1//===-- safestack.cc ------------------------------------------------------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file implements the runtime support for the safe stack protection 11// mechanism. The runtime manages allocation/deallocation of the unsafe stack 12// for the main thread, as well as all pthreads that are created/destroyed 13// during program execution. 14// 15//===----------------------------------------------------------------------===// 16 17#include <errno.h> 18#include <limits.h> 19#include <pthread.h> 20#include <stddef.h> 21#include <stdint.h> 22#include <unistd.h> 23#include <stdlib.h> 24#include <sys/resource.h> 25#include <sys/types.h> 26#if !defined(__NetBSD__) 27#include <sys/user.h> 28#endif 29 30#include "interception/interception.h" 31#include "sanitizer_common/sanitizer_common.h" 32 33// TODO: The runtime library does not currently protect the safe stack beyond 34// relying on the system-enforced ASLR. The protection of the (safe) stack can 35// be provided by three alternative features: 36// 37// 1) Protection via hardware segmentation on x86-32 and some x86-64 38// architectures: the (safe) stack segment (implicitly accessed via the %ss 39// segment register) can be separated from the data segment (implicitly 40// accessed via the %ds segment register). Dereferencing a pointer to the safe 41// segment would result in a segmentation fault. 42// 43// 2) Protection via software fault isolation: memory writes that are not meant 44// to access the safe stack can be prevented from doing so through runtime 45// instrumentation. One way to do it is to allocate the safe stack(s) in the 46// upper half of the userspace and bitmask the corresponding upper bit of the 47// memory addresses of memory writes that are not meant to access the safe 48// stack. 49// 50// 3) Protection via information hiding on 64 bit architectures: the location 51// of the safe stack(s) can be randomized through secure mechanisms, and the 52// leakage of the stack pointer can be prevented. Currently, libc can leak the 53// stack pointer in several ways (e.g. in longjmp, signal handling, user-level 54// context switching related functions, etc.). These can be fixed in libc and 55// in other low-level libraries, by either eliminating the escaping/dumping of 56// the stack pointer (i.e., %rsp) when that's possible, or by using 57// encryption/PTR_MANGLE (XOR-ing the dumped stack pointer with another secret 58// we control and protect better, as is already done for setjmp in glibc.) 59// Furthermore, a static machine code level verifier can be ran after code 60// generation to make sure that the stack pointer is never written to memory, 61// or if it is, its written on the safe stack. 62// 63// Finally, while the Unsafe Stack pointer is currently stored in a thread 64// local variable, with libc support it could be stored in the TCB (thread 65// control block) as well, eliminating another level of indirection and making 66// such accesses faster. Alternatively, dedicating a separate register for 67// storing it would also be possible. 68 69/// Minimum stack alignment for the unsafe stack. 70const unsigned kStackAlign = 16; 71 72/// Default size of the unsafe stack. This value is only used if the stack 73/// size rlimit is set to infinity. 74const unsigned kDefaultUnsafeStackSize = 0x2800000; 75 76/// Runtime page size obtained through sysconf 77static unsigned pageSize; 78 79// TODO: To make accessing the unsafe stack pointer faster, we plan to 80// eventually store it directly in the thread control block data structure on 81// platforms where this structure is pointed to by %fs or %gs. This is exactly 82// the same mechanism as currently being used by the traditional stack 83// protector pass to store the stack guard (see getStackCookieLocation() 84// function above). Doing so requires changing the tcbhead_t struct in glibc 85// on Linux and tcb struct in libc on FreeBSD. 