1 /* 2 * Copyright 2011-2017 by the PaX Team <pageexec@freemail.hu> 3 * Modified by Alexander Popov <alex.popov@linux.com> 4 * Licensed under the GPL v2 5 * 6 * Note: the choice of the license means that the compilation process is 7 * NOT 'eligible' as defined by gcc's library exception to the GPL v3, 8 * but for the kernel it doesn't matter since it doesn't link against 9 * any of the gcc libraries 10 * 11 * This gcc plugin is needed for tracking the lowest border of the kernel stack. 12 * It instruments the kernel code inserting stackleak_track_stack() calls: 13 * - after alloca(); 14 * - for the functions with a stack frame size greater than or equal 15 * to the "track-min-size" plugin parameter. 16 * 17 * This plugin is ported from grsecurity/PaX. For more information see: 18 * https://grsecurity.net/ 19 * https://pax.grsecurity.net/ 20 * 21 * Debugging: 22 * - use fprintf() to stderr, debug_generic_expr(), debug_gimple_stmt(), 23 * print_rtl() and print_simple_rtl(); 24 * - add "-fdump-tree-all -fdump-rtl-all" to the plugin CFLAGS in 25 * Makefile.gcc-plugins to see the verbose dumps of the gcc passes; 26 * - use gcc -E to understand the preprocessing shenanigans; 27 * - use gcc with enabled CFG/GIMPLE/SSA verification (--enable-checking). 28 */ 29 30 #include "gcc-common.h" 31 32 __visible int plugin_is_GPL_compatible; 33 34 static int track_frame_size = -1; 35 static const char track_function[] = "stackleak_track_stack"; 36 37 /* 38 * Mark these global variables (roots) for gcc garbage collector since 39 * they point to the garbage-collected memory. 40 */ 41 static GTY(()) tree track_function_decl; 42 43 static struct plugin_info stackleak_plugin_info = { 44 .version = "201707101337", 45 .help = "track-min-size=nn\ttrack stack for functions with a stack frame size >= nn bytes\n" 46 "disable\t\tdo not activate the plugin\n" 47 }; 48 49 static void stackleak_add_track_stack(gimple_stmt_iterator *gsi, bool after) 50 { 51 gimple stmt; 52 gcall *stackleak_track_stack; 53 cgraph_node_ptr node; 54 int frequency; 55 basic_block bb; 56 57 /* Insert call to void stackleak_track_stack(void) */ 58 stmt = gimple_build_call(track_function_decl, 0); 59 stackleak_track_stack = as_a_gcall(stmt); 60 if (after) { 61 gsi_insert_after(gsi, stackleak_track_stack, 62 GSI_CONTINUE_LINKING); 63 } else { 64 gsi_insert_before(gsi, stackleak_track_stack, GSI_SAME_STMT); 65 } 66 67 /* Update the cgraph */ 68 bb = gimple_bb(stackleak_track_stack); 69 node = cgraph_get_create_node(track_function_decl); 70 gcc_assert(node); 71 frequency = compute_call_stmt_bb_frequency(current_function_decl, bb); 72 cgraph_create_edge(cgraph_get_node(current_function_decl), node, 73 stackleak_track_stack, bb->count, frequency); 74 } 75 76 static bool is_alloca(gimple stmt) 77 { 78 if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA)) 79 return true; 80 81 #if BUILDING_GCC_VERSION >= 4007 82 if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA_WITH_ALIGN)) 83 return true; 84 #endif 85 86 return false; 87 } 88 89 /* 90 * Work with the GIMPLE representation of the code. Insert the 91 * stackleak_track_stack() call after alloca() and into the beginning 92 * of the function if it is not instrumented. 93 */ 94 static unsigned int stackleak_instrument_execute(void) 95 { 96 basic_block bb, entry_bb; 97 bool prologue_instrumented = false, is_leaf = true; 98 gimple_stmt_iterator gsi; 99 100 /* 101 * ENTRY_BLOCK_PTR is a basic block which represents possible entry 102 * point of a function. This block does not contain any code and 103 * has a CFG edge to its successor. 