1 /*
2 * Copyright 2011-2017 by the PaX Team <pageexec@freemail.hu>
3 * Modified by Alexander Popov <alex.popov@linux.com>
4 * Licensed under the GPL v2
5 *
6 * Note: the choice of the license means that the compilation process is
7 * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
8 * but for the kernel it doesn't matter since it doesn't link against
9 * any of the gcc libraries
10 *
11 * This gcc plugin is needed for tracking the lowest border of the kernel stack.
12 * It instruments the kernel code inserting stackleak_track_stack() calls:
13 * - after alloca();
14 * - for the functions with a stack frame size greater than or equal
15 * to the "track-min-size" plugin parameter.
16 *
17 * This plugin is ported from grsecurity/PaX. For more information see:
18 * https://grsecurity.net/
19 * https://pax.grsecurity.net/
20 *
21 * Debugging:
22 * - use fprintf() to stderr, debug_generic_expr(), debug_gimple_stmt(),
23 * print_rtl() and print_simple_rtl();
24 * - add "-fdump-tree-all -fdump-rtl-all" to the plugin CFLAGS in
25 * Makefile.gcc-plugins to see the verbose dumps of the gcc passes;
26 * - use gcc -E to understand the preprocessing shenanigans;
27 * - use gcc with enabled CFG/GIMPLE/SSA verification (--enable-checking).
28 */
29
30 #include "gcc-common.h"
31
32 __visible int plugin_is_GPL_compatible;
33
34 static int track_frame_size = -1;
35 static const char track_function[] = "stackleak_track_stack";
36
37 /*
38 * Mark these global variables (roots) for gcc garbage collector since
39 * they point to the garbage-collected memory.
40 */
41 static GTY(()) tree track_function_decl;
42
43 static struct plugin_info stackleak_plugin_info = {
44 .version = "201707101337",
45 .help = "track-min-size=nn\ttrack stack for functions with a stack frame size >= nn bytes\n"
46 "disable\t\tdo not activate the plugin\n"
47 };
48
49 static void stackleak_add_track_stack(gimple_stmt_iterator *gsi, bool after)
50 {
51 gimple stmt;
52 gcall *stackleak_track_stack;
53 cgraph_node_ptr node;
54 int frequency;
55 basic_block bb;
56
57 /* Insert call to void stackleak_track_stack(void) */
58 stmt = gimple_build_call(track_function_decl, 0);
59 stackleak_track_stack = as_a_gcall(stmt);
60 if (after) {
61 gsi_insert_after(gsi, stackleak_track_stack,
62 GSI_CONTINUE_LINKING);
63 } else {
64 gsi_insert_before(gsi, stackleak_track_stack, GSI_SAME_STMT);
65 }
66
67 /* Update the cgraph */
68 bb = gimple_bb(stackleak_track_stack);
69 node = cgraph_get_create_node(track_function_decl);
70 gcc_assert(node);
71 frequency = compute_call_stmt_bb_frequency(current_function_decl, bb);
72 cgraph_create_edge(cgraph_get_node(current_function_decl), node,
73 stackleak_track_stack, bb->count, frequency);
74 }
75
76 static bool is_alloca(gimple stmt)
77 {
78 if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA))
79 return true;
80
81 #if BUILDING_GCC_VERSION >= 4007
82 if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA_WITH_ALIGN))
83 return true;
84 #endif
85
86 return false;
87 }
88
89 /*
90 * Work with the GIMPLE representation of the code. Insert the
91 * stackleak_track_stack() call after alloca() and into the beginning
92 * of the function if it is not instrumented.
93 */
94 static unsigned int stackleak_instrument_execute(void)
95 {
96 basic_block bb, entry_bb;
97 bool prologue_instrumented = false, is_leaf = true;
98 gimple_stmt_iterator gsi;
99
100 /*
101 * ENTRY_BLOCK_PTR is a basic block which represents possible entry
102 * point of a function. This block does not contain any code and
103 * has a CFG edge to its successor.
104 */
105 gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
106 entry_bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
107
108 /*
109 * Loop through the GIMPLE statements in each of cfun basic blocks.
110 * cfun is a global variable which represents the function that is
111 * currently processed.
112 */
113 FOR_EACH_BB_FN(bb, cfun) {
114 for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
115 gimple stmt;
116
117 stmt = gsi_stmt(gsi);
118
119 /* Leaf function is a function which makes no calls */
120 if (is_gimple_call(stmt))
121 is_leaf = false;
122
123 if (!is_alloca(stmt))
124 continue;
125
126 /* Insert stackleak_track_stack() call after alloca() */
127 stackleak_add_track_stack(&gsi, true);
128 if (bb == entry_bb)
129 prologue_instrumented = true;
130 }
131 }
132
133 if (prologue_instrumented)
134 return 0;
135
136 /*
137 * Special cases to skip the instrumentation.
138 *
139 * Taking the address of static inline functions materializes them,
140 * but we mustn't instrument some of them as the resulting stack
141 * alignment required by the function call ABI will break other
142 * assumptions regarding the expected (but not otherwise enforced)
143 * register clobbering ABI.
