StackProtector.cpp revision 12c74dc2c2ee306f60fb39a9b2a43000e23addcc
1//===-- StackProtector.cpp - Stack Protector Insertion --------------------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This pass inserts stack protectors into functions which need them. A variable 11// with a random value in it is stored onto the stack before the local variables 12// are allocated. Upon exiting the block, the stored value is checked. If it's 13// changed, then there was some sort of violation and the program aborts. 14// 15//===----------------------------------------------------------------------===// 16 17#define DEBUG_TYPE "stack-protector" 18#include "llvm/CodeGen/Passes.h" 19#include "llvm/ADT/SmallPtrSet.h" 20#include "llvm/ADT/Statistic.h" 21#include "llvm/ADT/Triple.h" 22#include "llvm/Analysis/Dominators.h" 23#include "llvm/IR/Attributes.h" 24#include "llvm/IR/Constants.h" 25#include "llvm/IR/DataLayout.h" 26#include "llvm/IR/DerivedTypes.h" 27#include "llvm/IR/Function.h" 28#include "llvm/IR/GlobalValue.h" 29#include "llvm/IR/GlobalVariable.h" 30#include "llvm/IR/Instructions.h" 31#include "llvm/IR/Intrinsics.h" 32#include "llvm/IR/Module.h" 33#include "llvm/Pass.h" 34#include "llvm/Support/CommandLine.h" 35#include "llvm/Target/TargetLowering.h" 36using namespace llvm; 37 38STATISTIC(NumFunProtected, "Number of functions protected"); 39STATISTIC(NumAddrTaken, "Number of local variables that have their address" 40 " taken."); 41 42namespace { 43 class StackProtector : public FunctionPass { 44 const TargetMachine *TM; 45 46 /// TLI - Keep a pointer of a TargetLowering to consult for determining 47 /// target type sizes. 48 const TargetLoweringBase *TLI; 49 const Triple Trip; 50 51 Function *F; 52 Module *M; 53 54 DominatorTree *DT; 55 56 /// VisitedPHIs - The set of PHI nodes visited when determining 57 /// if a variable's reference has been taken. This set 58 /// is maintained to ensure we don't visit the same PHI node multiple 59 /// times. 60 SmallPtrSet<const PHINode*, 16> VisitedPHIs; 61 62 /// InsertStackProtectors - Insert code into the prologue and epilogue of 63 /// the function. 64 /// 65 /// - The prologue code loads and stores the stack guard onto the stack. 66 /// - The epilogue checks the value stored in the prologue against the 67 /// original value. It calls __stack_chk_fail if they differ. 68 bool InsertStackProtectors(); 69 70 /// CreateFailBB - Create a basic block to jump to when the stack protector 71 /// check fails. 72 BasicBlock *CreateFailBB(); 73 74 /// ContainsProtectableArray - Check whether the type either is an array or 75 /// contains an array of sufficient size so that we need stack protectors 76 /// for it. 77 bool ContainsProtectableArray(Type *Ty, bool Strong = false, 78 bool InStruct = false) const; 79 80 /// \brief Check whether a stack allocation has its address taken. 81 bool HasAddressTaken(const Instruction *AI); 82 83 /// RequiresStackProtector - Check whether or not this function needs a 84 /// stack protector based upon the stack protector level. 85 bool RequiresStackProtector(); 86 public: 87 static char ID; // Pass identification, replacement for typeid. 