1 //===-- safestack.cpp -----------------------------------------------------===//
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
7 //===----------------------------------------------------------------------===//
14 //===----------------------------------------------------------------------===//
55 // protector pass to store the stack guard (see getStackCookieLocation()
59 // For now, store it in a thread-local variable.
68 // relying on the system-enforced ASLR. The protection of the (safe) stack can
71 // 1) Protection via hardware segmentation on x86-32 and some x86-64
87 // stack pointer in several ways (e.g. in longjmp, signal handling, user-level
89 // in other low-level libraries, by either eliminating the escaping/dumping of
91 // encryption/PTR_MANGLE (XOR-ing the dumped stack pointer with another secret
110 // Per-thread unsafe stack information. It's not frequently accessed, so there
111 // it can be kept out of the tcb in normal thread-local variables.
116 inline void *unsafe_stack_alloc(size_t size, size_t guard) {  in unsafe_stack_alloc()  argument
117   SFS_CHECK(size + guard >= size);  in unsafe_stack_alloc()
118   void *addr = Mmap(nullptr, size + guard, PROT_READ | PROT_WRITE,  in unsafe_stack_alloc()
119                     MAP_PRIVATE | MAP_ANON, -1, 0);  in unsafe_stack_alloc()
121   Mprotect(addr, guard, PROT_NONE);  in unsafe_stack_alloc()
122   return (char *)addr + guard;  in unsafe_stack_alloc()
125 inline void unsafe_stack_setup(void *start, size_t size, size_t guard) {  in unsafe_stack_setup()  argument
127   SFS_CHECK((char *)start + guard >= (char *)start);  in unsafe_stack_setup()
129   SFS_CHECK((((size_t)stack_ptr) & (kStackAlign - 1)) == 0);  in unsafe_stack_setup()
134   unsafe_stack_guard = guard;  in unsafe_stack_setup()
140 /// Safe stack per-thread information passed to the thread_start function
155   void *(*start_routine)(void *) = tinfo->start_routine;  in thread_start()
156   void *start_routine_arg = tinfo->start_routine_arg;  in thread_start()
159   unsafe_stack_setup(tinfo->unsafe_stack_start, tinfo->unsafe_stack_size,  in thread_start()
160                      tinfo->unsafe_stack_guard);  in thread_start()
162   // Make sure out thread-specific destructor will be called  in thread_start()
182 /// Thread-specific data destructor. We want to free the unsafe stack only after
183 /// this thread is terminated. libc can call functions in safestack-instrumented
184 /// code (like free) after thread-specific data destructors have run.
203     if (stack->pid != pid ||  in thread_cleanup_handler()
204         (-1 == TgKill(stack->pid, stack->tid, 0) && errno == ESRCH)) {  in thread_cleanup_handler()
205       Munmap(stack->stack_base, stack->size);  in thread_cleanup_handler()
206       *stackp = stack->next;  in thread_cleanup_handler()
209       stackp = &stack->next;  in thread_cleanup_handler()
214   cur_stack->stack_base = (char *)unsafe_stack_start - unsafe_stack_guard;  in thread_cleanup_handler()
215   cur_stack->size = unsafe_stack_size + unsafe_stack_guard;  in thread_cleanup_handler()
216   cur_stack->pid = pid;  in thread_cleanup_handler()
217   cur_stack->tid = tid;  in thread_cleanup_handler()
223   cur_stack->next = temp_stacks;  in thread_cleanup_handler()
238   size_t guard = 0;  in INTERCEPTOR()  local
242     pthread_attr_getguardsize(attr, &guard);  in INTERCEPTOR()
248     pthread_attr_getguardsize(&tmpattr, &guard);  in INTERCEPTOR()
266   void *addr = unsafe_stack_alloc(size, guard);  in INTERCEPTOR()
267   // Put tinfo at the end of the buffer. guard may be not page aligned.  in INTERCEPTOR()
270       (struct tinfo *)(((char *)addr) + size - sizeof(struct tinfo));  in INTERCEPTOR()
271   tinfo->start_routine = start_routine;  in INTERCEPTOR()
272   tinfo->start_routine_arg = arg;  in INTERCEPTOR()
273   tinfo->unsafe_stack_start = addr;  in INTERCEPTOR()
274   tinfo->unsafe_stack_size = size;  in INTERCEPTOR()
275   tinfo->unsafe_stack_guard = guard;  in INTERCEPTOR()
304   size_t guard = 4096;  in __safestack_init()  local
311   void *addr = unsafe_stack_alloc(size, guard);  in __safestack_init()
312   unsafe_stack_setup(addr, size, guard);  in __safestack_init()