1 /*
2  * Copyright 2011-2017 by the PaX Team <pageexec@freemail.hu>
3  * Modified by Alexander Popov <alex.popov@linux.com>
4  * Licensed under the GPL v2
5  *
6  * Note: the choice of the license means that the compilation process is
7  * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
8  * but for the kernel it doesn't matter since it doesn't link against
9  * any of the gcc libraries
10  *
11  * This gcc plugin is needed for tracking the lowest border of the kernel stack.
12  * It instruments the kernel code inserting stackleak_track_stack() calls:
13  *  - after alloca();
14  *  - for the functions with a stack frame size greater than or equal
15  *     to the "track-min-size" plugin parameter.
16  *
17  * This plugin is ported from grsecurity/PaX. For more information see:
18  *   https://grsecurity.net/
19  *   https://pax.grsecurity.net/
20  *
21  * Debugging:
22  *  - use fprintf() to stderr, debug_generic_expr(), debug_gimple_stmt(),
23  *     print_rtl_single() and debug_rtx();
24  *  - add "-fdump-tree-all -fdump-rtl-all" to the plugin CFLAGS in
25  *     Makefile.gcc-plugins to see the verbose dumps of the gcc passes;
26  *  - use gcc -E to understand the preprocessing shenanigans;
27  *  - use gcc with enabled CFG/GIMPLE/SSA verification (--enable-checking).
28  */
29 
30 #include "gcc-common.h"
31 
32 __visible int plugin_is_GPL_compatible;
33 
34 static int track_frame_size = -1;
35 static bool build_for_x86 = false;
36 static const char track_function[] = "stackleak_track_stack";
37 static bool disable = false;
38 static bool verbose = false;
39 
40 /*
41  * Mark these global variables (roots) for gcc garbage collector since
42  * they point to the garbage-collected memory.
43  */
44 static GTY(()) tree track_function_decl;
45 
46 static struct plugin_info stackleak_plugin_info = {
47 	.version = "201707101337",
48 	.help = "track-min-size=nn\ttrack stack for functions with a stack frame size >= nn bytes\n"
49 		"arch=target_arch\tspecify target build arch\n"
50 		"disable\t\tdo not activate the plugin\n"
51 		"verbose\t\tprint info about the instrumentation\n"
52 };
53 
54 static void add_stack_tracking_gcall(gimple_stmt_iterator *gsi, bool after)
55 {
56 	gimple stmt;
57 	gcall *gimple_call;
58 	cgraph_node_ptr node;
59 	basic_block bb;
60 
61 	/* Insert calling stackleak_track_stack() */
62 	stmt = gimple_build_call(track_function_decl, 0);
63 	gimple_call = as_a_gcall(stmt);
64 	if (after)
65 		gsi_insert_after(gsi, gimple_call, GSI_CONTINUE_LINKING);
66 	else
67 		gsi_insert_before(gsi, gimple_call, GSI_SAME_STMT);
68 
69 	/* Update the cgraph */
70 	bb = gimple_bb(gimple_call);
71 	node = cgraph_get_create_node(track_function_decl);
72 	gcc_assert(node);
73 	cgraph_create_edge(cgraph_get_node(current_function_decl), node,
74 			gimple_call, bb->count,
75 			compute_call_stmt_bb_frequency(current_function_decl, bb));
76 }
77 
78 static bool is_alloca(gimple stmt)
79 {
80 	if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA))
81 		return true;
82 
83 	if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA_WITH_ALIGN))
84 		return true;
85 
86 	return false;
87 }
88 
89 static tree get_current_stack_pointer_decl(void)
90 {
91 	varpool_node_ptr node;
92 
93 	FOR_EACH_VARIABLE(node) {
94 		tree var = NODE_DECL(node);
95 		tree name = DECL_NAME(var);
96 
97 		if (DECL_NAME_LENGTH(var) != sizeof("current_stack_pointer") - 1)
98 			continue;
99 
100 		if (strcmp(IDENTIFIER_POINTER(name), "current_stack_pointer"))
101 			continue;
102 
103 		return var;
104 	}
105 
106 	if (verbose) {
107 		fprintf(stderr, "stackleak: missing current_stack_pointer in %s()\n",
108 			DECL_NAME_POINTER(current_function_decl));
109 	}
110 	return NULL_TREE;
111 }
112 
113 static void add_stack_tracking_gasm(gimple_stmt_iterator *gsi, bool after)
114 {
115 	gasm *asm_call = NULL;
116 	tree sp_decl, input;
117 	vec<tree, va_gc> *inputs = NULL;
118 
119 	/* 'no_caller_saved_registers' is currently supported only for x86 */
120 	gcc_assert(build_for_x86);
121 
122 	/*
123 	 * Insert calling stackleak_track_stack() in asm:
124 	 *   asm volatile("call stackleak_track_stack"
125 	 *		  :: "r" (current_stack_pointer))
126 	 * Use ASM_CALL_CONSTRAINT trick from arch/x86/include/asm/asm.h.
