StackProtector.cpp revision a67eda76c0224ec272e2cc7cf919f4e6e213e275
19682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall//===-- StackProtector.cpp - Stack Protector Insertion --------------------===// 29682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall// 39682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall// The LLVM Compiler Infrastructure 49682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall// 59682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall// This file is distributed under the University of Illinois Open Source 69682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall// License. See LICENSE.TXT for details. 79682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall// 89682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall//===----------------------------------------------------------------------===// 99682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall// 109682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall// This pass inserts stack protectors into functions which need them. A variable 119682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall// with a random value in it is stored onto the stack before the local variables 129682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall// are allocated. Upon exiting the block, the stored value is checked. If it's 139682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall// changed, then there was some sort of violation and the program aborts. 149682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall// 159682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall//===----------------------------------------------------------------------===// 169682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 179682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall#define DEBUG_TYPE "stack-protector" 189682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall#include "llvm/CodeGen/Passes.h" 199682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall#include "llvm/Analysis/Dominators.h" 209682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall#include "llvm/Attributes.h" 219682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall#include "llvm/Constants.h" 229682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall#include "llvm/DerivedTypes.h" 239682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall#include "llvm/Function.h" 249682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall#include "llvm/Instructions.h" 259682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall#include "llvm/Intrinsics.h" 269682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall#include "llvm/Module.h" 279682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall#include "llvm/Pass.h" 289682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall#include "llvm/Support/CommandLine.h" 299682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall#include "llvm/Target/TargetData.h" 309682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall#include "llvm/Target/TargetLowering.h" 319682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall#include "llvm/ADT/Triple.h" 329682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hallusing namespace llvm; 339682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 349682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall// SSPBufferSize - The lower bound for a buffer to be considered for stack 359682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall// smashing protection. 369682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hallstatic cl::opt<unsigned> 379682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse HallSSPBufferSize("stack-protector-buffer-size", cl::init(8), 389682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall cl::desc("Lower bound for a buffer to be considered for " 399682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall "stack protection")); 409682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 419682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hallnamespace { 429682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall class StackProtector : public FunctionPass { 439682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall /// TLI - Keep a pointer of a TargetLowering to consult for determining 449682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall /// target type sizes. 459682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall const TargetLowering *TLI; 469682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 479682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall Function *F; 489682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall Module *M; 499682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 509682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall DominatorTree *DT; 519682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 529682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall /// InsertStackProtectors - Insert code into the prologue and epilogue of 539682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall /// the function. 549682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall /// 559682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall /// - The prologue code loads and stores the stack guard onto the stack. 569682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall /// - The epilogue checks the value stored in the prologue against the 579682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall /// original value. It calls __stack_chk_fail if they differ. 589682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall bool InsertStackProtectors(); 599682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 609682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall /// CreateFailBB - Create a basic block to jump to when the stack protector 619682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall /// check fails. 629682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall BasicBlock *CreateFailBB(); 639682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 649682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall /// ContainsProtectableArray - Check whether the type either is an array or 659682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall /// contains an array of sufficient size so that we need stack protectors 669682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall /// for it. 679682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall bool ContainsProtectableArray(Type *Ty, bool InStruct = false) const; 689682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 699682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall /// RequiresStackProtector - Check whether or not this function needs a 709682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall /// stack protector based upon the stack protector level. 719682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall bool RequiresStackProtector() const; 729682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall public: 739682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall static char ID; // Pass identification, replacement for typeid. 749682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall StackProtector() : FunctionPass(ID), TLI(0) { 759682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall initializeStackProtectorPass(*PassRegistry::getPassRegistry()); 769682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall } 779682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall StackProtector(const TargetLowering *tli) 789682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall : FunctionPass(ID), TLI(tli) { 799682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall initializeStackProtectorPass(*PassRegistry::getPassRegistry()); 809682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall } 819682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 829682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall virtual void getAnalysisUsage(AnalysisUsage &AU) const { 839682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall AU.addPreserved<DominatorTree>(); 849682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall } 859682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 869682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall virtual bool runOnFunction(Function &Fn); 879682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall }; 889682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall} // end anonymous namespace 899682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 909682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hallchar StackProtector::ID = 0; 919682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse HallINITIALIZE_PASS(StackProtector, "stack-protector", 929682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall "Insert stack protectors", false, false) 939682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 949682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse