1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright 2011-2017 by the PaX Team <pageexec@freemail.hu> 4 * Modified by Alexander Popov <alex.popov@linux.com> 5 * 6 * Note: the choice of the license means that the compilation process is 7 * NOT 'eligible' as defined by gcc's library exception to the GPL v3, 8 * but for the kernel it doesn't matter since it doesn't link against 9 * any of the gcc libraries 10 * 11 * This gcc plugin is needed for tracking the lowest border of the kernel stack. 12 * It instruments the kernel code inserting stackleak_track_stack() calls: 13 * - after alloca(); 14 * - for the functions with a stack frame size greater than or equal 15 * to the "track-min-size" plugin parameter. 16 * 17 * This plugin is ported from grsecurity/PaX. For more information see: 18 * https://grsecurity.net/ 19 * https://pax.grsecurity.net/ 20 * 21 * Debugging: 22 * - use fprintf() to stderr, debug_generic_expr(), debug_gimple_stmt(), 23 * print_rtl_single() and debug_rtx(); 24 * - add "-fdump-tree-all -fdump-rtl-all" to the plugin CFLAGS in 25 * Makefile.gcc-plugins to see the verbose dumps of the gcc passes; 26 * - use gcc -E to understand the preprocessing shenanigans; 27 * - use gcc with enabled CFG/GIMPLE/SSA verification (--enable-checking). 28 */ 29 30 #include "gcc-common.h" 31 32 __visible int plugin_is_GPL_compatible; 33 34 static int track_frame_size = -1; 35 static bool build_for_x86 = false; 36 static const char track_function[] = "stackleak_track_stack"; 37 static bool disable = false; 38 static bool verbose = false; 39 40 /* 41 * Mark these global variables (roots) for gcc garbage collector since 42 * they point to the garbage-collected memory. 43 */ 44 static GTY(()) tree track_function_decl; 45 46 static struct plugin_info stackleak_plugin_info = { 47 .version = PLUGIN_VERSION, 48 .help = "track-min-size=nn\ttrack stack for functions with a stack frame size >= nn bytes\n" 49 "arch=target_arch\tspecify target build arch\n" 50 "disable\t\tdo not activate the plugin\n" 51 "verbose\t\tprint info about the instrumentation\n" 52 }; 53 54 static void add_stack_tracking_gcall(gimple_stmt_iterator *gsi, bool after) 55 { 56 gimple stmt; 57 gcall *gimple_call; 58 cgraph_node_ptr node; 59 basic_block bb; 60 61 /* Insert calling stackleak_track_stack() */ 62 stmt = gimple_build_call(track_function_decl, 0); 63 gimple_call = as_a_gcall(stmt); 64 if (after) 65 gsi_insert_after(gsi, gimple_call, GSI_CONTINUE_LINKING); 66 else 67 gsi_insert_before(gsi, gimple_call, GSI_SAME_STMT); 68 69 /* Update the cgraph */ 70 bb = gimple_bb(gimple_call); 71 node = cgraph_get_create_node(track_function_decl); 72 gcc_assert(node); 73 cgraph_create_edge(cgraph_get_node(current_function_decl), node, 74 gimple_call, bb->count, 75 compute_call_stmt_bb_frequency(current_function_decl, bb)); 76 } 77 78 static bool is_alloca(gimple stmt) 79 { 80 if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA)) 81 return true; 82 83 if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA_WITH_ALIGN)) 84 return true; 85 86 return false; 87 } 88 89 static tree get_current_stack_pointer_decl(void) 90 { 91 varpool_node_ptr node; 92 93 FOR_EACH_VARIABLE(node) { 94 tree var = NODE_DECL(node); 95 tree name = DECL_NAME(var); 96 97 if (DECL_NAME_LENGTH(var) != sizeof("current_stack_pointer") - 1) 98 continue; 99 100 if (strcmp(IDENTIFIER_POINTER(name), "current_stack_pointer")) 101 continue; 102 103 return var; 104 } 105 106 if (verbose) { 107 fprintf(stderr, "stackleak: missing current_stack_pointer in %s()\n", 108 DECL_NAME_POINTER(current_function_decl)); 109 } 110 return NULL_TREE; 111 } 112 113 static void add_stack_tracking_gasm(gimple_stmt_iterator *gsi, bool after) 114 { 115 gasm *asm_call = NULL; 116 tree sp_decl, input; 117 vec<tree, va_gc> *inputs = NULL; 118 119 /* 'no_caller_saved_registers' is currently supported only for x86 */ 120 gcc_assert(build_for_x86); 121 122 /* 123 * Insert calling stackleak_track_stack() in asm: 124 * asm volatile("call stackleak_track_stack" 125 * :: "r" (current_stack_pointer)) 126 * Use ASM_CALL_CONSTRAINT trick from arch/x86/include/asm/asm.h. 127 * This constraint is taken into account during gcc shrink-wrapping 128 * optimization. It is needed to be sure that stackleak_track_stack() 129 * call is inserted after the prologue of the containing function, 130 * when the stack frame is prepared. 