127 	 * This constraint is taken into account during gcc shrink-wrapping
128 	 * optimization. It is needed to be sure that stackleak_track_stack()
129 	 * call is inserted after the prologue of the containing function,
130 	 * when the stack frame is prepared.
131 	 */
132 	sp_decl = get_current_stack_pointer_decl();
133 	if (sp_decl == NULL_TREE) {
134 		add_stack_tracking_gcall(gsi, after);
135 		return;
136 	}
137 	input = build_tree_list(NULL_TREE, build_const_char_string(2, "r"));
138 	input = chainon(NULL_TREE, build_tree_list(input, sp_decl));
139 	vec_safe_push(inputs, input);
140 	asm_call = gimple_build_asm_vec("call stackleak_track_stack",
141 					inputs, NULL, NULL, NULL);
142 	gimple_asm_set_volatile(asm_call, true);
143 	if (after)
144 		gsi_insert_after(gsi, asm_call, GSI_CONTINUE_LINKING);
145 	else
146 		gsi_insert_before(gsi, asm_call, GSI_SAME_STMT);
147 	update_stmt(asm_call);
148 }
149 
150 static void add_stack_tracking(gimple_stmt_iterator *gsi, bool after)
151 {
152 	/*
153 	 * The 'no_caller_saved_registers' attribute is used for
154 	 * stackleak_track_stack(). If the compiler supports this attribute for
155 	 * the target arch, we can add calling stackleak_track_stack() in asm.
156 	 * That improves performance: we avoid useless operations with the
157 	 * caller-saved registers in the functions from which we will remove
158 	 * stackleak_track_stack() call during the stackleak_cleanup pass.
159 	 */
160 	if (lookup_attribute_spec(get_identifier("no_caller_saved_registers")))
161 		add_stack_tracking_gasm(gsi, after);
162 	else
163 		add_stack_tracking_gcall(gsi, after);
164 }
165 
166 /*
167  * Work with the GIMPLE representation of the code. Insert the
168  * stackleak_track_stack() call after alloca() and into the beginning
169  * of the function if it is not instrumented.
170  */
171 static unsigned int stackleak_instrument_execute(void)
172 {
173 	basic_block bb, entry_bb;
174 	bool prologue_instrumented = false, is_leaf = true;
175 	gimple_stmt_iterator gsi = { 0 };
176 
177 	/*
178 	 * ENTRY_BLOCK_PTR is a basic block which represents possible entry
179 	 * point of a function. This block does not contain any code and
180 	 * has a CFG edge to its successor.
181 	 */
182 	gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
183 	entry_bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
184 
185 	/*
186 	 * Loop through the GIMPLE statements in each of cfun basic blocks.
187 	 * cfun is a global variable which represents the function that is
188 	 * currently processed.
