1 //===- StackProtector.cpp - Stack Protector Insertion ---------------------===//
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
7 //===----------------------------------------------------------------------===//
9 // This pass inserts stack protectors into functions which need them. A variable
10 // with a random value in it is stored onto the stack before the local variables
11 // are allocated. Upon exiting the block, the stored value is checked. If it's
12 // changed, then there was some sort of violation and the program aborts.
14 //===----------------------------------------------------------------------===//
16 #include "llvm/CodeGen/StackProtector.h"
17 #include "llvm/ADT/SmallPtrSet.h"
18 #include "llvm/ADT/Statistic.h"
19 #include "llvm/Analysis/BranchProbabilityInfo.h"
20 #include "llvm/Analysis/CaptureTracking.h"
21 #include "llvm/Analysis/EHPersonalities.h"
22 #include "llvm/Analysis/OptimizationRemarkEmitter.h"
23 #include "llvm/CodeGen/Passes.h"
24 #include "llvm/CodeGen/TargetLowering.h"
25 #include "llvm/CodeGen/TargetPassConfig.h"
26 #include "llvm/CodeGen/TargetSubtargetInfo.h"
27 #include "llvm/IR/Attributes.h"
28 #include "llvm/IR/BasicBlock.h"
29 #include "llvm/IR/Constants.h"
30 #include "llvm/IR/DataLayout.h"
31 #include "llvm/IR/DebugInfo.h"
32 #include "llvm/IR/DebugLoc.h"
33 #include "llvm/IR/DerivedTypes.h"
34 #include "llvm/IR/Dominators.h"
35 #include "llvm/IR/Function.h"
36 #include "llvm/IR/IRBuilder.h"
37 #include "llvm/IR/Instruction.h"
38 #include "llvm/IR/Instructions.h"
39 #include "llvm/IR/IntrinsicInst.h"
40 #include "llvm/IR/Intrinsics.h"
41 #include "llvm/IR/MDBuilder.h"
42 #include "llvm/IR/Module.h"
43 #include "llvm/IR/Type.h"
44 #include "llvm/IR/User.h"
45 #include "llvm/Pass.h"
46 #include "llvm/Support/Casting.h"
47 #include "llvm/Support/CommandLine.h"
48 #include "llvm/Target/TargetMachine.h"
49 #include "llvm/Target/TargetOptions.h"
54 #define DEBUG_TYPE "stack-protector"
56 STATISTIC(NumFunProtected
, "Number of functions protected");
57 STATISTIC(NumAddrTaken
, "Number of local variables that have their address"
60 static cl::opt
<bool> EnableSelectionDAGSP("enable-selectiondag-sp",
61 cl::init(true), cl::Hidden
);
63 char StackProtector::ID
= 0;
65 INITIALIZE_PASS_BEGIN(StackProtector
, DEBUG_TYPE
,
66 "Insert stack protectors", false, true)
67 INITIALIZE_PASS_DEPENDENCY(TargetPassConfig
)
68 INITIALIZE_PASS_END(StackProtector
, DEBUG_TYPE
,
69 "Insert stack protectors", false, true)
71 FunctionPass
*llvm::createStackProtectorPass() { return new StackProtector(); }
73 void StackProtector::getAnalysisUsage(AnalysisUsage
&AU
) const {
74 AU
.addRequired
<TargetPassConfig
>();
75 AU
.addPreserved
<DominatorTreeWrapperPass
>();
78 bool StackProtector::runOnFunction(Function
&Fn
) {
81 DominatorTreeWrapperPass
*DTWP
=
82 getAnalysisIfAvailable
<DominatorTreeWrapperPass
>();
83 DT
= DTWP
? &DTWP
->getDomTree() : nullptr;
84 TM
= &getAnalysis
<TargetPassConfig
>().getTM
<TargetMachine
>();
85 Trip
= TM
->getTargetTriple();
86 TLI
= TM
->getSubtargetImpl(Fn
)->getTargetLowering();
90 Attribute Attr
= Fn
.getFnAttribute("stack-protector-buffer-size");
91 if (Attr
.isStringAttribute() &&
92 Attr
.getValueAsString().getAsInteger(10, SSPBufferSize
))
93 return false; // Invalid integer string
95 if (!RequiresStackProtector())
98 // TODO(etienneb): Functions with funclets are not correctly supported now.