131 */ 132 sp_decl = get_current_stack_pointer_decl(); 133 if (sp_decl == NULL_TREE) { 134 add_stack_tracking_gcall(gsi, after); 135 return; 136 } 137 input = build_tree_list(NULL_TREE, build_const_char_string(2, "r")); 138 input = chainon(NULL_TREE, build_tree_list(input, sp_decl)); 139 vec_safe_push(inputs, input); 140 asm_call = gimple_build_asm_vec("call stackleak_track_stack", 141 inputs, NULL, NULL, NULL); 142 gimple_asm_set_volatile(asm_call, true); 143 if (after) 144 gsi_insert_after(gsi, asm_call, GSI_CONTINUE_LINKING); 145 else 146 gsi_insert_before(gsi, asm_call, GSI_SAME_STMT); 147 update_stmt(asm_call); 148 } 149 150 static void add_stack_tracking(gimple_stmt_iterator *gsi, bool after) 151 { 152 /* 153 * The 'no_caller_saved_registers' attribute is used for 154 * stackleak_track_stack(). If the compiler supports this attribute for 155 * the target arch, we can add calling stackleak_track_stack() in asm. 156 * That improves performance: we avoid useless operations with the 157 * caller-saved registers in the functions from which we will remove 158 * stackleak_track_stack() call during the stackleak_cleanup pass. 159 */ 160 if (lookup_attribute_spec(get_identifier("no_caller_saved_registers"))) 161 add_stack_tracking_gasm(gsi, after); 162 else 163 add_stack_tracking_gcall(gsi, after); 164 } 165 166 /* 167 * Work with the GIMPLE representation of the code. Insert the 168 * stackleak_track_stack() call after alloca() and into the beginning 169 * of the function if it is not instrumented. 170 */ 171 static unsigned int stackleak_instrument_execute(void) 172 { 173 basic_block bb, entry_bb; 174 bool prologue_instrumented = false, is_leaf = true; 175 gimple_stmt_iterator gsi = { 0 }; 176 177 /* 178 * ENTRY_BLOCK_PTR is a basic block which represents possible entry 179 * point of a function. This block does not contain any code and 180 * has a CFG edge to its successor. 181 */ 182 gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun))); 183 entry_bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun)); 184 185 /* 186 * Loop through the GIMPLE statements in each of cfun basic blocks. 187 * cfun is a global variable which represents the function that is 188 * currently processed. 189 */ 190 FOR_EACH_BB_FN(bb, cfun) { 191 for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) { 192 gimple stmt; 193 194 stmt = gsi_stmt(gsi); 195 196 /* Leaf function is a function which makes no calls */ 197 if (is_gimple_call(stmt)) 198 is_leaf = false; 199 200 if (!is_alloca(stmt)) 201 continue; 202 203 if (verbose) { 204 fprintf(stderr, "stackleak: be careful, alloca() in %s()\n", 205 DECL_NAME_POINTER(current_function_decl)); 206 } 207 208 /* Insert stackleak_track_stack() call after alloca() */ 209 add_stack_tracking(&gsi, true); 210 if (bb == entry_bb) 211 prologue_instrumented = true; 212 } 213 } 214 215 if (prologue_instrumented) 216 return 0; 217 218 /* 219 * Special cases to skip the instrumentation. 220 * 221 * Taking the address of static inline functions materializes them, 222 * but we mustn't instrument some of them as the resulting stack 223 * alignment required by the function call ABI will break other 224 * assumptions regarding the expected (but not otherwise enforced) 225 * register clobbering ABI. 226 * 227 * Case in point: native_save_fl on amd64 when optimized for size 228 * clobbers rdx if it were instrumented here. 229 * 230 * TODO: any more special cases? 