88 StackProtector() : FunctionPass(ID), TM(0), TLI(0) { 89 initializeStackProtectorPass(*PassRegistry::getPassRegistry()); 90 } 91 StackProtector(const TargetMachine *TM) 92 : FunctionPass(ID), TM(TM), TLI(0), Trip(TM->getTargetTriple()) { 93 initializeStackProtectorPass(*PassRegistry::getPassRegistry()); 94 } 95 96 virtual void getAnalysisUsage(AnalysisUsage &AU) const { 97 AU.addPreserved<DominatorTree>(); 98 } 99 100 virtual bool runOnFunction(Function &Fn); 101 }; 102} // end anonymous namespace 103 104char StackProtector::ID = 0; 105INITIALIZE_PASS(StackProtector, "stack-protector", 106 "Insert stack protectors", false, false) 107 108FunctionPass *llvm::createStackProtectorPass(const TargetMachine *TM) { 109 return new StackProtector(TM); 110} 111 112bool StackProtector::runOnFunction(Function &Fn) { 113 F = &Fn; 114 M = F->getParent(); 115 DT = getAnalysisIfAvailable<DominatorTree>(); 116 TLI = TM->getTargetLowering(); 117 118 if (!RequiresStackProtector()) return false; 119 120 ++NumFunProtected; 121 return InsertStackProtectors(); 122} 123 124/// ContainsProtectableArray - Check whether the type either is an array or 125/// contains a char array of sufficient size so that we need stack protectors 126/// for it. 127bool StackProtector::ContainsProtectableArray(Type *Ty, bool Strong, 128 bool InStruct) const { 129 if (!Ty) return false; 130 if (ArrayType *AT = dyn_cast<ArrayType>(Ty)) { 131 // In strong mode any array, regardless of type and size, triggers a 132 // protector 133 if (Strong) 134 return true; 135 const TargetMachine &TM = TLI->getTargetMachine(); 136 if (!AT->getElementType()->isIntegerTy(8)) { 137 // If we're on a non-Darwin platform or we're inside of a structure, don't 138 // add stack protectors unless the array is a character array. 139 if (InStruct || !Trip.isOSDarwin()) 140 return false; 141 } 142 143 // If an array has more than SSPBufferSize bytes of allocated space, then we 144 // emit stack protectors. 145 if (TM.Options.SSPBufferSize <= TLI->getDataLayout()->getTypeAllocSize(AT)) 146 return true; 147 } 148 149 const StructType *ST = dyn_cast<StructType>(Ty); 150 if (!ST) return false; 151 152 for (StructType::element_iterator I = ST->element_begin(), 153 E = ST->element_end(); I != E; ++I) 154 if (ContainsProtectableArray(*I, Strong, true)) 155 return true; 156 157 return false; 158} 159 160bool StackProtector::HasAddressTaken(const Instruction *AI) { 161 for (Value::const_use_iterator UI = AI->use_begin(), UE = AI->use_end(); 162 UI != UE; ++UI) { 163 const User *U = *UI; 164 if (const StoreInst *SI = dyn_cast<StoreInst>(U)) { 165 if (AI == SI->getValueOperand()) 166 return true; 167 } else if (const PtrToIntInst *SI = dyn_cast<PtrToIntInst>(U)) { 168 if (AI == SI->getOperand(0)) 169 return true; 170 } else if (isa<CallInst>(U)) { 171 return true; 172 } else if (isa<InvokeInst>(U)) { 173 return true; 174 } else if (const SelectInst *SI = dyn_cast<SelectInst>(U)) { 175 if (HasAddressTaken(SI)) 176 return true; 177 } else if (const PHINode *PN = dyn_cast<PHINode>(U)) { 178 // Keep track of what PHI nodes we have already visited to ensure 179 // they are only visited once. 180 if (VisitedPHIs.insert(PN)) 181 if (HasAddressTaken(PN)) 182 return true; 183 } else if (const GetElementPtrInst *GEP = dyn_cast<GetElementPtrInst>(U)) { 184 if (HasAddressTaken(GEP)) 185 return true; 186 } else if (const BitCastInst *BI = dyn_cast<BitCastInst>(U)) { 187 if (HasAddressTaken(BI)) 188 return true; 189 } 190 } 191 return false; 192} 193 194/// \brief Check whether or not this function needs a stack protector based 195/// upon the stack protector level. 196/// 197/// We use two heuristics: a standard (ssp) and strong (sspstrong). 