99 // Do nothing if this is funclet-based personality.
100 if (Fn
.hasPersonalityFn()) {
101 EHPersonality Personality
= classifyEHPersonality(Fn
.getPersonalityFn());
102 if (isFuncletEHPersonality(Personality
))
107 return InsertStackProtectors();
110 /// \param [out] IsLarge is set to true if a protectable array is found and
111 /// it is "large" ( >= ssp-buffer-size). In the case of a structure with
112 /// multiple arrays, this gets set if any of them is large.
113 bool StackProtector::ContainsProtectableArray(Type
*Ty
, bool &IsLarge
,
115 bool InStruct
) const {
118 if (ArrayType
*AT
= dyn_cast
<ArrayType
>(Ty
)) {
119 if (!AT
->getElementType()->isIntegerTy(8)) {
120 // If we're on a non-Darwin platform or we're inside of a structure, don't
121 // add stack protectors unless the array is a character array.
122 // However, in strong mode any array, regardless of type and size,
123 // triggers a protector.
124 if (!Strong
&& (InStruct
|| !Trip
.isOSDarwin()))
128 // If an array has more than SSPBufferSize bytes of allocated space, then we
129 // emit stack protectors.
130 if (SSPBufferSize
<= M
->getDataLayout().getTypeAllocSize(AT
)) {
136 // Require a protector for all arrays in strong mode
140 const StructType
*ST
= dyn_cast
<StructType
>(Ty
);
144 bool NeedsProtector
= false;
145 for (StructType::element_iterator I
= ST
->element_begin(),
146 E
= ST
->element_end();
148 if (ContainsProtectableArray(*I
, IsLarge
, Strong
, true)) {
149 // If the element is a protectable array and is large (>= SSPBufferSize)
150 // then we are done. If the protectable array is not large, then
151 // keep looking in case a subsequent element is a large array.
154 NeedsProtector
= true;
157 return NeedsProtector
;
160 /// Search for the first call to the llvm.stackprotector intrinsic and return it
162 static const CallInst
*findStackProtectorIntrinsic(Function
&F
) {
163 for (const BasicBlock
&BB
: F
)
164 for (const Instruction
&I
: BB
)
165 if (const CallInst
*CI
= dyn_cast
<CallInst
>(&I
))
166 if (CI
->getCalledFunction() ==
167 Intrinsic::getDeclaration(F
.getParent(), Intrinsic::stackprotector
))
172 /// Check whether or not this function needs a stack protector based
173 /// upon the stack protector level.
175 /// We use two heuristics: a standard (ssp) and strong (sspstrong).
176 /// The standard heuristic which will add a guard variable to functions that
177 /// call alloca with a either a variable size or a size >= SSPBufferSize,
178 /// functions with character buffers larger than SSPBufferSize, and functions
179 /// with aggregates containing character buffers larger than SSPBufferSize. The
180 /// strong heuristic will add a guard variables to functions that call alloca
181 /// regardless of size, functions with any buffer regardless of type and size,
182 /// functions with aggregates that contain any buffer regardless of type and
183 /// size, and functions that contain stack-based variables that have had their
185 bool StackProtector::RequiresStackProtector() {
187 bool NeedsProtector
= false;
188 HasPrologue
= findStackProtectorIntrinsic(*F
);
190 if (F
->hasFnAttribute(Attribute::SafeStack
))
193 // We are constructing the OptimizationRemarkEmitter on the fly rather than
194 // using the analysis pass to avoid building DominatorTree and LoopInfo which
195 // are not available this late in the IR pipeline.