144 *
145 * Case in point: native_save_fl on amd64 when optimized for size
146 * clobbers rdx if it were instrumented here.
147 *
148 * TODO: any more special cases?
149 */
150 if (is_leaf &&
151 !TREE_PUBLIC(current_function_decl) &&
152 DECL_DECLARED_INLINE_P(current_function_decl)) {
153 return 0;
154 }
155
156 if (is_leaf &&
157 !strncmp(IDENTIFIER_POINTER(DECL_NAME(current_function_decl)),
158 "_paravirt_", 10)) {
159 return 0;
160 }
161
162 /* Insert stackleak_track_stack() call at the function beginning */
163 bb = entry_bb;
164 if (!single_pred_p(bb)) {
165 /* gcc_assert(bb_loop_depth(bb) ||
166 (bb->flags & BB_IRREDUCIBLE_LOOP)); */
167 split_edge(single_succ_edge(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
168 gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
169 bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
170 }
171 gsi = gsi_after_labels(bb);
172 stackleak_add_track_stack(&gsi, false);
173
174 return 0;
175 }
176
177 static bool large_stack_frame(void)
178 {
179 #if BUILDING_GCC_VERSION >= 8000
180 return maybe_ge(get_frame_size(), track_frame_size);
181 #else
182 return (get_frame_size() >= track_frame_size);
183 #endif
184 }
185
186 /*
187 * Work with the RTL representation of the code.
188 * Remove the unneeded stackleak_track_stack() calls from the functions
189 * which don't call alloca() and don't have a large enough stack frame size.
190 */
191 static unsigned int stackleak_cleanup_execute(void)
192 {
193 rtx_insn *insn, *next;
194
195 if (cfun->calls_alloca)
196 return 0;
197
198 if (large_stack_frame())
199 return 0;
200
201 /*
202 * Find stackleak_track_stack() calls. Loop through the chain of insns,
203 * which is an RTL representation of the code for a function.
204 *
205 * The example of a matching insn:
206 * (call_insn 8 4 10 2 (call (mem (symbol_ref ("stackleak_track_stack")
207 * [flags 0x41] <function_decl 0x7f7cd3302a80 stackleak_track_stack>)
208 * [0 stackleak_track_stack S1 A8]) (0)) 675 {*call} (expr_list
209 * (symbol_ref ("stackleak_track_stack") [flags 0x41] <function_decl
210 * 0x7f7cd3302a80 stackleak_track_stack>) (expr_list (0) (nil))) (nil))
211 */
212 for (insn = get_insns(); insn; insn = next) {
213 rtx body;
214
215 next = NEXT_INSN(insn);
216
217 /* Check the expression code of the insn */
218 if (!CALL_P(insn))
219 continue;
220
221 /*
222 * Check the expression code of the insn body, which is an RTL
223 * Expression (RTX) describing the side effect performed by
224 * that insn.
225 */
226 body = PATTERN(insn);
227
228 if (GET_CODE(body) == PARALLEL)
229 body = XVECEXP(body, 0, 0);
230
231 if (GET_CODE(body) != CALL)
232 continue;
233
234 /*
235 * Check the first operand of the call expression. It should
236 * be a mem RTX describing the needed subroutine with a
237 * symbol_ref RTX.
238 */
239 body = XEXP(body, 0);
240 if (GET_CODE(body) != MEM)
241 continue;
242
243 body = XEXP(body, 0);
244 if (GET_CODE(body) != SYMBOL_REF)
245 continue;
246
247 if (SYMBOL_REF_DECL(body) != track_function_decl)
248 continue;
249
250 /* Delete the stackleak_track_stack() call */
251 delete_insn_and_edges(insn);
252 #if BUILDING_GCC_VERSION >= 4007 && BUILDING_GCC_VERSION < 8000
253 if (GET_CODE(next) == NOTE &&
254 NOTE_KIND(next) == NOTE_INSN_CALL_ARG_LOCATION) {
255 insn = next;
256 next = NEXT_INSN(insn);
257 delete_insn_and_edges(insn);
258 }
259 #endif
260 }
261
262 return 0;
263 }
264
265 static bool stackleak_gate(void)
266 {
267 tree section;
268
269 section = lookup_attribute("section",
270 DECL_ATTRIBUTES(current_function_decl));
271 if (section && TREE_VALUE(section)) {
272 section = TREE_VALUE(TREE_VALUE(section));
273
274 if (!strncmp(TREE_STRING_POINTER(section), ".init.text", 10))
275 return false;
276 if (!strncmp(TREE_STRING_POINTER(section), ".devinit.text", 13))
277 return false;
278 if (!strncmp(TREE_STRING_POINTER(section), ".cpuinit.text", 13))
279 return false;
280 if (!strncmp(TREE_STRING_POINTER(section), ".meminit.text", 13))
281 return false;
282 }
283
284 return track_frame_size >= 0;
285 }
286
287 /* Build the function declaration for stackleak_track_stack() */
288 static void stackleak_start_unit(void *gcc_data __unused,
289 void *user_data __unused)
290 {
291 tree fntype;
292
293 /* void stackleak_track_stack(void) */
294 fntype = build_function_type_list(void_type_node, NULL_TREE);
295 track_function_decl = build_fn_decl(track_function, fntype);
296 DECL_ASSEMBLER_NAME(track_function_decl); /* for LTO */
297 TREE_PUBLIC(track_function_decl) = 1;
298 TREE_USED(track_function_decl) = 1;
299 DECL_EXTERNAL(track_function_decl) = 1;
300 DECL_ARTIFICIAL(track_function_decl) = 1;
301 DECL_PRESERVE_P(track_function_decl) = 1;
302 }
303
304 /*
305 * Pass gate function is a predicate function that gets executed before the
306 * corresponding pass. If the return value is 'true' the pass gets executed,
307 * otherwise, it is skipped.
