1//===-- safestack.cc ------------------------------------------------------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file implements the runtime support for the safe stack protection 11// mechanism. The runtime manages allocation/deallocation of the unsafe stack 12// for the main thread, as well as all pthreads that are created/destroyed 13// during program execution. 14// 15//===----------------------------------------------------------------------===// 16 17#include <limits.h> 18#include <pthread.h> 19#include <stddef.h> 20#include <stdint.h> 21#include <unistd.h> 22#include <sys/resource.h> 23#include <sys/types.h> 24#include <sys/user.h> 25 26#include "interception/interception.h" 27#include "sanitizer_common/sanitizer_common.h" 28 29// TODO: The runtime library does not currently protect the safe stack beyond 30// relying on the system-enforced ASLR. The protection of the (safe) stack can 31// be provided by three alternative features: 32// 33// 1) Protection via hardware segmentation on x86-32 and some x86-64 34// architectures: the (safe) stack segment (implicitly accessed via the %ss 35// segment register) can be separated from the data segment (implicitly 36// accessed via the %ds segment register). Dereferencing a pointer to the safe 37// segment would result in a segmentation fault. 38// 39// 2) Protection via software fault isolation: memory writes that are not meant 40// to access the safe stack can be prevented from doing so through runtime 41// instrumentation. One way to do it is to allocate the safe stack(s) in the 42// upper half of the userspace and bitmask the corresponding upper bit of the 43// memory addresses of memory writes that are not meant to access the safe 44// stack. 45// 46// 3) Protection via information hiding on 64 bit architectures: the location 47// of the safe stack(s) can be randomized through secure mechanisms, and the 48// leakage of the stack pointer can be prevented. Currently, libc can leak the 49// stack pointer in several ways (e.g. in longjmp, signal handling, user-level 50// context switching related functions, etc.). These can be fixed in libc and 51// in other low-level libraries, by either eliminating the escaping/dumping of 52// the stack pointer (i.e., %rsp) when that's possible, or by using 53// encryption/PTR_MANGLE (XOR-ing the dumped stack pointer with another secret 54// we control and protect better, as is already done for setjmp in glibc.) 55// Furthermore, a static machine code level verifier can be ran after code 56// generation to make sure that the stack pointer is never written to memory, 57// or if it is, its written on the safe stack. 58// 59// Finally, while the Unsafe Stack pointer is currently stored in a thread 60// local variable, with libc support it could be stored in the TCB (thread 61// control block) as well, eliminating another level of indirection and making 62// such accesses faster. Alternatively, dedicating a separate register for 63// storing it would also be possible. 64 65/// Minimum stack alignment for the unsafe stack. 66const unsigned kStackAlign = 16; 67 68/// Default size of the unsafe stack. This value is only used if the stack 69/// size rlimit is set to infinity. 70const unsigned kDefaultUnsafeStackSize = 0x2800000; 71 72/// Runtime page size obtained through sysconf 73static unsigned pageSize; 74 75// TODO: To make accessing the unsafe stack pointer faster, we plan to 76// eventually store it directly in the thread control block data structure on 77// platforms where this structure is pointed to by %fs or %gs. This is exactly 78// the same mechanism as currently being used by the traditional stack 79// protector pass to store the stack guard (see getStackCookieLocation() 80// function above). Doing so requires changing the tcbhead_t struct in glibc 81// on Linux and tcb struct in libc on FreeBSD. 82// 83// For now, store it in a thread-local variable. 84extern "C" { 85__attribute__((visibility( 86 "default"))) __thread void *__safestack_unsafe_stack_ptr = nullptr; 87} 88 89// Per-thread unsafe stack information. It's not frequently accessed, so there 90// it can be kept out of the tcb in normal thread-local variables. 