196 OptimizationRemarkEmitter
ORE(F
);
198 if (F
->hasFnAttribute(Attribute::StackProtectReq
)) {
200 return OptimizationRemark(DEBUG_TYPE
, "StackProtectorRequested", F
)
201 << "Stack protection applied to function "
202 << ore::NV("Function", F
)
203 << " due to a function attribute or command-line switch";
205 NeedsProtector
= true;
206 Strong
= true; // Use the same heuristic as strong to determine SSPLayout
207 } else if (F
->hasFnAttribute(Attribute::StackProtectStrong
))
209 else if (HasPrologue
)
210 NeedsProtector
= true;
211 else if (!F
->hasFnAttribute(Attribute::StackProtect
))
214 for (const BasicBlock
&BB
: *F
) {
215 for (const Instruction
&I
: BB
) {
216 if (const AllocaInst
*AI
= dyn_cast
<AllocaInst
>(&I
)) {
217 if (AI
->isArrayAllocation()) {
218 auto RemarkBuilder
= [&]() {
219 return OptimizationRemark(DEBUG_TYPE
, "StackProtectorAllocaOrArray",
221 << "Stack protection applied to function "
222 << ore::NV("Function", F
)
223 << " due to a call to alloca or use of a variable length "
226 if (const auto *CI
= dyn_cast
<ConstantInt
>(AI
->getArraySize())) {
227 if (CI
->getLimitedValue(SSPBufferSize
) >= SSPBufferSize
) {
228 // A call to alloca with size >= SSPBufferSize requires
230 Layout
.insert(std::make_pair(AI
,
231 MachineFrameInfo::SSPLK_LargeArray
));
232 ORE
.emit(RemarkBuilder
);
233 NeedsProtector
= true;
235 // Require protectors for all alloca calls in strong mode.
236 Layout
.insert(std::make_pair(AI
,
237 MachineFrameInfo::SSPLK_SmallArray
));
238 ORE
.emit(RemarkBuilder
);
239 NeedsProtector
= true;
242 // A call to alloca with a variable size requires protectors.
243 Layout
.insert(std::make_pair(AI
,
244 MachineFrameInfo::SSPLK_LargeArray
));
245 ORE
.emit(RemarkBuilder
);
246 NeedsProtector
= true;
251 bool IsLarge
= false;
252 if (ContainsProtectableArray(AI
->getAllocatedType(), IsLarge
, Strong
)) {
253 Layout
.insert(std::make_pair(AI
, IsLarge
254 ? MachineFrameInfo::SSPLK_LargeArray
255 : MachineFrameInfo::SSPLK_SmallArray
));
257 return OptimizationRemark(DEBUG_TYPE
, "StackProtectorBuffer", &I
)
258 << "Stack protection applied to function "
259 << ore::NV("Function", F
)
260 << " due to a stack allocated buffer or struct containing a "
263 NeedsProtector
= true;
267 if (Strong
&& PointerMayBeCaptured(AI
,
268 /* ReturnCaptures */ false,
269 /* StoreCaptures */ true)) {
271 Layout
.insert(std::make_pair(AI
, MachineFrameInfo::SSPLK_AddrOf
));
273 return OptimizationRemark(DEBUG_TYPE
, "StackProtectorAddressTaken",
275 << "Stack protection applied to function "
276 << ore::NV("Function", F
)
277 << " due to the address of a local variable being taken";
279 NeedsProtector
= true;
285 return NeedsProtector
;
288 /// Create a stack guard loading and populate whether SelectionDAG SSP is
290 static Value
*getStackGuard(const TargetLoweringBase
*TLI
, Module
*M
,
292 bool *SupportsSelectionDAGSP
= nullptr) {
293 if (Value
*Guard
= TLI
->getIRStackGuard(B
))
294 return B
.CreateLoad(B
.getInt8PtrTy(), Guard
, true, "StackGuard");
296 // Use SelectionDAG SSP handling, since there isn't an IR guard.
298 // This is more or less weird, since we optionally output whether we
299 // should perform a SelectionDAG SP here. The reason is that it's strictly
300 // defined as !TLI->getIRStackGuard(B), where getIRStackGuard is also
301 // mutating. There is no way to get this bit without mutating the IR, so
302 // getting this bit has to happen in this right time.
304 // We could have define a new function TLI::supportsSelectionDAGSP(), but that
305 // will put more burden on the backends' overriding work, especially when it
306 // actually conveys the same information getIRStackGuard() already gives.
