1 //===-- StackProtector.cpp - Stack Protector Insertion --------------------===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This pass inserts stack protectors into functions which need them. A variable 11 // with a random value in it is stored onto the stack before the local variables 12 // are allocated. Upon exiting the block, the stored value is checked. If it's 13 // changed, then there was some sort of violation and the program aborts. 14 // 15 //===----------------------------------------------------------------------===// 16 17 #include "llvm/CodeGen/StackProtector.h" 18 #include "llvm/ADT/SmallPtrSet.h" 19 #include "llvm/ADT/Statistic.h" 20 #include "llvm/Analysis/BranchProbabilityInfo.h" 21 #include "llvm/Analysis/EHPersonalities.h" 22 #include "llvm/Analysis/ValueTracking.h" 23 #include "llvm/CodeGen/Passes.h" 24 #include "llvm/IR/Attributes.h" 25 #include "llvm/IR/Constants.h" 26 #include "llvm/IR/DataLayout.h" 27 #include "llvm/IR/DebugInfo.h" 28 #include "llvm/IR/DerivedTypes.h" 29 #include "llvm/IR/Function.h" 30 #include "llvm/IR/GlobalValue.h" 31 #include "llvm/IR/GlobalVariable.h" 32 #include "llvm/IR/IRBuilder.h" 33 #include "llvm/IR/Instructions.h" 34 #include "llvm/IR/IntrinsicInst.h" 35 #include "llvm/IR/Intrinsics.h" 36 #include "llvm/IR/MDBuilder.h" 37 #include "llvm/IR/Module.h" 38 #include "llvm/Support/CommandLine.h" 39 #include "llvm/Target/TargetSubtargetInfo.h" 40 #include <cstdlib> 41 using namespace llvm; 42 43 #define DEBUG_TYPE "stack-protector" 44 45 STATISTIC(NumFunProtected, "Number of functions protected"); 46 STATISTIC(NumAddrTaken, "Number of local variables that have their address" 47 " taken."); 48 49 static cl::opt<bool> EnableSelectionDAGSP("enable-selectiondag-sp", 50 cl::init(true), cl::Hidden); 51 52 char StackProtector::ID = 0; 53 INITIALIZE_PASS(StackProtector, "stack-protector", "Insert stack protectors", 54 false, true) 55 56 FunctionPass *llvm::createStackProtectorPass(const TargetMachine *TM) { 57 return new StackProtector(TM); 58 } 59 60 StackProtector::SSPLayoutKind 61 StackProtector::getSSPLayout(const AllocaInst *AI) const { 62 return AI ? Layout.lookup(AI) : SSPLK_None; 63 } 64 65 void StackProtector::adjustForColoring(const AllocaInst *From, 66 const AllocaInst *To) { 67 // When coloring replaces one alloca with another, transfer the SSPLayoutKind 68 // tag from the remapped to the target alloca. The remapped alloca should 69 // have a size smaller than or equal to the replacement alloca. 70 SSPLayoutMap::iterator I = Layout.find(From); 71 if (I != Layout.end()) { 72 SSPLayoutKind Kind = I->second; 73 Layout.erase(I); 74 75 // Transfer the tag, but make sure that SSPLK_AddrOf does not overwrite 76 // SSPLK_SmallArray or SSPLK_LargeArray, and make sure that 77 // SSPLK_SmallArray does not overwrite SSPLK_LargeArray. 78 I = Layout.find(To); 79 if (I == Layout.end()) 80 Layout.insert(std::make_pair(To, Kind)); 81 else if (I->second != SSPLK_LargeArray && Kind != SSPLK_AddrOf) 82 I->second = Kind; 83 } 84 } 85 86 bool StackProtector::runOnFunction(Function &Fn) { 87 F = &Fn; 88 M = F->getParent(); 89 DominatorTreeWrapperPass *DTWP = 90 getAnalysisIfAvailable<DominatorTreeWrapperPass>(); 91 DT = DTWP ? &DTWP->getDomTree() : nullptr; 92 TLI = TM->getSubtargetImpl(Fn)->getTargetLowering(); 93 HasPrologue = false; 94 HasIRCheck = false; 95 96 Attribute Attr = Fn.getFnAttribute("stack-protector-buffer-size"); 97 if (Attr.isStringAttribute() && 98 Attr.getValueAsString().getAsInteger(10, SSPBufferSize)) 99 return false; // Invalid integer string 100 101 if (!RequiresStackProtector()) 102 return false; 103 104 // TODO(etienneb): Functions with funclets are not correctly supported now. 105 // Do nothing if this is funclet-based personality. 