104 */ 105 gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun))); 106 entry_bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun)); 107 108 /* 109 * Loop through the GIMPLE statements in each of cfun basic blocks. 110 * cfun is a global variable which represents the function that is 111 * currently processed. 112 */ 113 FOR_EACH_BB_FN(bb, cfun) { 114 for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) { 115 gimple stmt; 116 117 stmt = gsi_stmt(gsi); 118 119 /* Leaf function is a function which makes no calls */ 120 if (is_gimple_call(stmt)) 121 is_leaf = false; 122 123 if (!is_alloca(stmt)) 124 continue; 125 126 /* Insert stackleak_track_stack() call after alloca() */ 127 stackleak_add_track_stack(&gsi, true); 128 if (bb == entry_bb) 129 prologue_instrumented = true; 130 } 131 } 132 133 if (prologue_instrumented) 134 return 0; 135 136 /* 137 * Special cases to skip the instrumentation. 138 * 139 * Taking the address of static inline functions materializes them, 140 * but we mustn't instrument some of them as the resulting stack 141 * alignment required by the function call ABI will break other 142 * assumptions regarding the expected (but not otherwise enforced) 143 * register clobbering ABI. 144 * 145 * Case in point: native_save_fl on amd64 when optimized for size 146 * clobbers rdx if it were instrumented here. 147 * 148 * TODO: any more special cases? 149 */ 150 if (is_leaf && 151 !TREE_PUBLIC(current_function_decl) && 152 DECL_DECLARED_INLINE_P(current_function_decl)) { 153 return 0; 154 } 155 156 if (is_leaf && 157 !strncmp(IDENTIFIER_POINTER(DECL_NAME(current_function_decl)), 158 "_paravirt_", 10)) { 159 return 0; 160 } 161 162 /* Insert stackleak_track_stack() call at the function beginning */ 163 bb = entry_bb; 164 if (!single_pred_p(bb)) { 165 /* gcc_assert(bb_loop_depth(bb) || 166 (bb->flags & BB_IRREDUCIBLE_LOOP)); */ 167 split_edge(single_succ_edge(ENTRY_BLOCK_PTR_FOR_FN(cfun))); 168 gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun))); 169 bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun)); 170 } 171 gsi = gsi_after_labels(bb); 172 stackleak_add_track_stack(&gsi, false); 173 174 return 0; 175 } 176 177 static bool large_stack_frame(void) 178 { 179 #if BUILDING_GCC_VERSION >= 8000 180 return maybe_ge(get_frame_size(), track_frame_size); 181 #else 182 return (get_frame_size() >= track_frame_size); 183 #endif 184 } 185 186 /* 187 * Work with the RTL representation of the code. 188 * Remove the unneeded stackleak_track_stack() calls from the functions 189 * which don't call alloca() and don't have a large enough stack frame size. 190 */ 191 static unsigned int stackleak_cleanup_execute(void) 192 { 193 rtx_insn *insn, *next; 194 195 if (cfun->calls_alloca) 196 return 0; 197 198 if (large_stack_frame()) 199 return 0; 200 201 /* 202 * Find stackleak_track_stack() calls. Loop through the chain of insns, 203 * which is an RTL representation of the code for a function. 