189 	 */
190 	FOR_EACH_BB_FN(bb, cfun) {
191 		for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
192 			gimple stmt;
193 
194 			stmt = gsi_stmt(gsi);
195 
196 			/* Leaf function is a function which makes no calls */
197 			if (is_gimple_call(stmt))
198 				is_leaf = false;
199 
200 			if (!is_alloca(stmt))
201 				continue;
202 
203 			if (verbose) {
204 				fprintf(stderr, "stackleak: be careful, alloca() in %s()\n",
205 					DECL_NAME_POINTER(current_function_decl));
206 			}
207 
208 			/* Insert stackleak_track_stack() call after alloca() */
209 			add_stack_tracking(&gsi, true);
210 			if (bb == entry_bb)
211 				prologue_instrumented = true;
212 		}
213 	}
214 
215 	if (prologue_instrumented)
216 		return 0;
217 
218 	/*
219 	 * Special cases to skip the instrumentation.
220 	 *
221 	 * Taking the address of static inline functions materializes them,
222 	 * but we mustn't instrument some of them as the resulting stack
223 	 * alignment required by the function call ABI will break other
224 	 * assumptions regarding the expected (but not otherwise enforced)
225 	 * register clobbering ABI.
226 	 *
227 	 * Case in point: native_save_fl on amd64 when optimized for size
228 	 * clobbers rdx if it were instrumented here.
229 	 *
230 	 * TODO: any more special cases?
231 	 */
232 	if (is_leaf &&
233 	    !TREE_PUBLIC(current_function_decl) &&
234 	    DECL_DECLARED_INLINE_P(current_function_decl)) {
235 		return 0;
236 	}
237 
238 	if (is_leaf &&
239 	    !strncmp(IDENTIFIER_POINTER(DECL_NAME(current_function_decl)),
240 		     "_paravirt_", 10)) {
241 		return 0;
242 	}
243 
244 	/* Insert stackleak_track_stack() call at the function beginning */
245 	bb = entry_bb;
246 	if (!single_pred_p(bb)) {
247 		/* gcc_assert(bb_loop_depth(bb) ||
248 				(bb->flags & BB_IRREDUCIBLE_LOOP)); */
249 		split_edge(single_succ_edge(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
250 		gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
251 		bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
252 	}
253 	gsi = gsi_after_labels(bb);
254 	add_stack_tracking(&gsi, false);
255 
256 	return 0;
257 }
258 
259 static bool large_stack_frame(void)
260 {
261 #if BUILDING_GCC_VERSION >= 8000
262 	return maybe_ge(get_frame_size(), track_frame_size);
263 #else
264 	return (get_frame_size() >= track_frame_size);
265 #endif
266 }
267 
268 static void remove_stack_tracking_gcall(void)
269 {
270 	rtx_insn *insn, *next;
271 
272 	/*
273 	 * Find stackleak_track_stack() calls. Loop through the chain of insns,
274 	 * which is an RTL representation of the code for a function.
275 	 *
276 	 * The example of a matching insn:
277 	 *  (call_insn 8 4 10 2 (call (mem (symbol_ref ("stackleak_track_stack")
278 	 *  [flags 0x41] <function_decl 0x7f7cd3302a80 stackleak_track_stack>)
279 	 *  [0 stackleak_track_stack S1 A8]) (0)) 675 {*call} (expr_list
280 	 *  (symbol_ref ("stackleak_track_stack") [flags 0x41] <function_decl
281 	 *  0x7f7cd3302a80 stackleak_track_stack>) (expr_list (0) (nil))) (nil))
282 	 */
283 	for (insn = get_insns(); insn; insn = next) {
284 		rtx body;
285 
286 		next = NEXT_INSN(insn);
287 
288 		/* Check the expression code of the insn */
289 		if (!CALL_P(insn))
290 			continue;
291 
292 		/*
293 		 * Check the expression code of the insn body, which is an RTL
294 		 * Expression (RTX) describing the side effect performed by
295 		 * that insn.
