ("gcc-plugins: Add the randstruct plugin")
Signed-off-by: Kees Cook <keescook@chromium.org>
+8
-3
+8
-3
scripts/gcc-plugins/randomize_layout_plugin.c
+8
-3
scripts/gcc-plugins/randomize_layout_plugin.c
···
191
191
192
192
static void performance_shuffle(tree *newtree, unsigned long length, ranctx *prng_state)
193
193
{
194
-
unsigned long i, x;
194
+
unsigned long i, x, index;
195
195
struct partition_group size_group[length];
196
196
unsigned long num_groups = 0;
197
197
unsigned long randnum;
198
198
199
199
partition_struct(newtree, length, (struct partition_group *)&size_group, &num_groups);
200
+
201
+
/* FIXME: this group shuffle is currently a no-op. */
200
202
for (i = num_groups - 1; i > 0; i--) {
201
203
struct partition_group tmp;
202
204
randnum = ranval(prng_state) % (i + 1);
···
208
206
}
209
207
210
208
for (x = 0; x < num_groups; x++) {
211
-
for (i = size_group[x].start + size_group[x].length - 1; i > size_group[x].start; i--) {
209
+
for (index = size_group[x].length - 1; index > 0; index--) {
212
210
tree tmp;
211
+
212
+
i = size_group[x].start + index;
213
213
if (DECL_BIT_FIELD_TYPE(newtree[i]))
214
214
continue;
215
-
randnum = ranval(prng_state) % (i + 1);
215
+
randnum = ranval(prng_state) % (index + 1);
216
+
randnum += size_group[x].start;
216
217
// we could handle this case differently if desired
217
218
if (DECL_BIT_FIELD_TYPE(newtree[randnum]))
218
219
continue;