307 if (SupportsSelectionDAGSP
)
308 *SupportsSelectionDAGSP
= true;
309 TLI
->insertSSPDeclarations(*M
);
310 return B
.CreateCall(Intrinsic::getDeclaration(M
, Intrinsic::stackguard
));
313 /// Insert code into the entry block that stores the stack guard
314 /// variable onto the stack:
317 /// StackGuardSlot = alloca i8*
318 /// StackGuard = <stack guard>
319 /// call void @llvm.stackprotector(StackGuard, StackGuardSlot)
321 /// Returns true if the platform/triple supports the stackprotectorcreate pseudo
323 static bool CreatePrologue(Function
*F
, Module
*M
, ReturnInst
*RI
,
324 const TargetLoweringBase
*TLI
, AllocaInst
*&AI
) {
325 bool SupportsSelectionDAGSP
= false;
326 IRBuilder
<> B(&F
->getEntryBlock().front());
327 PointerType
*PtrTy
= Type::getInt8PtrTy(RI
->getContext());
328 AI
= B
.CreateAlloca(PtrTy
, nullptr, "StackGuardSlot");
330 Value
*GuardSlot
= getStackGuard(TLI
, M
, B
, &SupportsSelectionDAGSP
);
331 B
.CreateCall(Intrinsic::getDeclaration(M
, Intrinsic::stackprotector
),
333 return SupportsSelectionDAGSP
;
336 /// InsertStackProtectors - Insert code into the prologue and epilogue of the
339 /// - The prologue code loads and stores the stack guard onto the stack.
340 /// - The epilogue checks the value stored in the prologue against the original
341 /// value. It calls __stack_chk_fail if they differ.
342 bool StackProtector::InsertStackProtectors() {
343 // If the target wants to XOR the frame pointer into the guard value, it's
344 // impossible to emit the check in IR, so the target *must* support stack
345 // protection in SDAG.
346 bool SupportsSelectionDAGSP
=
347 TLI
->useStackGuardXorFP() ||
348 (EnableSelectionDAGSP
&& !TM
->Options
.EnableFastISel
&&
349 !TM
->Options
.EnableGlobalISel
);
350 AllocaInst
*AI
= nullptr; // Place on stack that stores the stack guard.
352 for (Function::iterator I
= F
->begin(), E
= F
->end(); I
!= E
;) {
353 BasicBlock
*BB
= &*I
++;
354 ReturnInst
*RI
= dyn_cast
<ReturnInst
>(BB
->getTerminator());
358 // Generate prologue instrumentation if not already generated.
361 SupportsSelectionDAGSP
&= CreatePrologue(F
, M
, RI
, TLI
, AI
);
364 // SelectionDAG based code generation. Nothing else needs to be done here.
365 // The epilogue instrumentation is postponed to SelectionDAG.
366 if (SupportsSelectionDAGSP
)
369 // Find the stack guard slot if the prologue was not created by this pass
370 // itself via a previous call to CreatePrologue().
372 const CallInst
*SPCall
= findStackProtectorIntrinsic(*F
);
373 assert(SPCall
&& "Call to llvm.stackprotector is missing");
374 AI
= cast
<AllocaInst
>(SPCall
->getArgOperand(1));
377 // Set HasIRCheck to true, so that SelectionDAG will not generate its own
378 // version. SelectionDAG called 'shouldEmitSDCheck' to check whether
379 // instrumentation has already been generated.
382 // Generate epilogue instrumentation. The epilogue intrumentation can be
383 // function-based or inlined depending on which mechanism the target is
385 if (Function
*GuardCheck
= TLI
->getSSPStackGuardCheck(*M
)) {
386 // Generate the function-based epilogue instrumentation.
387 // The target provides a guard check function, generate a call to it.
389 LoadInst
*Guard
= B
.CreateLoad(B
.getInt8PtrTy(), AI
, true, "Guard");
390 CallInst
*Call
= B
.CreateCall(GuardCheck
, {Guard
});
391 Call
->setAttributes(GuardCheck
->getAttributes());
392 Call
->setCallingConv(GuardCheck
->getCallingConv());
394 // Generate the epilogue with inline instrumentation.
