scripts/gcc-plugins/stackleak_plugin.c

   1 /*
   2  * Copyright 2011-2017 by the PaX Team <pageexec@freemail.hu>
   3  * Modified by Alexander Popov <alex.popov@linux.com>
   4  * Licensed under the GPL v2
   5  *
   6  * Note: the choice of the license means that the compilation process is
   7  * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
   8  * but for the kernel it doesn't matter since it doesn't link against
   9  * any of the gcc libraries
  10  *
  11  * This gcc plugin is needed for tracking the lowest border of the kernel stack.
  12  * It instruments the kernel code inserting stackleak_track_stack() calls:
  13  *  - after alloca();
  14  *  - for the functions with a stack frame size greater than or equal
  15  *     to the "track-min-size" plugin parameter.
  16  *
  17  * This plugin is ported from grsecurity/PaX. For more information see:
  18  *   https://grsecurity.net/
  19  *   https://pax.grsecurity.net/
  20  *
  21  * Debugging:
  22  *  - use fprintf() to stderr, debug_generic_expr(), debug_gimple_stmt(),
  23  *     print_rtl() and print_simple_rtl();
  24  *  - add "-fdump-tree-all -fdump-rtl-all" to the plugin CFLAGS in
  25  *     Makefile.gcc-plugins to see the verbose dumps of the gcc passes;
  26  *  - use gcc -E to understand the preprocessing shenanigans;
  27  *  - use gcc with enabled CFG/GIMPLE/SSA verification (--enable-checking).
  28  */
  29
  30 #include "gcc-common.h"
  31
  32 __visible int plugin_is_GPL_compatible;
  33
  34 static int track_frame_size = -1;
  35 static const char track_function[] = "stackleak_track_stack";
  36
  37 /*
  38  * Mark these global variables (roots) for gcc garbage collector since
  39  * they point to the garbage-collected memory.
  40  */
  41 static GTY(()) tree track_function_decl;
  42
  43 static struct plugin_info stackleak_plugin_info = {
  44         .version = "201707101337",
  45         .help = "track-min-size=nn\ttrack stack for functions with a stack frame size >= nn bytes\n"
  46                 "disable\t\tdo not activate the plugin\n"
  47 };
  48
  49 static void stackleak_add_track_stack(gimple_stmt_iterator *gsi, bool after)
  50 {
  51         gimple stmt;
  52         gcall *stackleak_track_stack;
  53         cgraph_node_ptr node;
  54         int frequency;
  55         basic_block bb;
  56
  57         /* Insert call to void stackleak_track_stack(void) */
  58         stmt = gimple_build_call(track_function_decl, 0);
  59         stackleak_track_stack = as_a_gcall(stmt);
  60         if (after) {
  61                 gsi_insert_after(gsi, stackleak_track_stack,
  62                                                 GSI_CONTINUE_LINKING);
  63         } else {
  64                 gsi_insert_before(gsi, stackleak_track_stack, GSI_SAME_STMT);
  65         }
  66
  67         /* Update the cgraph */
  68         bb = gimple_bb(stackleak_track_stack);
  69         node = cgraph_get_create_node(track_function_decl);
  70         gcc_assert(node);
  71         frequency = compute_call_stmt_bb_frequency(current_function_decl, bb);
  72         cgraph_create_edge(cgraph_get_node(current_function_decl), node,
  73                         stackleak_track_stack, bb->count, frequency);
  74 }
  75
  76 static bool is_alloca(gimple stmt)
  77 {
  78         if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA))
  79                 return true;
  80
  81 #if BUILDING_GCC_VERSION >= 4007
  82         if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA_WITH_ALIGN))
  83                 return true;
  84 #endif
  85
  86         return false;
  87 }
  88
  89 /*
  90  * Work with the GIMPLE representation of the code. Insert the
  91  * stackleak_track_stack() call after alloca() and into the beginning
  92  * of the function if it is not instrumented.
  93  */
  94 static unsigned int stackleak_instrument_execute(void)
  95 {
  96         basic_block bb, entry_bb;
  97         bool prologue_instrumented = false, is_leaf = true;
  98         gimple_stmt_iterator gsi;
  99
 100         /*
 101          * ENTRY_BLOCK_PTR is a basic block which represents possible entry
 102          * point of a function. This block does not contain any code and
 103          * has a CFG edge to its successor.