198/// The standard heuristic which will add a guard variable to functions that 199/// call alloca with a either a variable size or a size >= SSPBufferSize, 200/// functions with character buffers larger than SSPBufferSize, and functions 201/// with aggregates containing character buffers larger than SSPBufferSize. The 202/// strong heuristic will add a guard variables to functions that call alloca 203/// regardless of size, functions with any buffer regardless of type and size, 204/// functions with aggregates that contain any buffer regardless of type and 205/// size, and functions that contain stack-based variables that have had their 206/// address taken. 207bool StackProtector::RequiresStackProtector() { 208 bool Strong = false; 209 if (F->getAttributes().hasAttribute(AttributeSet::FunctionIndex, 210 Attribute::StackProtectReq)) 211 return true; 212 else if (F->getAttributes().hasAttribute(AttributeSet::FunctionIndex, 213 Attribute::StackProtectStrong)) 214 Strong = true; 215 else if (!F->getAttributes().hasAttribute(AttributeSet::FunctionIndex, 216 Attribute::StackProtect)) 217 return false; 218 219 for (Function::iterator I = F->begin(), E = F->end(); I != E; ++I) { 220 BasicBlock *BB = I; 221 222 for (BasicBlock::iterator 223 II = BB->begin(), IE = BB->end(); II != IE; ++II) { 224 if (AllocaInst *AI = dyn_cast<AllocaInst>(II)) { 225 if (AI->isArrayAllocation()) { 226 // SSP-Strong: Enable protectors for any call to alloca, regardless 227 // of size. 228 if (Strong) 229 return true; 230 231 if (const ConstantInt *CI = 232 dyn_cast<ConstantInt>(AI->getArraySize())) { 233 unsigned BufferSize = TLI->getTargetMachine().Options.SSPBufferSize; 234 if (CI->getLimitedValue(BufferSize) >= BufferSize) 235 // A call to alloca with size >= SSPBufferSize requires 236 // stack protectors. 237 return true; 238 } else // A call to alloca with a variable size requires protectors. 239 return true; 240 } 241 242 if (ContainsProtectableArray(AI->getAllocatedType(), Strong)) 243 return true; 244 245 if (Strong && HasAddressTaken(AI)) { 246 ++NumAddrTaken; 247 return true; 248 } 249 } 250 } 251 } 252 253 return false; 254} 255 256/// InsertStackProtectors - Insert code into the prologue and epilogue of the 257/// function. 258/// 259/// - The prologue code loads and stores the stack guard onto the stack. 260/// - The epilogue checks the value stored in the prologue against the original 261/// value. It calls __stack_chk_fail if they differ. 262bool StackProtector::InsertStackProtectors() { 263 BasicBlock *FailBB = 0; // The basic block to jump to if check fails. 264 BasicBlock *FailBBDom = 0; // FailBB's dominator. 265 AllocaInst *AI = 0; // Place on stack that stores the stack guard. 266 Value *StackGuardVar = 0; // The stack guard variable. 267 268 for (Function::iterator I = F->begin(), E = F->end(); I != E; ) { 269 BasicBlock *BB = I++; 270 ReturnInst *RI = dyn_cast<ReturnInst>(BB->getTerminator()); 271 if (!RI) continue; 272 273 if (!FailBB) { 274 // Insert code into the entry block that stores the __stack_chk_guard 275 // variable onto the stack: 276 // 277 // entry: 278 // StackGuardSlot = alloca i8* 279 // StackGuard = load __stack_chk_guard 280 // call void @llvm.stackprotect.create(StackGuard, StackGuardSlot) 281 // 282 PointerType *PtrTy = Type::getInt8PtrTy(RI->getContext()); 283 unsigned AddressSpace, Offset; 284 if (TLI->getStackCookieLocation(AddressSpace, Offset)) { 285 Constant *OffsetVal = 286 ConstantInt::get(Type::getInt32Ty(RI->getContext()), Offset); 287 288 StackGuardVar = ConstantExpr::getIntToPtr(OffsetVal, 289 PointerType::get(PtrTy, AddressSpace)); 290 } else if (Trip.getOS() == llvm::Triple::OpenBSD) { 291 StackGuardVar = M->getOrInsertGlobal("__guard_local", PtrTy); 