106 if (Fn.hasPersonalityFn()) { 107 EHPersonality Personality = classifyEHPersonality(Fn.getPersonalityFn()); 108 if (isFuncletEHPersonality(Personality)) 109 return false; 110 } 111 112 ++NumFunProtected; 113 return InsertStackProtectors(); 114 } 115 116 /// \param [out] IsLarge is set to true if a protectable array is found and 117 /// it is "large" ( >= ssp-buffer-size). In the case of a structure with 118 /// multiple arrays, this gets set if any of them is large. 119 bool StackProtector::ContainsProtectableArray(Type *Ty, bool &IsLarge, 120 bool Strong, 121 bool InStruct) const { 122 if (!Ty) 123 return false; 124 if (ArrayType *AT = dyn_cast<ArrayType>(Ty)) { 125 if (!AT->getElementType()->isIntegerTy(8)) { 126 // If we're on a non-Darwin platform or we're inside of a structure, don't 127 // add stack protectors unless the array is a character array. 128 // However, in strong mode any array, regardless of type and size, 129 // triggers a protector. 130 if (!Strong && (InStruct || !Trip.isOSDarwin())) 131 return false; 132 } 133 134 // If an array has more than SSPBufferSize bytes of allocated space, then we 135 // emit stack protectors. 136 if (SSPBufferSize <= M->getDataLayout().getTypeAllocSize(AT)) { 137 IsLarge = true; 138 return true; 139 } 140 141 if (Strong) 142 // Require a protector for all arrays in strong mode 143 return true; 144 } 145 146 const StructType *ST = dyn_cast<StructType>(Ty); 147 if (!ST) 148 return false; 149 150 bool NeedsProtector = false; 151 for (StructType::element_iterator I = ST->element_begin(), 152 E = ST->element_end(); 153 I != E; ++I) 154 if (ContainsProtectableArray(*I, IsLarge, Strong, true)) { 155 // If the element is a protectable array and is large (>= SSPBufferSize) 156 // then we are done. If the protectable array is not large, then 157 // keep looking in case a subsequent element is a large array. 158 if (IsLarge) 159 return true; 160 NeedsProtector = true; 161 } 162 163 return NeedsProtector; 164 } 165 166 bool StackProtector::HasAddressTaken(const Instruction *AI) { 167 for (const User *U : AI->users()) { 168 if (const StoreInst *SI = dyn_cast<StoreInst>(U)) { 169 if (AI == SI->getValueOperand()) 170 return true; 171 } else if (const PtrToIntInst *SI = dyn_cast<PtrToIntInst>(U)) { 172 if (AI == SI->getOperand(0)) 173 return true; 174 } else if (isa<CallInst>(U)) { 175 return true; 176 } else if (isa<InvokeInst>(U)) { 177 return true; 178 } else if (const SelectInst *SI = dyn_cast<SelectInst>(U)) { 179 if (HasAddressTaken(SI)) 180 return true; 181 } else if (const PHINode *PN = dyn_cast<PHINode>(U)) { 182 // Keep track of what PHI nodes we have already visited to ensure 183 // they are only visited once. 184 if (VisitedPHIs.insert(PN).second) 185 if (HasAddressTaken(PN)) 186 return true; 187 } else if (const GetElementPtrInst *GEP = dyn_cast<GetElementPtrInst>(U)) { 188 if (HasAddressTaken(GEP)) 189 return true; 190 } else if (const BitCastInst *BI = dyn_cast<BitCastInst>(U)) { 191 if (HasAddressTaken(BI)) 192 return true; 193 } 194 } 195 return false; 196 } 197 198 /// \brief Check whether or not this function needs a stack protector based 199 /// upon the stack protector level. 