296 		 */
297 		body = PATTERN(insn);
298 
299 		if (GET_CODE(body) == PARALLEL)
300 			body = XVECEXP(body, 0, 0);
301 
302 		if (GET_CODE(body) != CALL)
303 			continue;
304 
305 		/*
306 		 * Check the first operand of the call expression. It should
307 		 * be a mem RTX describing the needed subroutine with a
308 		 * symbol_ref RTX.
309 		 */
310 		body = XEXP(body, 0);
311 		if (GET_CODE(body) != MEM)
312 			continue;
313 
314 		body = XEXP(body, 0);
315 		if (GET_CODE(body) != SYMBOL_REF)
316 			continue;
317 
318 		if (SYMBOL_REF_DECL(body) != track_function_decl)
319 			continue;
320 
321 		/* Delete the stackleak_track_stack() call */
322 		delete_insn_and_edges(insn);
323 #if BUILDING_GCC_VERSION < 8000
324 		if (GET_CODE(next) == NOTE &&
325 		    NOTE_KIND(next) == NOTE_INSN_CALL_ARG_LOCATION) {
326 			insn = next;
327 			next = NEXT_INSN(insn);
328 			delete_insn_and_edges(insn);
329 		}
330 #endif
331 	}
332 }
333 
334 static bool remove_stack_tracking_gasm(void)
335 {
336 	bool removed = false;
337 	rtx_insn *insn, *next;
338 
339 	/* 'no_caller_saved_registers' is currently supported only for x86 */
340 	gcc_assert(build_for_x86);
341 
342 	/*
343 	 * Find stackleak_track_stack() asm calls. Loop through the chain of
344 	 * insns, which is an RTL representation of the code for a function.
345 	 *
346 	 * The example of a matching insn:
347 	 *  (insn 11 5 12 2 (parallel [ (asm_operands/v
348 	 *  ("call stackleak_track_stack") ("") 0
349 	 *  [ (reg/v:DI 7 sp [ current_stack_pointer ]) ]
350 	 *  [ (asm_input:DI ("r")) ] [])
351 	 *  (clobber (reg:CC 17 flags)) ]) -1 (nil))
352 	 */
353 	for (insn = get_insns(); insn; insn = next) {
354 		rtx body;
355 
356 		next = NEXT_INSN(insn);
357 
358 		/* Check the expression code of the insn */
359 		if (!NONJUMP_INSN_P(insn))
360 			continue;
361 
362 		/*
363 		 * Check the expression code of the insn body, which is an RTL
364 		 * Expression (RTX) describing the side effect performed by
365 		 * that insn.
366 		 */
367 		body = PATTERN(insn);
368 
369 		if (GET_CODE(body) != PARALLEL)
370 			continue;
371 
372 		body = XVECEXP(body, 0, 0);
373 
374 		if (GET_CODE(body) != ASM_OPERANDS)
375 			continue;
376 
377 		if (strcmp(ASM_OPERANDS_TEMPLATE(body),
378 						"call stackleak_track_stack")) {
379 			continue;
380 		}
381 
382 		delete_insn_and_edges(insn);
383 		gcc_assert(!removed);
384 		removed = true;
385 	}
386 
387 	return removed;
388 }
389 
390 /*
391  * Work with the RTL representation of the code.
392  * Remove the unneeded stackleak_track_stack() calls from the functions
393  * which don't call alloca() and don't have a large enough stack frame size.
394  */
395 static unsigned int stackleak_cleanup_execute(void)
396 {
397 	const char *fn = DECL_NAME_POINTER(current_function_decl);
398 	bool removed = false;
399 
400 	/*
401 	 * Leave stack tracking in functions that call alloca().
402 	 * Additional case:
403 	 *   gcc before version 7 called allocate_dynamic_stack_space() from
404 	 *   expand_stack_vars() for runtime alignment of constant-sized stack
405 	 *   variables. That caused cfun->calls_alloca to be set for functions
406 	 *   that in fact don't use alloca().
407 	 *   For more info see gcc commit 7072df0aae0c59ae437e.
408 	 *   Let's leave such functions instrumented as well.