395 // If we do not support SelectionDAG based tail calls, generate IR level
398 // For each block with a return instruction, convert this:
408 // %1 = <stack guard>
409 // %2 = load StackGuardSlot
410 // %3 = cmp i1 %1, %2
411 // br i1 %3, label %SP_return, label %CallStackCheckFailBlk
416 // CallStackCheckFailBlk:
417 // call void @__stack_chk_fail()
420 // Create the FailBB. We duplicate the BB every time since the MI tail
421 // merge pass will merge together all of the various BB into one including
422 // fail BB generated by the stack protector pseudo instruction.
423 BasicBlock
*FailBB
= CreateFailBB();
425 // Split the basic block before the return instruction.
426 BasicBlock
*NewBB
= BB
->splitBasicBlock(RI
->getIterator(), "SP_return");
428 // Update the dominator tree if we need to.
429 if (DT
&& DT
->isReachableFromEntry(BB
)) {
430 DT
->addNewBlock(NewBB
, BB
);
431 DT
->addNewBlock(FailBB
, BB
);
434 // Remove default branch instruction to the new BB.
435 BB
->getTerminator()->eraseFromParent();
437 // Move the newly created basic block to the point right after the old
438 // basic block so that it's in the "fall through" position.
439 NewBB
->moveAfter(BB
);
441 // Generate the stack protector instructions in the old basic block.
443 Value
*Guard
= getStackGuard(TLI
, M
, B
);
444 LoadInst
*LI2
= B
.CreateLoad(B
.getInt8PtrTy(), AI
, true);
445 Value
*Cmp
= B
.CreateICmpEQ(Guard
, LI2
);
447 BranchProbabilityInfo::getBranchProbStackProtector(true);
449 BranchProbabilityInfo::getBranchProbStackProtector(false);
450 MDNode
*Weights
= MDBuilder(F
->getContext())
451 .createBranchWeights(SuccessProb
.getNumerator(),
452 FailureProb
.getNumerator());
453 B
.CreateCondBr(Cmp
, NewBB
, FailBB
, Weights
);
457 // Return if we didn't modify any basic blocks. i.e., there are no return
458 // statements in the function.
462 /// CreateFailBB - Create a basic block to jump to when the stack protector
464 BasicBlock
*StackProtector::CreateFailBB() {
465 LLVMContext
&Context
= F
->getContext();
466 BasicBlock
*FailBB
= BasicBlock::Create(Context
, "CallStackCheckFailBlk", F
);
467 IRBuilder
<> B(FailBB
);
468 B
.SetCurrentDebugLocation(DebugLoc::get(0, 0, F
->getSubprogram()));
469 if (Trip
.isOSOpenBSD()) {
470 FunctionCallee StackChkFail
= M
->getOrInsertFunction(
471 "__stack_smash_handler", Type::getVoidTy(Context
),
472 Type::getInt8PtrTy(Context
));
474 B
.CreateCall(StackChkFail
, B
.CreateGlobalStringPtr(F
->getName(), "SSH"));
476 FunctionCallee StackChkFail
=
477 M
->getOrInsertFunction("__stack_chk_fail", Type::getVoidTy(Context
));
479 B
.CreateCall(StackChkFail
, {});
481 B
.CreateUnreachable();
485 bool StackProtector::shouldEmitSDCheck(const BasicBlock
&BB
) const {
486 return HasPrologue
&& !HasIRCheck
&& isa
<ReturnInst
>(BB
.getTerminator());
489 void StackProtector::copyToMachineFrameInfo(MachineFrameInfo
&MFI
) const {
493 for (int I
= 0, E
= MFI
.getObjectIndexEnd(); I
!= E
; ++I
) {
494 if (MFI
.isDeadObjectIndex(I
))
497 const AllocaInst
*AI
= MFI
.getObjectAllocation(I
);
501 SSPLayoutMap::const_iterator LI
= Layout
.find(AI
);
502 if (LI
== Layout
.end())
505 MFI
.setObjectSSPLayout(I
, LI
->second
);