StackProtector.cpp revision 23d66a58b7900784a5808d24ce2d4a449f869aa8
1cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)//===-- StackProtector.cpp - Stack Protector Insertion --------------------===// 2cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// 3cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// The LLVM Compiler Infrastructure 4cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// 5cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// This file is distributed under the University of Illinois Open Source 6cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// License. See LICENSE.TXT for details. 7cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// 8cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)//===----------------------------------------------------------------------===// 9cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// 10cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// This pass inserts stack protectors into functions which need them. A variable 11cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// with a random value in it is stored onto the stack before the local variables 12cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// are allocated. Upon exiting the block, the stored value is checked. If it's 13cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// changed, then there was some sort of violation and the program aborts. 14cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// 15cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)//===----------------------------------------------------------------------===// 16cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) 17cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)#define DEBUG_TYPE "stack-protector" 18cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)#include "llvm/CodeGen/Passes.h" 19cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)#include "llvm/Analysis/Dominators.h" 20cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)#include "llvm/Attributes.h" 21cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)#include "llvm/Constants.h" 22#include "llvm/DerivedTypes.h" 23#include "llvm/Function.h" 24#include "llvm/Instructions.h" 25#include "llvm/Intrinsics.h" 26#include "llvm/Module.h" 27#include "llvm/Pass.h" 28#include "llvm/Support/CommandLine.h" 29#include "llvm/Target/TargetData.h" 30#include "llvm/Target/TargetLowering.h" 31using namespace llvm; 32 33// SSPBufferSize - The lower bound for a buffer to be considered for stack 34// smashing protection. 35static cl::opt<unsigned> 36SSPBufferSize("stack-protector-buffer-size", cl::init(8), 37 cl::desc("Lower bound for a buffer to be considered for " 38 "stack protection")); 39 40namespace { 41 class StackProtector : public FunctionPass { 42 /// TLI - Keep a pointer of a TargetLowering to consult for determining 43 /// target type sizes. 44 const TargetLowering *TLI; 45 46 Function *F; 47 Module *M; 48 49 DominatorTree* DT; 50 51 /// InsertStackProtectors - Insert code into the prologue and epilogue of 52 /// the function. 53 /// 54 /// - The prologue code loads and stores the stack guard onto the stack. 55 /// - The epilogue checks the value stored in the prologue against the 56 /// original value. It calls __stack_chk_fail if they differ. 57 bool InsertStackProtectors(); 58 59 /// CreateFailBB - Create a basic block to jump to when the stack protector 60 /// check fails. 61 BasicBlock *CreateFailBB(); 62 63 /// RequiresStackProtector - Check whether or not this function needs a 64 /// stack protector based upon the stack protector level. 65 bool RequiresStackProtector() const; 66 public: 67 static char ID; // Pass identification, replacement for typeid. 68 StackProtector() : FunctionPass(ID), TLI(0) { 69 initializeStackProtectorPass(*PassRegistry::getPassRegistry()); 70 } 71 StackProtector(const TargetLowering *tli) 72 : FunctionPass(ID), TLI(tli) { 73 initializeStackProtectorPass(*PassRegistry::getPassRegistry()); 74 } 75 76 virtual void getAnalysisUsage(AnalysisUsage &AU) const { 77 AU.addPreserved<DominatorTree>(); 78 } 79 80 virtual bool runOnFunction(Function &Fn); 81 }; 82} // end anonymous namespace 83 84char StackProtector::ID = 0; 85INITIALIZE_PASS(StackProtector, "stack-protector", 86 "Insert stack protectors", false, false) 87 88FunctionPass *llvm::createStackProtectorPass(const TargetLowering *tli) { 89 return new StackProtector(tli); 90} 91 92bool StackProtector::runOnFunction(Function &Fn) { 93 F = &Fn; 94 M = F->getParent(); 95 DT = getAnalysisIfAvailable<DominatorTree>(); 96 97 if (!RequiresStackProtector()) return false; 98 99 return InsertStackProtectors(); 100} 101 102/// RequiresStackProtector - Check whether or not this function needs a stack 103/// protector based upon the stack protector level. The heuristic we use is to 104/// add a guard variable to functions that call alloca, and functions with 105/// buffers larger than SSPBufferSize bytes. 