 104          */
 105         gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
 106         entry_bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
 107
 108         /*
 109          * Loop through the GIMPLE statements in each of cfun basic blocks.
 110          * cfun is a global variable which represents the function that is
 111          * currently processed.
 112          */
 113         FOR_EACH_BB_FN(bb, cfun) {
 114                 for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
 115                         gimple stmt;
 116
 117                         stmt = gsi_stmt(gsi);
 118
 119                         /* Leaf function is a function which makes no calls */
 120                         if (is_gimple_call(stmt))
 121                                 is_leaf = false;
 122
 123                         if (!is_alloca(stmt))
 124                                 continue;
 125
 126                         /* Insert stackleak_track_stack() call after alloca() */
 127                         stackleak_add_track_stack(&gsi, true);
 128                         if (bb == entry_bb)
 129                                 prologue_instrumented = true;
 130                 }
 131         }
 132
 133         if (prologue_instrumented)
 134                 return 0;
 135
 136         /*
 137          * Special cases to skip the instrumentation.
 138          *
 139          * Taking the address of static inline functions materializes them,
 140          * but we mustn't instrument some of them as the resulting stack
 141          * alignment required by the function call ABI will break other
 142          * assumptions regarding the expected (but not otherwise enforced)
 143          * register clobbering ABI.
 144          *
 145          * Case in point: native_save_fl on amd64 when optimized for size
 146          * clobbers rdx if it were instrumented here.
 147          *
 148          * TODO: any more special cases?
 149          */
 150         if (is_leaf &&
 151             !TREE_PUBLIC(current_function_decl) &&
 152             DECL_DECLARED_INLINE_P(current_function_decl)) {
 153                 return 0;
 154         }
 155
 156         if (is_leaf &&
 157             !strncmp(IDENTIFIER_POINTER(DECL_NAME(current_function_decl)),
 158                      "_paravirt_", 10)) {
 159                 return 0;
 160         }
 161
 162         /* Insert stackleak_track_stack() call at the function beginning */
 163         bb = entry_bb;
 164         if (!single_pred_p(bb)) {
 165                 /* gcc_assert(bb_loop_depth(bb) ||
 166                                 (bb->flags & BB_IRREDUCIBLE_LOOP)); */
 167                 split_edge(single_succ_edge(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
 168                 gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
 169                 bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
 170         }
 171         gsi = gsi_after_labels(bb);
 172         stackleak_add_track_stack(&gsi, false);
 173
 174         return 0;
 175 }
 176
 177 static bool large_stack_frame(void)
 178 {
 179 #if BUILDING_GCC_VERSION >= 8000
 180         return maybe_ge(get_frame_size(), track_frame_size);
 181 #else
 182         return (get_frame_size() >= track_frame_size);
 183 #endif
 184 }
 185
 186 /*
 187  * Work with the RTL representation of the code.
 188  * Remove the unneeded stackleak_track_stack() calls from the functions
 189  * which don't call alloca() and don't have a large enough stack frame size.
 190  */
 191 static unsigned int stackleak_cleanup_execute(void)
 192 {
 193         rtx_insn *insn, *next;
 194
 195         if (cfun->calls_alloca)
 196                 return 0;
 197
 198         if (large_stack_frame())
 199                 return 0;
 200
 201         /*
 202          * Find stackleak_track_stack() calls. Loop through the chain of insns,
 203          * which is an RTL representation of the code for a function.
 204          *
 205          * The example of a matching insn:
 206          *  (call_insn 8 4 10 2 (call (mem (symbol_ref ("stackleak_track_stack")
 207          *  [flags 0x41] <function_decl 0x7f7cd3302a80 stackleak_track_stack>)
 208          *  [0 stackleak_track_stack S1 A8]) (0)) 675 {*call} (expr_list
 209          *  (symbol_ref ("stackleak_track_stack") [flags 0x41] <function_decl
 210          *  0x7f7cd3302a80 stackleak_track_stack>) (expr_list (0) (nil))) (nil))
 211          */
 212         for (insn = get_insns(); insn; insn = next) {
 213                 rtx body;
 214
 215                 next = NEXT_INSN(insn);
 216
 217                 /* Check the expression code of the insn */
 218                 if (!CALL_P(insn))
 219                         continue;
 220
 221                 /*
 222                  * Check the expression code of the insn body, which is an RTL
 223                  * Expression (RTX) describing the side effect performed by
 224                  * that insn.