200 /// 201 /// We use two heuristics: a standard (ssp) and strong (sspstrong). 202 /// The standard heuristic which will add a guard variable to functions that 203 /// call alloca with a either a variable size or a size >= SSPBufferSize, 204 /// functions with character buffers larger than SSPBufferSize, and functions 205 /// with aggregates containing character buffers larger than SSPBufferSize. The 206 /// strong heuristic will add a guard variables to functions that call alloca 207 /// regardless of size, functions with any buffer regardless of type and size, 208 /// functions with aggregates that contain any buffer regardless of type and 209 /// size, and functions that contain stack-based variables that have had their 210 /// address taken. 211 bool StackProtector::RequiresStackProtector() { 212 bool Strong = false; 213 bool NeedsProtector = false; 214 for (const BasicBlock &BB : *F) 215 for (const Instruction &I : BB) 216 if (const CallInst *CI = dyn_cast<CallInst>(&I)) 217 if (CI->getCalledFunction() == 218 Intrinsic::getDeclaration(F->getParent(), 219 Intrinsic::stackprotector)) 220 HasPrologue = true; 221 222 if (F->hasFnAttribute(Attribute::SafeStack)) 223 return false; 224 225 if (F->hasFnAttribute(Attribute::StackProtectReq)) { 226 NeedsProtector = true; 227 Strong = true; // Use the same heuristic as strong to determine SSPLayout 228 } else if (F->hasFnAttribute(Attribute::StackProtectStrong)) 229 Strong = true; 230 else if (HasPrologue) 231 NeedsProtector = true; 232 else if (!F->hasFnAttribute(Attribute::StackProtect)) 233 return false; 234 235 for (const BasicBlock &BB : *F) { 236 for (const Instruction &I : BB) { 237 if (const AllocaInst *AI = dyn_cast<AllocaInst>(&I)) { 238 if (AI->isArrayAllocation()) { 239 // SSP-Strong: Enable protectors for any call to alloca, regardless 240 // of size. 241 if (Strong) 242 return true; 243 244 if (const auto *CI = dyn_cast<ConstantInt>(AI->getArraySize())) { 245 if (CI->getLimitedValue(SSPBufferSize) >= SSPBufferSize) { 246 // A call to alloca with size >= SSPBufferSize requires 247 // stack protectors. 248 Layout.insert(std::make_pair(AI, SSPLK_LargeArray)); 249 NeedsProtector = true; 250 } else if (Strong) { 251 // Require protectors for all alloca calls in strong mode. 252 Layout.insert(std::make_pair(AI, SSPLK_SmallArray)); 253 NeedsProtector = true; 254 } 255 } else { 256 // A call to alloca with a variable size requires protectors. 257 Layout.insert(std::make_pair(AI, SSPLK_LargeArray)); 258 NeedsProtector = true; 259 } 260 continue; 261 } 262 263 bool IsLarge = false; 264 if (ContainsProtectableArray(AI->getAllocatedType(), IsLarge, Strong)) { 265 Layout.insert(std::make_pair(AI, IsLarge ? SSPLK_LargeArray 266 : SSPLK_SmallArray)); 267 NeedsProtector = true; 268 continue; 269 } 270 271 if (Strong && HasAddressTaken(AI)) { 272 ++NumAddrTaken; 273 Layout.insert(std::make_pair(AI, SSPLK_AddrOf)); 274 NeedsProtector = true; 275 } 276 } 277 } 278 } 279 280 return NeedsProtector; 281 } 282 283 /// Create a stack guard loading and populate whether SelectionDAG SSP is 284 /// supported. 285 static Value *getStackGuard(const TargetLoweringBase *TLI, Module *M, 286 IRBuilder<> &B, 287 bool *SupportsSelectionDAGSP = nullptr) { 288 if (Value *Guard = TLI->getIRStackGuard(B)) 289 return B.CreateLoad(Guard, true, "StackGuard"); 290 291 // Use SelectionDAG SSP handling, since there isn't an IR guard. 