Bug 12376 - CONFIG_SCHED_STACK_END_CHECK is disabled on x86_64, armv5tel and aarch64
Summary: CONFIG_SCHED_STACK_END_CHECK is disabled on x86_64, armv5tel and aarch64
Status: CLOSED FIXED
Alias: None
Product: IPFire
Classification: Unclassified
Component: --- (show other bugs)
Version: 2
Hardware: unspecified All
: Will affect most users Security
Assignee: Peter Müller
QA Contact: Arne.F
URL:
Keywords:
Depends on:
Blocks: KERNSEC
  Show dependency treegraph
 
Reported: 2020-04-14 15:44 UTC by Peter Müller
Modified: 2020-07-01 15:15 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Peter Müller 2020-04-14 15:44:40 UTC
Quote from https://capsule8.com/blog/kernel-configuration-glossary/:

> Significance: High
> 
> This option checks for a stack overrun on calls to schedule(). If the stack
> end location is found to be over written always panic as the content of the
> corrupted region can no longer be trusted. This is to ensure no erroneous
> behaviour occurs which could result in data corruption or a sporadic crash at a
> later stage once the region is examined. The runtime overhead introduced is
> minimal.

In my opinion this can be safely enabled on all architectures.
Comment 1 Peter Müller 2020-04-18 08:42:53 UTC
https://patchwork.ipfire.org/patch/2982/