 225                  */
 226                 body = PATTERN(insn);
 227
 228                 if (GET_CODE(body) == PARALLEL)
 229                         body = XVECEXP(body, 0, 0);
 230
 231                 if (GET_CODE(body) != CALL)
 232                         continue;
 233
 234                 /*
 235                  * Check the first operand of the call expression. It should
 236                  * be a mem RTX describing the needed subroutine with a
 237                  * symbol_ref RTX.
 238                  */
 239                 body = XEXP(body, 0);
 240                 if (GET_CODE(body) != MEM)
 241                         continue;
 242
 243                 body = XEXP(body, 0);
 244                 if (GET_CODE(body) != SYMBOL_REF)
 245                         continue;
 246
 247                 if (SYMBOL_REF_DECL(body) != track_function_decl)
 248                         continue;
 249
 250                 /* Delete the stackleak_track_stack() call */
 251                 delete_insn_and_edges(insn);
 252 #if BUILDING_GCC_VERSION >= 4007 && BUILDING_GCC_VERSION < 8000
 253                 if (GET_CODE(next) == NOTE &&
 254                     NOTE_KIND(next) == NOTE_INSN_CALL_ARG_LOCATION) {
 255                         insn = next;
 256                         next = NEXT_INSN(insn);
 257                         delete_insn_and_edges(insn);
 258                 }
 259 #endif
 260         }
 261
 262         return 0;
 263 }
 264
 265 static bool stackleak_gate(void)
 266 {
 267         tree section;
 268
 269         section = lookup_attribute("section",
 270                                    DECL_ATTRIBUTES(current_function_decl));
 271         if (section && TREE_VALUE(section)) {
 272                 section = TREE_VALUE(TREE_VALUE(section));
 273
 274                 if (!strncmp(TREE_STRING_POINTER(section), ".init.text", 10))
 275                         return false;
 276                 if (!strncmp(TREE_STRING_POINTER(section), ".devinit.text", 13))
 277                         return false;
 278                 if (!strncmp(TREE_STRING_POINTER(section), ".cpuinit.text", 13))
 279                         return false;
 280                 if (!strncmp(TREE_STRING_POINTER(section), ".meminit.text", 13))
 281                         return false;
 282         }
 283
 284         return track_frame_size >= 0;
 285 }
 286
 287 /* Build the function declaration for stackleak_track_stack() */
 288 static void stackleak_start_unit(void *gcc_data __unused,
 289                                  void *user_data __unused)
 290 {
 291         tree fntype;
 292
 293         /* void stackleak_track_stack(void) */
 294         fntype = build_function_type_list(void_type_node, NULL_TREE);
 295         track_function_decl = build_fn_decl(track_function, fntype);
 296         DECL_ASSEMBLER_NAME(track_function_decl); /* for LTO */
 297         TREE_PUBLIC(track_function_decl) = 1;
 298         TREE_USED(track_function_decl) = 1;
 299         DECL_EXTERNAL(track_function_decl) = 1;
 300         DECL_ARTIFICIAL(track_function_decl) = 1;
 301         DECL_PRESERVE_P(track_function_decl) = 1;
 302 }
 303
 304 /*
 305  * Pass gate function is a predicate function that gets executed before the
 306  * corresponding pass. If the return value is 'true' the pass gets executed,
 307  * otherwise, it is skipped.
 308  */
 309 static bool stackleak_instrument_gate(void)
 310 {
 311         return stackleak_gate();
 312 }
 313
 314 #define PASS_NAME stackleak_instrument
 315 #define PROPERTIES_REQUIRED PROP_gimple_leh | PROP_cfg
 316 #define TODO_FLAGS_START TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts
 317 #define TODO_FLAGS_FINISH TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func \
 318                         | TODO_update_ssa | TODO_rebuild_cgraph_edges
 319 #include "gcc-generate-gimple-pass.h"
 320
 321 static bool stackleak_cleanup_gate(void)
 322 {
 323         return stackleak_gate();
 324 }
 325
 326 #define PASS_NAME stackleak_cleanup
 327 #define TODO_FLAGS_FINISH TODO_dump_func
 328 #include "gcc-generate-rtl-pass.h"
 329
 330 /*
 331  * Every gcc plugin exports a plugin_init() function that is called right
 332  * after the plugin is loaded. This function is responsible for registering
 333  * the plugin callbacks and doing other required initialization.