204 * 205 * The example of a matching insn: 206 * (call_insn 8 4 10 2 (call (mem (symbol_ref ("stackleak_track_stack") 207 * [flags 0x41] <function_decl 0x7f7cd3302a80 stackleak_track_stack>) 208 * [0 stackleak_track_stack S1 A8]) (0)) 675 {*call} (expr_list 209 * (symbol_ref ("stackleak_track_stack") [flags 0x41] <function_decl 210 * 0x7f7cd3302a80 stackleak_track_stack>) (expr_list (0) (nil))) (nil)) 211 */ 212 for (insn = get_insns(); insn; insn = next) { 213 rtx body; 214 215 next = NEXT_INSN(insn); 216 217 /* Check the expression code of the insn */ 218 if (!CALL_P(insn)) 219 continue; 220 221 /* 222 * Check the expression code of the insn body, which is an RTL 223 * Expression (RTX) describing the side effect performed by 224 * that insn. 225 */ 226 body = PATTERN(insn); 227 228 if (GET_CODE(body) == PARALLEL) 229 body = XVECEXP(body, 0, 0); 230 231 if (GET_CODE(body) != CALL) 232 continue; 233 234 /* 235 * Check the first operand of the call expression. It should 236 * be a mem RTX describing the needed subroutine with a 237 * symbol_ref RTX. 238 */ 239 body = XEXP(body, 0); 240 if (GET_CODE(body) != MEM) 241 continue; 242 243 body = XEXP(body, 0); 244 if (GET_CODE(body) != SYMBOL_REF) 245 continue; 246 247 if (SYMBOL_REF_DECL(body) != track_function_decl) 248 continue; 249 250 /* Delete the stackleak_track_stack() call */ 251 delete_insn_and_edges(insn); 252 #if BUILDING_GCC_VERSION >= 4007 && BUILDING_GCC_VERSION < 8000 253 if (GET_CODE(next) == NOTE && 254 NOTE_KIND(next) == NOTE_INSN_CALL_ARG_LOCATION) { 255 insn = next; 256 next = NEXT_INSN(insn); 257 delete_insn_and_edges(insn); 258 } 259 #endif 260 } 261 262 return 0; 263 } 264 265 static bool stackleak_gate(void) 266 { 267 tree section; 268 269 section = lookup_attribute("section", 270 DECL_ATTRIBUTES(current_function_decl)); 271 if (section && TREE_VALUE(section)) { 272 section = TREE_VALUE(TREE_VALUE(section)); 273 274 if (!strncmp(TREE_STRING_POINTER(section), ".init.text", 10)) 275 return false; 276 if (!strncmp(TREE_STRING_POINTER(section), ".devinit.text", 13)) 277 return false; 278 if (!strncmp(TREE_STRING_POINTER(section), ".cpuinit.text", 13)) 279 return false; 280 if (!strncmp(TREE_STRING_POINTER(section), ".meminit.text", 13)) 281 return false; 282 } 283 284 return track_frame_size >= 0; 285 } 286 287 /* Build the function declaration for stackleak_track_stack() */ 288 static void stackleak_start_unit(void *gcc_data __unused, 289 void *user_data __unused) 290 { 291 tree fntype; 292 293 /* void stackleak_track_stack(void) */ 294 fntype = build_function_type_list(void_type_node, NULL_TREE); 295 track_function_decl = build_fn_decl(track_function, fntype); 296 DECL_ASSEMBLER_NAME(track_function_decl); /* for LTO */ 297 TREE_PUBLIC(track_function_decl) = 1; 298 TREE_USED(track_function_decl) = 1; 299 DECL_EXTERNAL(track_function_decl) = 1; 300 DECL_ARTIFICIAL(track_function_decl) = 1; 301 DECL_PRESERVE_P(track_function_decl) = 1; 302 } 303 304 /* 305 * Pass gate function is a predicate function that gets executed before the 306 * corresponding pass. If the return value is 'true' the pass gets executed, 307 * otherwise, it is skipped. 308 */ 309 static bool stackleak_instrument_gate(void) 310 { 311 return stackleak_gate(); 312 } 313 314 #define PASS_NAME stackleak_instrument 315 #define PROPERTIES_REQUIRED PROP_gimple_leh | PROP_cfg 316 #define TODO_FLAGS_START TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts 317 #define TODO_FLAGS_FINISH TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func \ 318 | TODO_update_ssa | TODO_rebuild_cgraph_edges 319 #include "gcc-generate-gimple-pass.h" 320 321 static bool stackleak_cleanup_gate(void) 322 { 323 return stackleak_gate(); 324 } 325 326 #define PASS_NAME stackleak_cleanup 327 #define TODO_FLAGS_FINISH TODO_dump_func 328 #include "gcc-generate-rtl-pass.h" 329 330 /* 331 * Every gcc plugin exports a plugin_init() function that is called right 332 * after the plugin is loaded. This function is responsible for registering 333 * the plugin callbacks and doing other required initialization. 