292 // 293 // This is more or less weird, since we optionally output whether we 294 // should perform a SelectionDAG SP here. The reason is that it's strictly 295 // defined as !TLI->getIRStackGuard(B), where getIRStackGuard is also 296 // mutating. There is no way to get this bit without mutating the IR, so 297 // getting this bit has to happen in this right time. 298 // 299 // We could have define a new function TLI::supportsSelectionDAGSP(), but that 300 // will put more burden on the backends' overriding work, especially when it 301 // actually conveys the same information getIRStackGuard() already gives. 302 if (SupportsSelectionDAGSP) 303 *SupportsSelectionDAGSP = true; 304 TLI->insertSSPDeclarations(*M); 305 return B.CreateCall(Intrinsic::getDeclaration(M, Intrinsic::stackguard)); 306 } 307 308 /// Insert code into the entry block that stores the stack guard 309 /// variable onto the stack: 310 /// 311 /// entry: 312 /// StackGuardSlot = alloca i8* 313 /// StackGuard = <stack guard> 314 /// call void @llvm.stackprotector(StackGuard, StackGuardSlot) 315 /// 316 /// Returns true if the platform/triple supports the stackprotectorcreate pseudo 317 /// node. 318 static bool CreatePrologue(Function *F, Module *M, ReturnInst *RI, 319 const TargetLoweringBase *TLI, AllocaInst *&AI) { 320 bool SupportsSelectionDAGSP = false; 321 IRBuilder<> B(&F->getEntryBlock().front()); 322 PointerType *PtrTy = Type::getInt8PtrTy(RI->getContext()); 323 AI = B.CreateAlloca(PtrTy, nullptr, "StackGuardSlot"); 324 325 Value *GuardSlot = getStackGuard(TLI, M, B, &SupportsSelectionDAGSP); 326 B.CreateCall(Intrinsic::getDeclaration(M, Intrinsic::stackprotector), 327 {GuardSlot, AI}); 328 return SupportsSelectionDAGSP; 329 } 330 331 /// InsertStackProtectors - Insert code into the prologue and epilogue of the 332 /// function. 333 /// 334 /// - The prologue code loads and stores the stack guard onto the stack. 335 /// - The epilogue checks the value stored in the prologue against the original 336 /// value. It calls __stack_chk_fail if they differ. 337 bool StackProtector::InsertStackProtectors() { 338 bool SupportsSelectionDAGSP = 339 EnableSelectionDAGSP && !TM->Options.EnableFastISel; 340 AllocaInst *AI = nullptr; // Place on stack that stores the stack guard. 341 342 for (Function::iterator I = F->begin(), E = F->end(); I != E;) { 343 BasicBlock *BB = &*I++; 344 ReturnInst *RI = dyn_cast<ReturnInst>(BB->getTerminator()); 345 if (!RI) 346 continue; 347 348 // Generate prologue instrumentation if not already generated. 349 if (!HasPrologue) { 350 HasPrologue = true; 351 SupportsSelectionDAGSP &= CreatePrologue(F, M, RI, TLI, AI); 352 } 353 354 // SelectionDAG based code generation. Nothing else needs to be done here. 355 // The epilogue instrumentation is postponed to SelectionDAG. 356 if (SupportsSelectionDAGSP) 357 break; 358 359 // Set HasIRCheck to true, so that SelectionDAG will not generate its own 360 // version. SelectionDAG called 'shouldEmitSDCheck' to check whether 361 // instrumentation has already been generated. 362 HasIRCheck = true; 363 364 // Generate epilogue instrumentation. The epilogue intrumentation can be 365 // function-based or inlined depending on which mechanism the target is 366 // providing. 367 if (Value* GuardCheck = TLI->getSSPStackGuardCheck(*M)) { 368 // Generate the function-based epilogue instrumentation. 