 334  */
 335 __visible int plugin_init(struct plugin_name_args *plugin_info,
 336                           struct plugin_gcc_version *version)
 337 {
 338         const char * const plugin_name = plugin_info->base_name;
 339         const int argc = plugin_info->argc;
 340         const struct plugin_argument * const argv = plugin_info->argv;
 341         int i = 0;
 342
 343         /* Extra GGC root tables describing our GTY-ed data */
 344         static const struct ggc_root_tab gt_ggc_r_gt_stackleak[] = {
 345                 {
 346                         .base = &track_function_decl,
 347                         .nelt = 1,
 348                         .stride = sizeof(track_function_decl),
 349                         .cb = &gt_ggc_mx_tree_node,
 350                         .pchw = &gt_pch_nx_tree_node
 351                 },
 352                 LAST_GGC_ROOT_TAB
 353         };
 354
 355         /*
 356          * The stackleak_instrument pass should be executed before the
 357          * "optimized" pass, which is the control flow graph cleanup that is
 358          * performed just before expanding gcc trees to the RTL. In former
 359          * versions of the plugin this new pass was inserted before the
 360          * "tree_profile" pass, which is currently called "profile".
 361          */
 362         PASS_INFO(stackleak_instrument, "optimized", 1,
 363                                                 PASS_POS_INSERT_BEFORE);
 364
 365         /*
 366          * The stackleak_cleanup pass should be executed before the "*free_cfg"
 367          * pass. It's the moment when the stack frame size is already final,
 368          * function prologues and epilogues are generated, and the
 369          * machine-dependent code transformations are not done.
 370          */
 371         PASS_INFO(stackleak_cleanup, "*free_cfg", 1, PASS_POS_INSERT_BEFORE);
 372
 373         if (!plugin_default_version_check(version, &gcc_version)) {
 374                 error(G_("incompatible gcc/plugin versions"));
 375                 return 1;
 376         }
 377
 378         /* Parse the plugin arguments */
 379         for (i = 0; i < argc; i++) {
 380                 if (!strcmp(argv[i].key, "disable"))
 381                         return 0;
 382
 383                 if (!strcmp(argv[i].key, "track-min-size")) {
 384                         if (!argv[i].value) {
 385                                 error(G_("no value supplied for option '-fplugin-arg-%s-%s'"),
 386                                         plugin_name, argv[i].key);
 387                                 return 1;
 388                         }
 389
 390                         track_frame_size = atoi(argv[i].value);
 391                         if (track_frame_size < 0) {
 392                                 error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"),
 393                                         plugin_name, argv[i].key, argv[i].value);
 394                                 return 1;
 395                         }
 396                 } else {
 397                         error(G_("unknown option '-fplugin-arg-%s-%s'"),
 398                                         plugin_name, argv[i].key);
 399                         return 1;
 400                 }
 401         }
 402
 403         /* Give the information about the plugin */
 404         register_callback(plugin_name, PLUGIN_INFO, NULL,
 405                                                 &stackleak_plugin_info);
 406
 407         /* Register to be called before processing a translation unit */
 408         register_callback(plugin_name, PLUGIN_START_UNIT,
 409                                         &stackleak_start_unit, NULL);
 410
 411         /* Register an extra GCC garbage collector (GGC) root table */
 412         register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL,
 413                                         (void *)&gt_ggc_r_gt_stackleak);
 414
 415         /*
 416          * Hook into the Pass Manager to register new gcc passes.
 417          *
 418          * The stack frame size info is available only at the last RTL pass,
 419          * when it's too late to insert complex code like a function call.
 420          * So we register two gcc passes to instrument every function at first
 421          * and remove the unneeded instrumentation later.
 422          */
 423         register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL,
 424                                         &stackleak_instrument_pass_info);
 425         register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL,
 426                                         &stackleak_cleanup_pass_info);
 427
 428         return 0;
 429 }