86// 87// For now, store it in a thread-local variable. 88extern "C" { 89__attribute__((visibility( 90 "default"))) __thread void *__safestack_unsafe_stack_ptr = nullptr; 91} 92 93// Per-thread unsafe stack information. It's not frequently accessed, so there 94// it can be kept out of the tcb in normal thread-local variables. 95static __thread void *unsafe_stack_start = nullptr; 96static __thread size_t unsafe_stack_size = 0; 97static __thread size_t unsafe_stack_guard = 0; 98 99using namespace __sanitizer; 100 101static inline void *unsafe_stack_alloc(size_t size, size_t guard) { 102 CHECK_GE(size + guard, size); 103 void *addr = MmapOrDie(size + guard, "unsafe_stack_alloc"); 104 MprotectNoAccess((uptr)addr, (uptr)guard); 105 return (char *)addr + guard; 106} 107 108static inline void unsafe_stack_setup(void *start, size_t size, size_t guard) { 109 CHECK_GE((char *)start + size, (char *)start); 110 CHECK_GE((char *)start + guard, (char *)start); 111 void *stack_ptr = (char *)start + size; 112 CHECK_EQ((((size_t)stack_ptr) & (kStackAlign - 1)), 0); 113 114 __safestack_unsafe_stack_ptr = stack_ptr; 115 unsafe_stack_start = start; 116 unsafe_stack_size = size; 117 unsafe_stack_guard = guard; 118} 119 120/// Thread data for the cleanup handler 121static pthread_key_t thread_cleanup_key; 122 123/// Safe stack per-thread information passed to the thread_start function 124struct tinfo { 125 void *(*start_routine)(void *); 126 void *start_routine_arg; 127 128 void *unsafe_stack_start; 129 size_t unsafe_stack_size; 130 size_t unsafe_stack_guard; 131}; 132 133/// Wrap the thread function in order to deallocate the unsafe stack when the 134/// thread terminates by returning from its main function. 135static void *thread_start(void *arg) { 136 struct tinfo *tinfo = (struct tinfo *)arg; 137 138 void *(*start_routine)(void *) = tinfo->start_routine; 139 void *start_routine_arg = tinfo->start_routine_arg; 140 141 // Setup the unsafe stack; this will destroy tinfo content 142 unsafe_stack_setup(tinfo->unsafe_stack_start, tinfo->unsafe_stack_size, 143 tinfo->unsafe_stack_guard); 144 145 // Make sure out thread-specific destructor will be called 146 pthread_setspecific(thread_cleanup_key, (void *)1); 147 148 return start_routine(start_routine_arg); 149} 150 151/// Linked list used to store exiting threads stack/thread information. 152struct thread_stack_ll { 153 struct thread_stack_ll *next; 154 void *stack_base; 155 size_t size; 156 pid_t pid; 157 tid_t tid; 158}; 159 160/// Linked list of unsafe stacks for threads that are exiting. We delay 161/// unmapping them until the thread exits. 162static thread_stack_ll *thread_stacks = nullptr; 163static pthread_mutex_t thread_stacks_mutex = PTHREAD_MUTEX_INITIALIZER; 164 165/// Thread-specific data destructor. We want to free the unsafe stack only after 166/// this thread is terminated. libc can call functions in safestack-instrumented 167/// code (like free) after thread-specific data destructors have run. 168static void thread_cleanup_handler(void *_iter) { 169 CHECK_NE(unsafe_stack_start, nullptr); 170 pthread_setspecific(thread_cleanup_key, NULL); 171 172 pthread_mutex_lock(&thread_stacks_mutex); 173 // Temporary list to hold the previous threads stacks so we don't hold the 174 // thread_stacks_mutex for long. 175 thread_stack_ll *temp_stacks = thread_stacks; 176 thread_stacks = nullptr; 177 pthread_mutex_unlock(&thread_stacks_mutex); 178 179 pid_t pid = getpid(); 180 tid_t tid = GetTid(); 181 182 // Free stacks for dead threads 183 thread_stack_ll **stackp = &temp_stacks; 184 while (*stackp) { 185 thread_stack_ll *stack = *stackp; 186 int error; 187 if (stack->pid != pid || 188 (internal_iserror(TgKill(stack->pid, stack->tid, 0), &error) && 189 error == ESRCH)) { 190 UnmapOrDie(stack->stack_base, stack->size); 191 *stackp = stack->next; 192 free(stack); 193 } else 194 stackp = &stack->next; 195 } 196 197 thread_stack_ll *cur_stack = 198 (thread_stack_ll *)malloc(sizeof(thread_stack_ll)); 199 cur_stack->stack_base = (char *)unsafe_stack_start - unsafe_stack_guard; 200 cur_stack->size = unsafe_stack_size + unsafe_stack_guard; 201 cur_stack->pid = pid; 202 cur_stack->tid = tid; 203 204 pthread_mutex_lock(&thread_stacks_mutex); 205 // Merge thread_stacks with the current thread's stack and any remaining 206 // temp_stacks 207 *stackp = thread_stacks; 208 cur_stack->next = temp_stacks; 209 thread_stacks = cur_stack; 210 pthread_mutex_unlock(&thread_stacks_mutex); 211 212 unsafe_stack_start = nullptr; 213} 214 215static void EnsureInterceptorsInitialized(); 216 217/// Intercept thread creation operation to allocate and setup the unsafe stack 218INTERCEPTOR(int, pthread_create, pthread_t *thread, 219 const pthread_attr_t *attr, 220 void *(*start_routine)(void*), void *arg) { 221 EnsureInterceptorsInitialized(); 222 size_t size = 0; 223 size_t guard = 0; 224 225 if (attr) { 226 pthread_attr_getstacksize(attr, &size); 227 pthread_attr_getguardsize(attr, &guard); 228 } else { 229 // get pthread default stack size 230 pthread_attr_t tmpattr; 231 pthread_attr_init(&tmpattr); 232 pthread_attr_getstacksize(&tmpattr, &size); 233 pthread_attr_getguardsize(&tmpattr, &guard); 234 pthread_attr_destroy(&tmpattr); 235 } 236 237 CHECK_NE(size, 0); 238 CHECK_EQ((size & (kStackAlign - 1)), 0); 239 CHECK_EQ((guard & (pageSize - 1)), 0); 240 241 void *addr = unsafe_stack_alloc(size, guard); 242 struct tinfo *tinfo = 243 (struct tinfo *)(((char *)addr) + size - sizeof(struct tinfo)); 244 tinfo->start_routine = start_routine; 245 tinfo->start_routine_arg = arg; 246 tinfo->unsafe_stack_start = addr; 247 tinfo->unsafe_stack_size = size; 248 tinfo->unsafe_stack_guard = guard; 249 250 return REAL(pthread_create)(thread, attr, thread_start, tinfo); 251} 252 253static BlockingMutex interceptor_init_lock(LINKER_INITIALIZED); 254static bool interceptors_inited = false; 255 256static void EnsureInterceptorsInitialized() { 257 BlockingMutexLock lock(&interceptor_init_lock); 258 if (interceptors_inited) return; 259 260 // Initialize pthread interceptors for thread allocation 261 INTERCEPT_FUNCTION(pthread_create); 262 263 interceptors_inited = true; 264} 265 266extern "C" __attribute__((visibility("default"))) 267#if !SANITIZER_CAN_USE_PREINIT_ARRAY 268// On ELF platforms, the constructor is invoked using .preinit_array (see below) 269__attribute__((constructor(0))) 270#endif 271void __safestack_init() { 272 // Determine the stack size for the main thread. 273 size_t size = kDefaultUnsafeStackSize; 274 size_t guard = 4096; 275 276 struct rlimit limit; 277 if (getrlimit(RLIMIT_STACK, &limit) == 0 && limit.rlim_cur != RLIM_INFINITY) 278 size = limit.rlim_cur; 279 280 // Allocate unsafe stack for main thread 281 void *addr = unsafe_stack_alloc(size, guard); 282 283 unsafe_stack_setup(addr, size, guard); 284 pageSize = sysconf(_SC_PAGESIZE); 285 286 // Setup the cleanup handler 287 pthread_key_create(&thread_cleanup_key, thread_cleanup_handler); 288} 289 290#if SANITIZER_CAN_USE_PREINIT_ARRAY 291// On ELF platforms, run safestack initialization before any other constructors. 292// On other platforms we use the constructor attribute to arrange to run our 293// initialization early. 294extern "C" { 295__attribute__((section(".preinit_array"), 296 used)) void (*__safestack_preinit)(void) = __safestack_init; 297} 298#endif 299 300extern "C" 301 __attribute__((visibility("default"))) void *__get_unsafe_stack_bottom() { 302 return unsafe_stack_start; 303} 304 305extern "C" 306 __attribute__((visibility("default"))) void *__get_unsafe_stack_top() { 307 return (char*)unsafe_stack_start + unsafe_stack_size; 308} 309 310extern "C" 311 __attribute__((visibility("default"))) void *__get_unsafe_stack_start() { 312 return unsafe_stack_start; 313} 314 315extern "C" 316 __attribute__((visibility("default"))) void *__get_unsafe_stack_ptr() { 317 return __safestack_unsafe_stack_ptr; 318} 319