HallFunctionPass *llvm::createStackProtectorPass(const TargetLowering *tli) { 959682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall return new StackProtector(tli); 969682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall} 979682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 989682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hallbool StackProtector::runOnFunction(Function &Fn) { 999682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall F = &Fn; 1009682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall M = F->getParent(); 1019682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall DT = getAnalysisIfAvailable<DominatorTree>(); 1029682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 1039682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall if (!RequiresStackProtector()) return false; 1049682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 1059682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall return InsertStackProtectors(); 1069682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall} 1079682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 1089682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall/// ContainsProtectableArray - Check whether the type either is an array or 1099682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall/// contains a char array of sufficient size so that we need stack protectors 1109682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall/// for it. 1119682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hallbool StackProtector::ContainsProtectableArray(Type *Ty, bool InStruct) const { 1129682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall if (!Ty) return false; 1139682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall if (ArrayType *AT = dyn_cast<ArrayType>(Ty)) { 1149682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall if (!AT->getElementType()->isIntegerTy(8)) { 1159682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall const TargetMachine &TM = TLI->getTargetMachine(); 1169682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall Triple Trip(TM.getTargetTriple()); 1179682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 1189682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // If we're on a non-Darwin platform or we're inside of a structure, don't 1199682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // add stack protectors unless the array is a character array. 1209682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall if (InStruct || !Trip.isOSDarwin()) 1219682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall return false; 1229682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall } 1239682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 1249682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // If an array has more than SSPBufferSize bytes of allocated space, then we 1259682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // emit stack protectors. 1269682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall if (SSPBufferSize <= TLI->getTargetData()->getTypeAllocSize(AT)) 1279682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall return true; 1289682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall } 1299682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 1309682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall const StructType *ST = dyn_cast<StructType>(Ty); 1319682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall if (!ST) return false; 1329682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 1339682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall for (StructType::element_iterator I = ST->element_begin(), 1349682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall E = ST->element_end(); I != E; ++I) 1359682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall if (ContainsProtectableArray(*I, true)) 1369682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall return true; 1379682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 1389682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall return false; 1399682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall} 1409682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 1419682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall/// RequiresStackProtector - Check whether or not this function needs a stack 1429682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall/// protector based upon the stack protector level. The heuristic we use is to 1439682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall/// add a guard variable to functions that call alloca, and functions with 1449682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall/// buffers larger than SSPBufferSize bytes. 1459682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hallbool StackProtector::RequiresStackProtector() const { 1469682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall if (F->hasFnAttr(Attribute::StackProtectReq)) 1479682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall return true; 1489682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 1499682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall if (!F->hasFnAttr(Attribute::StackProtect)) 1509682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall return false; 1519682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 1529682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall for (Function::iterator I = F->begin(), E = F->end(); I != E; ++I) { 1539682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall BasicBlock *BB = I; 1549682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 1559682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall for (BasicBlock::iterator 1569682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall II = BB->begin(), IE = BB->end(); II != IE; ++II) 1579682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall if (AllocaInst *AI = dyn_cast<AllocaInst>(II)) { 1589682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall if (AI->isArrayAllocation()) 1599682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // This is a call to alloca with a variable size. Emit stack 1609682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // protectors. 1619682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall return true; 1629682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 1639682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall if (ContainsProtectableArray(AI->getAllocatedType())) 1649682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall return true; 1659682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall } 1669682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall } 1679682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 1689682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall return false; 1699682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall} 1709682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 1719682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall/// InsertStackProtectors - Insert code into the prologue and epilogue of the 1729682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall/// function. 1739682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall/// 1749682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall/// - The prologue code loads and stores the stack guard onto the stack. 1759682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall/// - The epilogue checks the value stored in the prologue against the original 1769682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall/// value. It calls __stack_chk_fail if they differ. 1779682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hallbool StackProtector::InsertStackProtectors() { 1789682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall BasicBlock *FailBB = 0; // The basic block to jump to if check fails. 1799682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall BasicBlock *FailBBDom = 0; // FailBB's dominator. 1809682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall AllocaInst *AI = 0; // Place on stack that stores the stack guard. 1819682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall Value *StackGuardVar = 0; // The stack guard variable. 