409 	 */
410 	if (cfun->calls_alloca) {
411 		if (verbose)
412 			fprintf(stderr, "stackleak: instrument %s(): calls_alloca\n", fn);
413 		return 0;
414 	}
415 
416 	/* Leave stack tracking in functions with large stack frame */
417 	if (large_stack_frame()) {
418 		if (verbose)
419 			fprintf(stderr, "stackleak: instrument %s()\n", fn);
420 		return 0;
421 	}
422 
423 	if (lookup_attribute_spec(get_identifier("no_caller_saved_registers")))
424 		removed = remove_stack_tracking_gasm();
425 
426 	if (!removed)
427 		remove_stack_tracking_gcall();
428 
429 	return 0;
430 }
431 
432 static bool stackleak_gate(void)
433 {
434 	tree section;
435 
436 	section = lookup_attribute("section",
437 				   DECL_ATTRIBUTES(current_function_decl));
438 	if (section && TREE_VALUE(section)) {
439 		section = TREE_VALUE(TREE_VALUE(section));
440 
441 		if (!strncmp(TREE_STRING_POINTER(section), ".init.text", 10))
442 			return false;
443 		if (!strncmp(TREE_STRING_POINTER(section), ".devinit.text", 13))
444 			return false;
445 		if (!strncmp(TREE_STRING_POINTER(section), ".cpuinit.text", 13))
446 			return false;
447 		if (!strncmp(TREE_STRING_POINTER(section), ".meminit.text", 13))
448 			return false;
449 	}
450 
451 	return track_frame_size >= 0;
452 }
453 
454 /* Build the function declaration for stackleak_track_stack() */
455 static void stackleak_start_unit(void *gcc_data __unused,
456 				 void *user_data __unused)
457 {
458 	tree fntype;
459 
460 	/* void stackleak_track_stack(void) */
461 	fntype = build_function_type_list(void_type_node, NULL_TREE);
462 	track_function_decl = build_fn_decl(track_function, fntype);
463 	DECL_ASSEMBLER_NAME(track_function_decl); /* for LTO */
464 	TREE_PUBLIC(track_function_decl) = 1;
465 	TREE_USED(track_function_decl) = 1;
466 	DECL_EXTERNAL(track_function_decl) = 1;
467 	DECL_ARTIFICIAL(track_function_decl) = 1;
468 	DECL_PRESERVE_P(track_function_decl) = 1;
469 }
470 
471 /*
472  * Pass gate function is a predicate function that gets executed before the
473  * corresponding pass. If the return value is 'true' the pass gets executed,
474  * otherwise, it is skipped.
475  */
476 static bool stackleak_instrument_gate(void)
477 {
478 	return stackleak_gate();
479 }
480 
481 #define PASS_NAME stackleak_instrument
482 #define PROPERTIES_REQUIRED PROP_gimple_leh | PROP_cfg
483 #define TODO_FLAGS_START TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts
484 #define TODO_FLAGS_FINISH TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func \
485 			| TODO_update_ssa | TODO_rebuild_cgraph_edges
486 #include "gcc-generate-gimple-pass.h"
487 
488 static bool stackleak_cleanup_gate(void)
489 {
490 	return stackleak_gate();
491 }
492 
493 #define PASS_NAME stackleak_cleanup
494 #define TODO_FLAGS_FINISH TODO_dump_func
495 #include "gcc-generate-rtl-pass.h"
496 
497 /*
498  * Every gcc plugin exports a plugin_init() function that is called right
499  * after the plugin is loaded. This function is responsible for registering
500  * the plugin callbacks and doing other required initialization.