231 */ 232 if (is_leaf && 233 !TREE_PUBLIC(current_function_decl) && 234 DECL_DECLARED_INLINE_P(current_function_decl)) { 235 return 0; 236 } 237 238 if (is_leaf && 239 !strncmp(IDENTIFIER_POINTER(DECL_NAME(current_function_decl)), 240 "_paravirt_", 10)) { 241 return 0; 242 } 243 244 /* Insert stackleak_track_stack() call at the function beginning */ 245 bb = entry_bb; 246 if (!single_pred_p(bb)) { 247 /* gcc_assert(bb_loop_depth(bb) || 248 (bb->flags & BB_IRREDUCIBLE_LOOP)); */ 249 split_edge(single_succ_edge(ENTRY_BLOCK_PTR_FOR_FN(cfun))); 250 gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun))); 251 bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun)); 252 } 253 gsi = gsi_after_labels(bb); 254 add_stack_tracking(&gsi, false); 255 256 return 0; 257 } 258 259 static bool large_stack_frame(void) 260 { 261 #if BUILDING_GCC_VERSION >= 8000 262 return maybe_ge(get_frame_size(), track_frame_size); 263 #else 264 return (get_frame_size() >= track_frame_size); 265 #endif 266 } 267 268 static void remove_stack_tracking_gcall(void) 269 { 270 rtx_insn *insn, *next; 271 272 /* 273 * Find stackleak_track_stack() calls. Loop through the chain of insns, 274 * which is an RTL representation of the code for a function. 275 * 276 * The example of a matching insn: 277 * (call_insn 8 4 10 2 (call (mem (symbol_ref ("stackleak_track_stack") 278 * [flags 0x41] <function_decl 0x7f7cd3302a80 stackleak_track_stack>) 279 * [0 stackleak_track_stack S1 A8]) (0)) 675 {*call} (expr_list 280 * (symbol_ref ("stackleak_track_stack") [flags 0x41] <function_decl 281 * 0x7f7cd3302a80 stackleak_track_stack>) (expr_list (0) (nil))) (nil)) 282 */ 283 for (insn = get_insns(); insn; insn = next) { 284 rtx body; 285 286 next = NEXT_INSN(insn); 287 288 /* Check the expression code of the insn */ 289 if (!CALL_P(insn)) 290 continue; 291 292 /* 293 * Check the expression code of the insn body, which is an RTL 294 * Expression (RTX) describing the side effect performed by 295 * that insn. 296 */ 297 body = PATTERN(insn); 298 299 if (GET_CODE(body) == PARALLEL) 300 body = XVECEXP(body, 0, 0); 301 302 if (GET_CODE(body) != CALL) 303 continue; 304 305 /* 306 * Check the first operand of the call expression. It should 307 * be a mem RTX describing the needed subroutine with a 308 * symbol_ref RTX. 309 */ 310 body = XEXP(body, 0); 311 if (GET_CODE(body) != MEM) 312 continue; 313 314 body = XEXP(body, 0); 315 if (GET_CODE(body) != SYMBOL_REF) 316 continue; 317 318 if (SYMBOL_REF_DECL(body) != track_function_decl) 319 continue; 320 321 /* Delete the stackleak_track_stack() call */ 322 delete_insn_and_edges(insn); 323 #if BUILDING_GCC_VERSION < 8000 324 if (GET_CODE(next) == NOTE && 325 NOTE_KIND(next) == NOTE_INSN_CALL_ARG_LOCATION) { 326 insn = next; 327 next = NEXT_INSN(insn); 328 delete_insn_and_edges(insn); 329 } 330 #endif 331 } 332 } 333 334 static bool remove_stack_tracking_gasm(void) 335 { 336 bool removed = false; 337 rtx_insn *insn, *next; 338 339 /* 'no_caller_saved_registers' is currently supported only for x86 */ 340 gcc_assert(build_for_x86); 341 342 /* 343 * Find stackleak_track_stack() asm calls. Loop through the chain of 344 * insns, which is an RTL representation of the code for a function. 345 * 346 * The example of a matching insn: 347 * (insn 11 5 12 2 (parallel [ (asm_operands/v 348 * ("call stackleak_track_stack") ("") 0 349 * [ (reg/v:DI 7 sp [ current_stack_pointer ]) ] 350 * [ (asm_input:DI ("r")) ] []) 351 * (clobber (reg:CC 17 flags)) ]) -1 (nil)) 352 */ 353 for (insn = get_insns(); insn; insn = next) { 354 rtx body; 355 356 next = NEXT_INSN(insn); 357 358 /* Check the expression code of the insn */ 359 if (!NONJUMP_INSN_P(insn)) 360 continue; 361 362 /* 363 * Check the expression code of the insn body, which is an RTL 364 * Expression (RTX) describing the side effect performed by 365 * that insn. 366 */ 367 body = PATTERN(insn); 368 369 if (GET_CODE(body) != PARALLEL) 370 continue; 371 372 body = XVECEXP(body, 0, 0); 373 374 if (GET_CODE(body) != ASM_OPERANDS) 375 continue; 376 377 if (strcmp(ASM_OPERANDS_TEMPLATE(body), 378 "call stackleak_track_stack")) { 379 continue; 380 } 381 382 delete_insn_and_edges(insn); 383 gcc_assert(!removed); 384 removed = true; 385 } 386 387 return removed; 388 } 389 390 /* 391 * Work with the RTL representation of the code. 392 * Remove the unneeded stackleak_track_stack() calls from the functions 393 * which don't call alloca() and don't have a large enough stack frame size. 394 */ 395 static unsigned int stackleak_cleanup_execute(void) 396 { 397 const char *fn = DECL_NAME_POINTER(current_function_decl); 398 bool removed = false; 399 400 /* 401 * Leave stack tracking in functions that call alloca(). 