334 */ 335 __visible int plugin_init(struct plugin_name_args *plugin_info, 336 struct plugin_gcc_version *version) 337 { 338 const char * const plugin_name = plugin_info->base_name; 339 const int argc = plugin_info->argc; 340 const struct plugin_argument * const argv = plugin_info->argv; 341 int i = 0; 342 343 /* Extra GGC root tables describing our GTY-ed data */ 344 static const struct ggc_root_tab gt_ggc_r_gt_stackleak[] = { 345 { 346 .base = &track_function_decl, 347 .nelt = 1, 348 .stride = sizeof(track_function_decl), 349 .cb = >_ggc_mx_tree_node, 350 .pchw = >_pch_nx_tree_node 351 }, 352 LAST_GGC_ROOT_TAB 353 }; 354 355 /* 356 * The stackleak_instrument pass should be executed before the 357 * "optimized" pass, which is the control flow graph cleanup that is 358 * performed just before expanding gcc trees to the RTL. In former 359 * versions of the plugin this new pass was inserted before the 360 * "tree_profile" pass, which is currently called "profile". 361 */ 362 PASS_INFO(stackleak_instrument, "optimized", 1, 363 PASS_POS_INSERT_BEFORE); 364 365 /* 366 * The stackleak_cleanup pass should be executed before the "*free_cfg" 367 * pass. It's the moment when the stack frame size is already final, 368 * function prologues and epilogues are generated, and the 369 * machine-dependent code transformations are not done. 370 */ 371 PASS_INFO(stackleak_cleanup, "*free_cfg", 1, PASS_POS_INSERT_BEFORE); 372 373 if (!plugin_default_version_check(version, &gcc_version)) { 374 error(G_("incompatible gcc/plugin versions")); 375 return 1; 376 } 377 378 /* Parse the plugin arguments */ 379 for (i = 0; i < argc; i++) { 380 if (!strcmp(argv[i].key, "disable")) 381 return 0; 382 383 if (!strcmp(argv[i].key, "track-min-size")) { 384 if (!argv[i].value) { 385 error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), 386 plugin_name, argv[i].key); 387 return 1; 388 } 389 390 track_frame_size = atoi(argv[i].value); 391 if (track_frame_size < 0) { 392 error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), 393 plugin_name, argv[i].key, argv[i].value); 394 return 1; 395 } 396 } else { 397 error(G_("unknown option '-fplugin-arg-%s-%s'"), 398 plugin_name, argv[i].key); 399 return 1; 400 } 401 } 402 403 /* Give the information about the plugin */ 404 register_callback(plugin_name, PLUGIN_INFO, NULL, 405 &stackleak_plugin_info); 406 407 /* Register to be called before processing a translation unit */ 408 register_callback(plugin_name, PLUGIN_START_UNIT, 409 &stackleak_start_unit, NULL); 410 411 /* Register an extra GCC garbage collector (GGC) root table */ 412 register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL, 413 (void *)>_ggc_r_gt_stackleak); 414 415 /* 416 * Hook into the Pass Manager to register new gcc passes. 417 * 418 * The stack frame size info is available only at the last RTL pass, 419 * when it's too late to insert complex code like a function call. 420 * So we register two gcc passes to instrument every function at first 421 * and remove the unneeded instrumentation later. 422 */ 423 register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, 424 &stackleak_instrument_pass_info); 425 register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, 426 &stackleak_cleanup_pass_info); 427 428 return 0; 429 } 430