501  */
502 __visible int plugin_init(struct plugin_name_args *plugin_info,
503 			  struct plugin_gcc_version *version)
504 {
505 	const char * const plugin_name = plugin_info->base_name;
506 	const int argc = plugin_info->argc;
507 	const struct plugin_argument * const argv = plugin_info->argv;
508 	int i = 0;
509 
510 	/* Extra GGC root tables describing our GTY-ed data */
511 	static const struct ggc_root_tab gt_ggc_r_gt_stackleak[] = {
512 		{
513 			.base = &track_function_decl,
514 			.nelt = 1,
515 			.stride = sizeof(track_function_decl),
516 			.cb = &gt_ggc_mx_tree_node,
517 			.pchw = &gt_pch_nx_tree_node
518 		},
519 		LAST_GGC_ROOT_TAB
520 	};
521 
522 	/*
523 	 * The stackleak_instrument pass should be executed before the
524 	 * "optimized" pass, which is the control flow graph cleanup that is
525 	 * performed just before expanding gcc trees to the RTL. In former
526 	 * versions of the plugin this new pass was inserted before the
527 	 * "tree_profile" pass, which is currently called "profile".
528 	 */
529 	PASS_INFO(stackleak_instrument, "optimized", 1,
530 						PASS_POS_INSERT_BEFORE);
531 
532 	/*
533 	 * The stackleak_cleanup pass should be executed before the "*free_cfg"
534 	 * pass. It's the moment when the stack frame size is already final,
535 	 * function prologues and epilogues are generated, and the
536 	 * machine-dependent code transformations are not done.
537 	 */
538 	PASS_INFO(stackleak_cleanup, "*free_cfg", 1, PASS_POS_INSERT_BEFORE);
539 
540 	if (!plugin_default_version_check(version, &gcc_version)) {
541 		error(G_("incompatible gcc/plugin versions"));
542 		return 1;
543 	}
544 
545 	/* Parse the plugin arguments */
546 	for (i = 0; i < argc; i++) {
547 		if (!strcmp(argv[i].key, "track-min-size")) {
548 			if (!argv[i].value) {
549 				error(G_("no value supplied for option '-fplugin-arg-%s-%s'"),
550 					plugin_name, argv[i].key);
551 				return 1;
552 			}
553 
554 			track_frame_size = atoi(argv[i].value);
555 			if (track_frame_size < 0) {
556 				error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"),
557 					plugin_name, argv[i].key, argv[i].value);
558 				return 1;
559 			}
560 		} else if (!strcmp(argv[i].key, "arch")) {
561 			if (!argv[i].value) {
562 				error(G_("no value supplied for option '-fplugin-arg-%s-%s'"),
563 					plugin_name, argv[i].key);
564 				return 1;
565 			}
566 
567 			if (!strcmp(argv[i].value, "x86"))
568 				build_for_x86 = true;
569 		} else if (!strcmp(argv[i].key, "disable")) {
570 			disable = true;
571 		} else if (!strcmp(argv[i].key, "verbose")) {
572 			verbose = true;
573 		} else {
574 			error(G_("unknown option '-fplugin-arg-%s-%s'"),
575 					plugin_name, argv[i].key);
576 			return 1;
577 		}
578 	}
579 
580 	if (disable) {
581 		if (verbose)
582 			fprintf(stderr, "stackleak: disabled for this translation unit\n");
583 		return 0;
584 	}
585 
586 	/* Give the information about the plugin */
587 	register_callback(plugin_name, PLUGIN_INFO, NULL,
588 						&stackleak_plugin_info);
589 
590 	/* Register to be called before processing a translation unit */
591 	register_callback(plugin_name, PLUGIN_START_UNIT,
592 					&stackleak_start_unit, NULL);
593 
594 	/* Register an extra GCC garbage collector (GGC) root table */
595 	register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL,
596 					(void *)&gt_ggc_r_gt_stackleak);
597 
598 	/*
599 	 * Hook into the Pass Manager to register new gcc passes.
600 	 *
601 	 * The stack frame size info is available only at the last RTL pass,
602 	 * when it's too late to insert complex code like a function call.
603 	 * So we register two gcc passes to instrument every function at first
604 	 * and remove the unneeded instrumentation later.
605 	 */
606 	register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL,
607 					&stackleak_instrument_pass_info);
608 	register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL,
609 					&stackleak_cleanup_pass_info);
610 
611 	return 0;
612 }
613