402 * Additional case: 403 * gcc before version 7 called allocate_dynamic_stack_space() from 404 * expand_stack_vars() for runtime alignment of constant-sized stack 405 * variables. That caused cfun->calls_alloca to be set for functions 406 * that in fact don't use alloca(). 407 * For more info see gcc commit 7072df0aae0c59ae437e. 408 * Let's leave such functions instrumented as well. 409 */ 410 if (cfun->calls_alloca) { 411 if (verbose) 412 fprintf(stderr, "stackleak: instrument %s(): calls_alloca\n", fn); 413 return 0; 414 } 415 416 /* Leave stack tracking in functions with large stack frame */ 417 if (large_stack_frame()) { 418 if (verbose) 419 fprintf(stderr, "stackleak: instrument %s()\n", fn); 420 return 0; 421 } 422 423 if (lookup_attribute_spec(get_identifier("no_caller_saved_registers"))) 424 removed = remove_stack_tracking_gasm(); 425 426 if (!removed) 427 remove_stack_tracking_gcall(); 428 429 return 0; 430 } 431 432 /* 433 * STRING_CST may or may not be NUL terminated: 434 * https://gcc.gnu.org/onlinedocs/gccint/Constant-expressions.html 435 */ 436 static inline bool string_equal(tree node, const char *string, int length) 437 { 438 if (TREE_STRING_LENGTH(node) < length) 439 return false; 440 if (TREE_STRING_LENGTH(node) > length + 1) 441 return false; 442 if (TREE_STRING_LENGTH(node) == length + 1 && 443 TREE_STRING_POINTER(node)[length] != '\0') 444 return false; 445 return !memcmp(TREE_STRING_POINTER(node), string, length); 446 } 447 #define STRING_EQUAL(node, str) string_equal(node, str, strlen(str)) 448 449 static bool stackleak_gate(void) 450 { 451 tree section; 452 453 section = lookup_attribute("section", 454 DECL_ATTRIBUTES(current_function_decl)); 455 if (section && TREE_VALUE(section)) { 456 section = TREE_VALUE(TREE_VALUE(section)); 457 458 if (STRING_EQUAL(section, ".init.text")) 459 return false; 460 if (STRING_EQUAL(section, ".devinit.text")) 461 return false; 462 if (STRING_EQUAL(section, ".cpuinit.text")) 463 return false; 464 if (STRING_EQUAL(section, ".meminit.text")) 465 return false; 466 if (STRING_EQUAL(section, ".noinstr.text")) 467 return false; 468 if (STRING_EQUAL(section, ".entry.text")) 469 return false; 470 } 471 472 return track_frame_size >= 0; 473 } 474 475 /* Build the function declaration for stackleak_track_stack() */ 476 static void stackleak_start_unit(void *gcc_data __unused, 477 void *user_data __unused) 478 { 479 tree fntype; 480 481 /* void stackleak_track_stack(void) */ 482 fntype = build_function_type_list(void_type_node, NULL_TREE); 483 track_function_decl = build_fn_decl(track_function, fntype); 484 DECL_ASSEMBLER_NAME(track_function_decl); /* for LTO */ 485 TREE_PUBLIC(track_function_decl) = 1; 486 TREE_USED(track_function_decl) = 1; 487 DECL_EXTERNAL(track_function_decl) = 1; 488 DECL_ARTIFICIAL(track_function_decl) = 1; 489 DECL_PRESERVE_P(track_function_decl) = 1; 490 } 491 492 /* 493 * Pass gate function is a predicate function that gets executed before the 494 * corresponding pass. If the return value is 'true' the pass gets executed, 495 * otherwise, it is skipped. 496 */ 497 static bool stackleak_instrument_gate(void) 498 { 499 return stackleak_gate(); 500 } 501 502 #define PASS_NAME stackleak_instrument 503 #define PROPERTIES_REQUIRED PROP_gimple_leh | PROP_cfg 504 #define TODO_FLAGS_START TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts 505 #define TODO_FLAGS_FINISH TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func \ 506 | TODO_update_ssa | TODO_rebuild_cgraph_edges 507 #include "gcc-generate-gimple-pass.h" 508 509 static bool stackleak_cleanup_gate(void) 510 { 511 return stackleak_gate(); 512 } 513 514 #define PASS_NAME stackleak_cleanup 515 #define TODO_FLAGS_FINISH TODO_dump_func 516 #include "gcc-generate-rtl-pass.h" 517 518 /* 519 * Every gcc plugin exports a plugin_init() function that is called right 520 * after the plugin is loaded. This function is responsible for registering 521 * the plugin callbacks and doing other required initialization. 