106bool StackProtector::RequiresStackProtector() const { 107 if (F->hasFnAttr(Attribute::StackProtectReq)) 108 return true; 109 110 if (!F->hasFnAttr(Attribute::StackProtect)) 111 return false; 112 113 const TargetData *TD = TLI->getTargetData(); 114 115 for (Function::iterator I = F->begin(), E = F->end(); I != E; ++I) { 116 BasicBlock *BB = I; 117 118 for (BasicBlock::iterator 119 II = BB->begin(), IE = BB->end(); II != IE; ++II) 120 if (AllocaInst *AI = dyn_cast<AllocaInst>(II)) { 121 if (AI->isArrayAllocation()) 122 // This is a call to alloca with a variable size. Emit stack 123 // protectors. 124 return true; 125 126 if (ArrayType *AT = dyn_cast<ArrayType>(AI->getAllocatedType())) 127 // If an array has more than SSPBufferSize bytes of allocated space, 128 // then we emit stack protectors. 129 if (SSPBufferSize <= TD->getTypeAllocSize(AT)) 130 return true; 131 } 132 } 133 134 return false; 135} 136 137/// InsertStackProtectors - Insert code into the prologue and epilogue of the 138/// function. 139/// 140/// - The prologue code loads and stores the stack guard onto the stack. 141/// - The epilogue checks the value stored in the prologue against the original 142/// value. It calls __stack_chk_fail if they differ. 143bool StackProtector::InsertStackProtectors() { 144 BasicBlock *FailBB = 0; // The basic block to jump to if check fails. 145 BasicBlock *FailBBDom = 0; // FailBB's dominator. 146 AllocaInst *AI = 0; // Place on stack that stores the stack guard. 147 Value *StackGuardVar = 0; // The stack guard variable. 148 149 for (Function::iterator I = F->begin(), E = F->end(); I != E; ) { 150 BasicBlock *BB = I++; 151 ReturnInst *RI = dyn_cast<ReturnInst>(BB->getTerminator()); 152 if (!RI) continue; 153 154 if (!FailBB) { 155 // Insert code into the entry block that stores the __stack_chk_guard 156 // variable onto the stack: 157 // 158 // entry: 159 // StackGuardSlot = alloca i8* 160 // StackGuard = load __stack_chk_guard 161 // call void @llvm.stackprotect.create(StackGuard, StackGuardSlot) 162 // 163 PointerType *PtrTy = Type::getInt8PtrTy(RI->getContext()); 164 unsigned AddressSpace, Offset; 165 if (TLI->getStackCookieLocation(AddressSpace, Offset)) { 166 Constant *OffsetVal = 167 ConstantInt::get(Type::getInt32Ty(RI->getContext()), Offset); 168 169 StackGuardVar = ConstantExpr::getIntToPtr(OffsetVal, 170 PointerType::get(PtrTy, AddressSpace)); 171 } else { 172 StackGuardVar = M->getOrInsertGlobal("__stack_chk_guard", PtrTy); 173 } 174 175 BasicBlock &Entry = F->getEntryBlock(); 176 Instruction *InsPt = &Entry.front(); 177 178 AI = new AllocaInst(PtrTy, "StackGuardSlot", InsPt); 179 LoadInst *LI = new LoadInst(StackGuardVar, "StackGuard", false, InsPt); 180 181 Value *Args[] = { LI, AI }; 182 CallInst:: 183 Create(Intrinsic::getDeclaration(M, Intrinsic::stackprotector), 184 Args, "", InsPt); 185 186 // Create the basic block to jump to when the guard check fails. 187 FailBB = CreateFailBB(); 188 } 189 190 // For each block with a return instruction, convert this: 191 // 192 // return: 193 // ... 194 // ret ... 195 // 196 // into this: 197 // 198 // return: 199 // ... 200 // %1 = load __stack_chk_guard 201 // %2 = load StackGuardSlot 202 // %3 = cmp i1 %1, %2 203 // br i1 %3, label %SP_return, label %CallStackCheckFailBlk 204 // 205 // SP_return: 206 // ret ... 207 // 208 // CallStackCheckFailBlk: 209 // call void @__stack_chk_fail() 210 // unreachable 211 212 // Split the basic block before the return instruction. 213 BasicBlock *NewBB = BB->splitBasicBlock(RI, "SP_return"); 214 215 if (DT && DT->isReachableFromEntry(BB)) { 216 DT->addNewBlock(NewBB, BB); 217 FailBBDom = FailBBDom ? DT->findNearestCommonDominator(FailBBDom, BB) :BB; 218 } 219 220 // Remove default branch instruction to the new BB. 221 BB->getTerminator()->eraseFromParent(); 222 223 // Move the newly created basic block to the point right after the old basic 224 // block so that it's in the "fall through" position. 225 NewBB->moveAfter(BB); 226 227 // Generate the stack protector instructions in the old basic block. 228 LoadInst *LI1 = new LoadInst(StackGuardVar, "", false, BB); 229 LoadInst *LI2 = new LoadInst(AI, "", true, BB); 230 ICmpInst *Cmp = new ICmpInst(*BB, CmpInst::ICMP_EQ, LI1, LI2, ""); 231 BranchInst::Create(NewBB, FailBB, Cmp, BB); 232 } 233 234 // Return if we didn't modify any basic blocks. I.e., there are no return 235 // statements in the function. 236 if (!FailBB) return false; 237 238 if (DT && FailBBDom) 239 DT->addNewBlock(FailBB, FailBBDom); 240 241 return true; 242} 243 244/// CreateFailBB - Create a basic block to jump to when the stack protector 245/// check fails. 246BasicBlock *StackProtector::CreateFailBB() { 247 BasicBlock *FailBB = BasicBlock::Create(F->getContext(), 248 "CallStackCheckFailBlk", F); 249 Constant *StackChkFail = 250 M->getOrInsertFunction("__stack_chk_fail", 251 Type::getVoidTy(F->getContext()), NULL); 252 CallInst::Create(StackChkFail, "", FailBB); 253 new UnreachableInst(F->getContext(), FailBB); 254 return FailBB; 255} 256