369 // The target provides a guard check function, generate a call to it. 370 IRBuilder<> B(RI); 371 LoadInst *Guard = B.CreateLoad(AI, true, "Guard"); 372 CallInst *Call = B.CreateCall(GuardCheck, {Guard}); 373 llvm::Function *Function = cast<llvm::Function>(GuardCheck); 374 Call->setAttributes(Function->getAttributes()); 375 Call->setCallingConv(Function->getCallingConv()); 376 } else { 377 // Generate the epilogue with inline instrumentation. 378 // If we do not support SelectionDAG based tail calls, generate IR level 379 // tail calls. 380 // 381 // For each block with a return instruction, convert this: 382 // 383 // return: 384 // ... 385 // ret ... 386 // 387 // into this: 388 // 389 // return: 390 // ... 391 // %1 = <stack guard> 392 // %2 = load StackGuardSlot 393 // %3 = cmp i1 %1, %2 394 // br i1 %3, label %SP_return, label %CallStackCheckFailBlk 395 // 396 // SP_return: 397 // ret ... 398 // 399 // CallStackCheckFailBlk: 400 // call void @__stack_chk_fail() 401 // unreachable 402 403 // Create the FailBB. We duplicate the BB every time since the MI tail 404 // merge pass will merge together all of the various BB into one including 405 // fail BB generated by the stack protector pseudo instruction. 406 BasicBlock *FailBB = CreateFailBB(); 407 408 // Split the basic block before the return instruction. 409 BasicBlock *NewBB = BB->splitBasicBlock(RI->getIterator(), "SP_return"); 410 411 // Update the dominator tree if we need to. 412 if (DT && DT->isReachableFromEntry(BB)) { 413 DT->addNewBlock(NewBB, BB); 414 DT->addNewBlock(FailBB, BB); 415 } 416 417 // Remove default branch instruction to the new BB. 418 BB->getTerminator()->eraseFromParent(); 419 420 // Move the newly created basic block to the point right after the old 421 // basic block so that it's in the "fall through" position. 422 NewBB->moveAfter(BB); 423 424 // Generate the stack protector instructions in the old basic block. 425 IRBuilder<> B(BB); 426 Value *Guard = getStackGuard(TLI, M, B); 427 LoadInst *LI2 = B.CreateLoad(AI, true); 428 Value *Cmp = B.CreateICmpEQ(Guard, LI2); 429 auto SuccessProb = 430 BranchProbabilityInfo::getBranchProbStackProtector(true); 431 auto FailureProb = 432 BranchProbabilityInfo::getBranchProbStackProtector(false); 433 MDNode *Weights = MDBuilder(F->getContext()) 434 .createBranchWeights(SuccessProb.getNumerator(), 435 FailureProb.getNumerator()); 436 B.CreateCondBr(Cmp, NewBB, FailBB, Weights); 437 } 438 } 439 440 // Return if we didn't modify any basic blocks. i.e., there are no return 441 // statements in the function. 442 return HasPrologue; 443 } 444 445 /// CreateFailBB - Create a basic block to jump to when the stack protector 446 /// check fails. 447 BasicBlock *StackProtector::CreateFailBB() { 448 LLVMContext &Context = F->getContext(); 449 BasicBlock *FailBB = BasicBlock::Create(Context, "CallStackCheckFailBlk", F); 450 IRBuilder<> B(FailBB); 451 B.SetCurrentDebugLocation(DebugLoc::get(0, 0, F->getSubprogram())); 452 if (Trip.isOSOpenBSD()) { 453 Constant *StackChkFail = 454 M->getOrInsertFunction("__stack_smash_handler", 455 Type::getVoidTy(Context), 456 Type::getInt8PtrTy(Context), nullptr); 457 458 B.CreateCall(StackChkFail, B.CreateGlobalStringPtr(F->getName(), "SSH")); 459 } else { 460 Constant *StackChkFail = 461 M->getOrInsertFunction("__stack_chk_fail", Type::getVoidTy(Context), 462 nullptr); 463 B.CreateCall(StackChkFail, {}); 464 } 465 B.CreateUnreachable(); 466 return FailBB; 467 } 468 469 bool StackProtector::shouldEmitSDCheck(const BasicBlock &BB) const { 470 return HasPrologue && !HasIRCheck && dyn_cast<ReturnInst>(BB.getTerminator()); 471 } 472