522 */ 523 __visible int plugin_init(struct plugin_name_args *plugin_info, 524 struct plugin_gcc_version *version) 525 { 526 const char * const plugin_name = plugin_info->base_name; 527 const int argc = plugin_info->argc; 528 const struct plugin_argument * const argv = plugin_info->argv; 529 int i = 0; 530 531 /* Extra GGC root tables describing our GTY-ed data */ 532 static const struct ggc_root_tab gt_ggc_r_gt_stackleak[] = { 533 { 534 .base = &track_function_decl, 535 .nelt = 1, 536 .stride = sizeof(track_function_decl), 537 .cb = >_ggc_mx_tree_node, 538 .pchw = >_pch_nx_tree_node 539 }, 540 LAST_GGC_ROOT_TAB 541 }; 542 543 /* 544 * The stackleak_instrument pass should be executed before the 545 * "optimized" pass, which is the control flow graph cleanup that is 546 * performed just before expanding gcc trees to the RTL. In former 547 * versions of the plugin this new pass was inserted before the 548 * "tree_profile" pass, which is currently called "profile". 549 */ 550 PASS_INFO(stackleak_instrument, "optimized", 1, 551 PASS_POS_INSERT_BEFORE); 552 553 /* 554 * The stackleak_cleanup pass should be executed before the "*free_cfg" 555 * pass. It's the moment when the stack frame size is already final, 556 * function prologues and epilogues are generated, and the 557 * machine-dependent code transformations are not done. 558 */ 559 PASS_INFO(stackleak_cleanup, "*free_cfg", 1, PASS_POS_INSERT_BEFORE); 560 561 if (!plugin_default_version_check(version, &gcc_version)) { 562 error(G_("incompatible gcc/plugin versions")); 563 return 1; 564 } 565 566 /* Parse the plugin arguments */ 567 for (i = 0; i < argc; i++) { 568 if (!strcmp(argv[i].key, "track-min-size")) { 569 if (!argv[i].value) { 570 error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), 571 plugin_name, argv[i].key); 572 return 1; 573 } 574 575 track_frame_size = atoi(argv[i].value); 576 if (track_frame_size < 0) { 577 error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), 578 plugin_name, argv[i].key, argv[i].value); 579 return 1; 580 } 581 } else if (!strcmp(argv[i].key, "arch")) { 582 if (!argv[i].value) { 583 error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), 584 plugin_name, argv[i].key); 585 return 1; 586 } 587 588 if (!strcmp(argv[i].value, "x86")) 589 build_for_x86 = true; 590 } else if (!strcmp(argv[i].key, "disable")) { 591 disable = true; 592 } else if (!strcmp(argv[i].key, "verbose")) { 593 verbose = true; 594 } else { 595 error(G_("unknown option '-fplugin-arg-%s-%s'"), 596 plugin_name, argv[i].key); 597 return 1; 598 } 599 } 600 601 if (disable) { 602 if (verbose) 603 fprintf(stderr, "stackleak: disabled for this translation unit\n"); 604 return 0; 605 } 606 607 /* Give the information about the plugin */ 608 register_callback(plugin_name, PLUGIN_INFO, NULL, 609 &stackleak_plugin_info); 610 611 /* Register to be called before processing a translation unit */ 612 register_callback(plugin_name, PLUGIN_START_UNIT, 613 &stackleak_start_unit, NULL); 614 615 /* Register an extra GCC garbage collector (GGC) root table */ 616 register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL, 617 (void *)>_ggc_r_gt_stackleak); 618 619 /* 620 * Hook into the Pass Manager to register new gcc passes. 621 * 622 * The stack frame size info is available only at the last RTL pass, 623 * when it's too late to insert complex code like a function call. 624 * So we register two gcc passes to instrument every function at first 625 * and remove the unneeded instrumentation later. 626 */ 627 register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, 628 &stackleak_instrument_pass_info); 629 register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, 630 &stackleak_cleanup_pass_info); 631 632 return 0; 633 } 634