1829682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 1839682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall for (Function::iterator I = F->begin(), E = F->end(); I != E; ) { 1849682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall BasicBlock *BB = I++; 1859682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall ReturnInst *RI = dyn_cast<ReturnInst>(BB->getTerminator()); 1869682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall if (!RI) continue; 1879682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 1889682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall if (!FailBB) { 1899682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // Insert code into the entry block that stores the __stack_chk_guard 1909682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // variable onto the stack: 1919682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // 1929682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // entry: 1939682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // StackGuardSlot = alloca i8* 1949682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // StackGuard = load __stack_chk_guard 1959682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // call void @llvm.stackprotect.create(StackGuard, StackGuardSlot) 1969682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // 1979682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall PointerType *PtrTy = Type::getInt8PtrTy(RI->getContext()); 1989682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall unsigned AddressSpace, Offset; 1999682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall if (TLI->getStackCookieLocation(AddressSpace, Offset)) { 2009682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall Constant *OffsetVal = 2019682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall ConstantInt::get(Type::getInt32Ty(RI->getContext()), Offset); 2029682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 2039682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall StackGuardVar = ConstantExpr::getIntToPtr(OffsetVal, 2049682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall PointerType::get(PtrTy, AddressSpace)); 2059682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall } else { 2069682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall StackGuardVar = M->getOrInsertGlobal("__stack_chk_guard", PtrTy); 2079682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall } 2089682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 2099682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall BasicBlock &Entry = F->getEntryBlock(); 2109682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall Instruction *InsPt = &Entry.front(); 2119682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 2129682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall AI = new AllocaInst(PtrTy, "StackGuardSlot", InsPt); 2139682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall LoadInst *LI = new LoadInst(StackGuardVar, "StackGuard", false, InsPt); 2149682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 2159682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall Value *Args[] = { LI, AI }; 2169682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall CallInst:: 2179682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall Create(Intrinsic::getDeclaration(M, Intrinsic::stackprotector), 2189682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall Args, "", InsPt); 2199682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 2209682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // Create the basic block to jump to when the guard check fails. 2219682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall FailBB = CreateFailBB(); 2229682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall } 2239682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 2249682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // For each block with a return instruction, convert this: 2259682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // 2269682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // return: 2279682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // ... 2289682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // ret ... 2299682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // 2309682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // into this: 2319682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // 2329682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // return: 2339682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // ... 2349682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // %1 = load __stack_chk_guard 2359682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // %2 = load StackGuardSlot 2369682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // %3 = cmp i1 %1, %2 2379682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // br i1 %3, label %SP_return, label %CallStackCheckFailBlk 2389682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // 2399682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // SP_return: 2409682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // ret ... 2419682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // 2429682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // CallStackCheckFailBlk: 2439682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // call void @__stack_chk_fail() 2449682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // unreachable 2459682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 2469682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // Split the basic block before the return instruction. 2479682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall BasicBlock *NewBB = BB->splitBasicBlock(RI, "SP_return"); 2489682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 2499682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall if (DT && DT->isReachableFromEntry(BB)) { 2509682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall DT->addNewBlock(NewBB, BB); 2519682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall FailBBDom = FailBBDom ? DT->findNearestCommonDominator(FailBBDom, BB) :BB; 2529682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall } 2539682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 2549682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // Remove default branch instruction to the new BB. 2559682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall BB->getTerminator()->eraseFromParent(); 2569682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 2579682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // Move the newly created basic block to the point right after the old basic 2589682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // block so that it's in the "fall through" position. 2599682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall NewBB->moveAfter(BB); 2609682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 2619682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // Generate the stack protector instructions in the old basic block. 2629682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall LoadInst *LI1 = new LoadInst(StackGuardVar, "", false, BB); 2639682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall LoadInst *LI2 = new LoadInst(AI, "", true, BB); 2649682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall ICmpInst *Cmp = new ICmpInst(*BB, CmpInst::ICMP_EQ, LI1, LI2, ""); 2659682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall BranchInst::Create(NewBB, FailBB, Cmp, BB); 2669682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall } 2679682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 2689682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // Return if we didn't modify any basic blocks. I.e., there are no return 2699682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall // statements in the function. 2709682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall if (!FailBB) return false; 2719682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 2729682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall if (DT && FailBBDom) 2739682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall DT->addNewBlock(FailBB, FailBBDom); 2749682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 2759682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall return true; 2769682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall} 2779682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall 2789682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall/// CreateFailBB - Create a basic block to jump to when the stack protector 2799682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall/// check fails. 2809682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse HallBasicBlock *StackProtector::CreateFailBB() { 2819682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall BasicBlock *FailBB = BasicBlock::Create(F->getContext(), 2829682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall "CallStackCheckFailBlk", F); 2839682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall Constant *StackChkFail = 2849682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall M->getOrInsertFunction("__stack_chk_fail", 2859682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall Type::getVoidTy(F->getContext()), NULL); 2869682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall CallInst::Create(StackChkFail, "", FailBB); 2879682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall new UnreachableInst(F->getContext(), FailBB); 2889682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall return FailBB; 2899682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall} 2909682c8870b8ff5e4ac2e4c70b759f791c6f38c1fJesse Hall