308 */
309 static bool stackleak_instrument_gate(void)
310 {
311 return stackleak_gate();
312 }
313
314 #define PASS_NAME stackleak_instrument
315 #define PROPERTIES_REQUIRED PROP_gimple_leh | PROP_cfg
316 #define TODO_FLAGS_START TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts
317 #define TODO_FLAGS_FINISH TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func \
318 | TODO_update_ssa | TODO_rebuild_cgraph_edges
319 #include "gcc-generate-gimple-pass.h"
320
321 static bool stackleak_cleanup_gate(void)
322 {
323 return stackleak_gate();
324 }
325
326 #define PASS_NAME stackleak_cleanup
327 #define TODO_FLAGS_FINISH TODO_dump_func
328 #include "gcc-generate-rtl-pass.h"
329
330 /*
331 * Every gcc plugin exports a plugin_init() function that is called right
332 * after the plugin is loaded. This function is responsible for registering
333 * the plugin callbacks and doing other required initialization.
334 */
335 __visible int plugin_init(struct plugin_name_args *plugin_info,
336 struct plugin_gcc_version *version)
337 {
338 const char * const plugin_name = plugin_info->base_name;
339 const int argc = plugin_info->argc;
340 const struct plugin_argument * const argv = plugin_info->argv;
341 int i = 0;
342
343 /* Extra GGC root tables describing our GTY-ed data */
344 static const struct ggc_root_tab gt_ggc_r_gt_stackleak[] = {
345 {
346 .base = &track_function_decl,
347 .nelt = 1,
348 .stride = sizeof(track_function_decl),
349 .cb = >_ggc_mx_tree_node,
350 .pchw = >_pch_nx_tree_node
351 },
352 LAST_GGC_ROOT_TAB
353 };
354
355 /*
356 * The stackleak_instrument pass should be executed before the
357 * "optimized" pass, which is the control flow graph cleanup that is
358 * performed just before expanding gcc trees to the RTL. In former
359 * versions of the plugin this new pass was inserted before the
360 * "tree_profile" pass, which is currently called "profile".
361 */
362 PASS_INFO(stackleak_instrument, "optimized", 1,
363 PASS_POS_INSERT_BEFORE);
364
365 /*
366 * The stackleak_cleanup pass should be executed before the "*free_cfg"
367 * pass. It's the moment when the stack frame size is already final,
368 * function prologues and epilogues are generated, and the
369 * machine-dependent code transformations are not done.
370 */
371 PASS_INFO(stackleak_cleanup, "*free_cfg", 1, PASS_POS_INSERT_BEFORE);
372
373 if (!plugin_default_version_check(version, &gcc_version)) {
374 error(G_("incompatible gcc/plugin versions"));
375 return 1;
376 }
377
378 /* Parse the plugin arguments */
379 for (i = 0; i < argc; i++) {
380 if (!strcmp(argv[i].key, "disable"))
381 return 0;
382
383 if (!strcmp(argv[i].key, "track-min-size")) {
384 if (!argv[i].value) {
385 error(G_("no value supplied for option '-fplugin-arg-%s-%s'"),
386 plugin_name, argv[i].key);
387 return 1;
388 }
389
390 track_frame_size = atoi(argv[i].value);
391 if (track_frame_size < 0) {
392 error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"),
393 plugin_name, argv[i].key, argv[i].value);
394 return 1;
395 }
396 } else {
397 error(G_("unknown option '-fplugin-arg-%s-%s'"),
398 plugin_name, argv[i].key);
399 return 1;
400 }
401 }
402
403 /* Give the information about the plugin */
404 register_callback(plugin_name, PLUGIN_INFO, NULL,
405 &stackleak_plugin_info);
406
407 /* Register to be called before processing a translation unit */
408 register_callback(plugin_name, PLUGIN_START_UNIT,
409 &stackleak_start_unit, NULL);
410
411 /* Register an extra GCC garbage collector (GGC) root table */
412 register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL,
413 (void *)>_ggc_r_gt_stackleak);
414
415 /*
416 * Hook into the Pass Manager to register new gcc passes.
417 *
418 * The stack frame size info is available only at the last RTL pass,
419 * when it's too late to insert complex code like a function call.
420 * So we register two gcc passes to instrument every function at first
421 * and remove the unneeded instrumentation later.
422 */
423 register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL,
424 &stackleak_instrument_pass_info);
425 register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL,
426 &stackleak_cleanup_pass_info);
427
428 return 0;
429 }