292 cast<GlobalValue>(StackGuardVar) 293 ->setVisibility(GlobalValue::HiddenVisibility); 294 } else { 295 StackGuardVar = M->getOrInsertGlobal("__stack_chk_guard", PtrTy); 296 } 297 298 BasicBlock &Entry = F->getEntryBlock(); 299 Instruction *InsPt = &Entry.front(); 300 301 AI = new AllocaInst(PtrTy, "StackGuardSlot", InsPt); 302 LoadInst *LI = new LoadInst(StackGuardVar, "StackGuard", false, InsPt); 303 304 Value *Args[] = { LI, AI }; 305 CallInst:: 306 Create(Intrinsic::getDeclaration(M, Intrinsic::stackprotector), 307 Args, "", InsPt); 308 309 // Create the basic block to jump to when the guard check fails. 310 FailBB = CreateFailBB(); 311 } 312 313 // For each block with a return instruction, convert this: 314 // 315 // return: 316 // ... 317 // ret ... 318 // 319 // into this: 320 // 321 // return: 322 // ... 323 // %1 = load __stack_chk_guard 324 // %2 = load StackGuardSlot 325 // %3 = cmp i1 %1, %2 326 // br i1 %3, label %SP_return, label %CallStackCheckFailBlk 327 // 328 // SP_return: 329 // ret ... 330 // 331 // CallStackCheckFailBlk: 332 // call void @__stack_chk_fail() 333 // unreachable 334 335 // Split the basic block before the return instruction. 336 BasicBlock *NewBB = BB->splitBasicBlock(RI, "SP_return"); 337 338 if (DT && DT->isReachableFromEntry(BB)) { 339 DT->addNewBlock(NewBB, BB); 340 FailBBDom = FailBBDom ? DT->findNearestCommonDominator(FailBBDom, BB) :BB; 341 } 342 343 // Remove default branch instruction to the new BB. 344 BB->getTerminator()->eraseFromParent(); 345 346 // Move the newly created basic block to the point right after the old basic 347 // block so that it's in the "fall through" position. 348 NewBB->moveAfter(BB); 349 350 // Generate the stack protector instructions in the old basic block. 351 LoadInst *LI1 = new LoadInst(StackGuardVar, "", false, BB); 352 LoadInst *LI2 = new LoadInst(AI, "", true, BB); 353 ICmpInst *Cmp = new ICmpInst(*BB, CmpInst::ICMP_EQ, LI1, LI2, ""); 354 BranchInst::Create(NewBB, FailBB, Cmp, BB); 355 } 356 357 // Return if we didn't modify any basic blocks. I.e., there are no return 358 // statements in the function. 359 if (!FailBB) return false; 360 361 if (DT && FailBBDom) 362 DT->addNewBlock(FailBB, FailBBDom); 363 364 return true; 365} 366 367/// CreateFailBB - Create a basic block to jump to when the stack protector 368/// check fails. 369BasicBlock *StackProtector::CreateFailBB() { 370 LLVMContext &Context = F->getContext(); 371 BasicBlock *FailBB = BasicBlock::Create(Context, "CallStackCheckFailBlk", F); 372 if (Trip.getOS() == llvm::Triple::OpenBSD) { 373 Constant *StackChkFail = M->getOrInsertFunction( 374 "__stack_smash_handler", Type::getVoidTy(Context), 375 Type::getInt8PtrTy(Context), NULL); 376 377 Constant *NameStr = ConstantDataArray::getString(Context, F->getName()); 378 Constant *FuncName = 379 new GlobalVariable(*M, NameStr->getType(), true, 380 GlobalVariable::PrivateLinkage, NameStr, "SSH"); 381 382 SmallVector<Constant *, 2> IdxList; 383 IdxList.push_back(ConstantInt::get(Type::getInt8Ty(Context), 0)); 384 IdxList.push_back(ConstantInt::get(Type::getInt8Ty(Context), 0)); 385 386 SmallVector<Value *, 1> Args; 387 Args.push_back(ConstantExpr::getGetElementPtr(FuncName, IdxList)); 388 389 CallInst::Create(StackChkFail, Args, "", FailBB); 390 } else { 391 Constant *StackChkFail = M->getOrInsertFunction( 392 "__stack_chk_fail", Type::getVoidTy(Context), NULL); 393 CallInst::Create(StackChkFail, "", FailBB); 394 } 395 new UnreachableInst(Context, FailBB); 396 return FailBB; 397} 398