91static __thread void *unsafe_stack_start = nullptr; 92static __thread size_t unsafe_stack_size = 0; 93static __thread size_t unsafe_stack_guard = 0; 94 95static inline void *unsafe_stack_alloc(size_t size, size_t guard) { 96 CHECK_GE(size + guard, size); 97 void *addr = MmapOrDie(size + guard, "unsafe_stack_alloc"); 98 MprotectNoAccess((uptr)addr, (uptr)guard); 99 return (char *)addr + guard; 100} 101 102static inline void unsafe_stack_setup(void *start, size_t size, size_t guard) { 103 CHECK_GE((char *)start + size, (char *)start); 104 CHECK_GE((char *)start + guard, (char *)start); 105 void *stack_ptr = (char *)start + size; 106 CHECK_EQ((((size_t)stack_ptr) & (kStackAlign - 1)), 0); 107 108 __safestack_unsafe_stack_ptr = stack_ptr; 109 unsafe_stack_start = start; 110 unsafe_stack_size = size; 111 unsafe_stack_guard = guard; 112} 113 114static void unsafe_stack_free() { 115 if (unsafe_stack_start) { 116 UnmapOrDie((char *)unsafe_stack_start - unsafe_stack_guard, 117 unsafe_stack_size + unsafe_stack_guard); 118 } 119 unsafe_stack_start = nullptr; 120} 121 122/// Thread data for the cleanup handler 123static pthread_key_t thread_cleanup_key; 124 125/// Safe stack per-thread information passed to the thread_start function 126struct tinfo { 127 void *(*start_routine)(void *); 128 void *start_routine_arg; 129 130 void *unsafe_stack_start; 131 size_t unsafe_stack_size; 132 size_t unsafe_stack_guard; 133}; 134 135/// Wrap the thread function in order to deallocate the unsafe stack when the 136/// thread terminates by returning from its main function. 137static void *thread_start(void *arg) { 138 struct tinfo *tinfo = (struct tinfo *)arg; 139 140 void *(*start_routine)(void *) = tinfo->start_routine; 141 void *start_routine_arg = tinfo->start_routine_arg; 142 143 // Setup the unsafe stack; this will destroy tinfo content 144 unsafe_stack_setup(tinfo->unsafe_stack_start, tinfo->unsafe_stack_size, 145 tinfo->unsafe_stack_guard); 146 147 // Make sure out thread-specific destructor will be called 148 // FIXME: we can do this only any other specific key is set by 149 // intercepting the pthread_setspecific function itself 150 pthread_setspecific(thread_cleanup_key, (void *)1); 151 152 return start_routine(start_routine_arg); 153} 154 155/// Thread-specific data destructor 156static void thread_cleanup_handler(void *_iter) { 157 // We want to free the unsafe stack only after all other destructors 158 // have already run. We force this function to be called multiple times. 159 // User destructors that might run more then PTHREAD_DESTRUCTOR_ITERATIONS-1 160 // times might still end up executing after the unsafe stack is deallocated. 161 size_t iter = (size_t)_iter; 162 if (iter < PTHREAD_DESTRUCTOR_ITERATIONS) { 163 pthread_setspecific(thread_cleanup_key, (void *)(iter + 1)); 164 } else { 165 // This is the last iteration 166 unsafe_stack_free(); 167 } 168} 169 170/// Intercept thread creation operation to allocate and setup the unsafe stack 171INTERCEPTOR(int, pthread_create, pthread_t *thread, 172 const pthread_attr_t *attr, 173 void *(*start_routine)(void*), void *arg) { 174 175 size_t size = 0; 176 size_t guard = 0; 177 178 if (attr) { 179 pthread_attr_getstacksize(attr, &size); 180 pthread_attr_getguardsize(attr, &guard); 181 } else { 182 // get pthread default stack size 183 pthread_attr_t tmpattr; 184 pthread_attr_init(&tmpattr); 185 pthread_attr_getstacksize(&tmpattr, &size); 186 pthread_attr_getguardsize(&tmpattr, &guard); 187 pthread_attr_destroy(&tmpattr); 188 } 189 190 CHECK_NE(size, 0); 191 CHECK_EQ((size & (kStackAlign - 1)), 0); 192 CHECK_EQ((guard & (pageSize - 1)), 0); 193 194 void *addr = unsafe_stack_alloc(size, guard); 195 struct tinfo *tinfo = 196 (struct tinfo *)(((char *)addr) + size - sizeof(struct tinfo)); 197 tinfo->start_routine = start_routine; 198 tinfo->start_routine_arg = arg; 199 tinfo->unsafe_stack_start = addr; 200 tinfo->unsafe_stack_size = size; 201 tinfo->unsafe_stack_guard = guard; 202 203 return REAL(pthread_create)(thread, attr, thread_start, tinfo); 204} 205 206extern "C" __attribute__((visibility("default"))) 207#if !SANITIZER_CAN_USE_PREINIT_ARRAY 208// On ELF platforms, the constructor is invoked using .preinit_array (see below) 209__attribute__((constructor(0))) 210#endif 211void __safestack_init() { 212 // Determine the stack size for the main thread. 213 size_t size = kDefaultUnsafeStackSize; 214 size_t guard = 4096; 215 216 struct rlimit limit; 217 if (getrlimit(RLIMIT_STACK, &limit) == 0 && limit.rlim_cur != RLIM_INFINITY) 218 size = limit.rlim_cur; 219 220 // Allocate unsafe stack for main thread 221 void *addr = unsafe_stack_alloc(size, guard); 222 223 unsafe_stack_setup(addr, size, guard); 224 pageSize = sysconf(_SC_PAGESIZE); 225 226 // Initialize pthread interceptors for thread allocation 227 INTERCEPT_FUNCTION(pthread_create); 228 229 // Setup the cleanup handler 230 pthread_key_create(&thread_cleanup_key, thread_cleanup_handler); 231} 232 233#if SANITIZER_CAN_USE_PREINIT_ARRAY 234// On ELF platforms, run safestack initialization before any other constructors. 235// On other platforms we use the constructor attribute to arrange to run our 236// initialization early. 237extern "C" { 238__attribute__((section(".preinit_array"), 239 used)) void (*__safestack_preinit)(void) = __safestack_init; 240} 241#endif 242 243extern "C" 244 __attribute__((visibility("default"))) void *__get_unsafe_stack_start() { 245 return unsafe_stack_start; 246} 247 248extern "C" 249 __attribute__((visibility("default"))) void *__get_unsafe_stack_ptr() { 250 return __safestack_unsafe_stack_ptr; 251} 252