1//===-- safestack.cpp -----------------------------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file implements the runtime support for the safe stack protection
10// mechanism. The runtime manages allocation/deallocation of the unsafe stack
11// for the main thread, as well as all pthreads that are created/destroyed
12// during program execution.
13//
14//===----------------------------------------------------------------------===//
15
16#define SANITIZER_COMMON_NO_REDEFINE_BUILTINS
17
18#include <errno.h>
19#include <string.h>
20#include <sys/resource.h>
21
22#include "interception/interception.h"
23#include "safestack_platform.h"
24#include "safestack_util.h"
25#include "sanitizer/safestack_interface.h"
26#include "sanitizer_common/sanitizer_internal_defs.h"
27
28// interception.h drags in sanitizer_redefine_builtins.h, which in turn
29// creates references to __sanitizer_internal_memcpy etc. The interceptors
30// aren't needed here, so just forward to libc.
31extern "C" {
32SANITIZER_INTERFACE_ATTRIBUTE void *__sanitizer_internal_memcpy(void *dest,
33 const void *src,
34 size_t n) {
35 return memcpy(dest: dest, src: src, n: n);
36}
37
38SANITIZER_INTERFACE_ATTRIBUTE void *__sanitizer_internal_memmove(
39 void *dest, const void *src, size_t n) {
40 return memmove(dest: dest, src: src, n: n);
41}
42
43SANITIZER_INTERFACE_ATTRIBUTE void *__sanitizer_internal_memset(void *s, int c,
44 size_t n) {
45 return memset(s: s, c: c, n: n);
46}
47} // extern "C"
48
49using namespace safestack;
50
51// TODO: To make accessing the unsafe stack pointer faster, we plan to
52// eventually store it directly in the thread control block data structure on
53// platforms where this structure is pointed to by %fs or %gs. This is exactly
54// the same mechanism as currently being used by the traditional stack
55// protector pass to store the stack guard (see getStackCookieLocation()
56// function above). Doing so requires changing the tcbhead_t struct in glibc
57// on Linux and tcb struct in libc on FreeBSD.
58//
59// For now, store it in a thread-local variable.
60extern "C" {
61__attribute__((visibility(
62 "default"))) __thread void *__safestack_unsafe_stack_ptr = nullptr;
63}
64
65namespace {
66
67// TODO: The runtime library does not currently protect the safe stack beyond
68// relying on the system-enforced ASLR. The protection of the (safe) stack can
69// be provided by three alternative features:
70//
71// 1) Protection via hardware segmentation on x86-32 and some x86-64
72// architectures: the (safe) stack segment (implicitly accessed via the %ss
73// segment register) can be separated from the data segment (implicitly
74// accessed via the %ds segment register). Dereferencing a pointer to the safe
75// segment would result in a segmentation fault.
76//
77// 2) Protection via software fault isolation: memory writes that are not meant
78// to access the safe stack can be prevented from doing so through runtime
79// instrumentation. One way to do it is to allocate the safe stack(s) in the
80// upper half of the userspace and bitmask the corresponding upper bit of the
81// memory addresses of memory writes that are not meant to access the safe
82// stack.
83//
84// 3) Protection via information hiding on 64 bit architectures: the location
85// of the safe stack(s) can be randomized through secure mechanisms, and the
86// leakage of the stack pointer can be prevented. Currently, libc can leak the
87// stack pointer in several ways (e.g. in longjmp, signal handling, user-level
88// context switching related functions, etc.). These can be fixed in libc and
89// in other low-level libraries, by either eliminating the escaping/dumping of
90// the stack pointer (i.e., %rsp) when that's possible, or by using
91// encryption/PTR_MANGLE (XOR-ing the dumped stack pointer with another secret
92// we control and protect better, as is already done for setjmp in glibc.)
93// Furthermore, a static machine code level verifier can be ran after code
94// generation to make sure that the stack pointer is never written to memory,
95// or if it is, its written on the safe stack.
96//
97// Finally, while the Unsafe Stack pointer is currently stored in a thread
98// local variable, with libc support it could be stored in the TCB (thread
99// control block) as well, eliminating another level of indirection and making
100// such accesses faster. Alternatively, dedicating a separate register for
101// storing it would also be possible.
102
103/// Minimum stack alignment for the unsafe stack.
104const unsigned kStackAlign = 16;
105
106/// Default size of the unsafe stack. This value is only used if the stack
107/// size rlimit is set to infinity.
108const unsigned kDefaultUnsafeStackSize = 0x2800000;
109
110// Per-thread unsafe stack information. It's not frequently accessed, so there
111// it can be kept out of the tcb in normal thread-local variables.
112__thread void *unsafe_stack_start = nullptr;
113__thread size_t unsafe_stack_size = 0;
114__thread size_t unsafe_stack_guard = 0;
115
116// Per-thread unsafe stack information used for the unsafe stack during signal
117// handling if sigaltstack is used. Without, only the safe stack is switched by
118// the operating system. When the program indicates to use a separate stack for
119// signal handling, this should also include the unsafe stack component.
120__thread void* unsafe_sigalt_stack_ptr = nullptr;
121__thread void* unsafe_sigalt_stack_start = nullptr;
122__thread size_t unsafe_sigalt_stack_size = 0;
123
124inline void *unsafe_stack_alloc(size_t size, size_t guard) {
125 SFS_CHECK(size + guard >= size);
126 void *addr = Mmap(addr: nullptr, length: size + guard, PROT_READ | PROT_WRITE,
127 MAP_PRIVATE | MAP_ANON, fd: -1, offset: 0);
128 SFS_CHECK(MAP_FAILED != addr);
129 Mprotect(addr, length: guard, PROT_NONE);
130 return (char *)addr + guard;
131}
132
133inline void unsafe_stack_setup(void *start, size_t size, size_t guard) {
134 SFS_CHECK((char *)start + size >= (char *)start);
135 SFS_CHECK((char *)start + guard >= (char *)start);
136 void *stack_ptr = (char *)start + size;
137 SFS_CHECK((((size_t)stack_ptr) & (kStackAlign - 1)) == 0);
138
139 __safestack_unsafe_stack_ptr = stack_ptr;
140 unsafe_stack_start = start;
141 unsafe_stack_size = size;
142 unsafe_stack_guard = guard;
143}
144
145inline void unsafe_sigalt_stack_setup(void* start, size_t size) {
146 SFS_CHECK((uintptr_t)start + size >= (uintptr_t)start);
147 void* stack_ptr = (void*)((uintptr_t)start + size);
148 SFS_CHECK((((uintptr_t)stack_ptr) & (kStackAlign - 1)) == 0);
149
150 unsafe_sigalt_stack_ptr = stack_ptr;
151 unsafe_sigalt_stack_start = start;
152 unsafe_sigalt_stack_size = size;
153}
154
155/// Thread data for the cleanup handler
156pthread_key_t thread_cleanup_key;
157
158/// Safe stack per-thread information passed to the thread_start function
159struct tinfo {
160 void *(*start_routine)(void *);
161 void *start_routine_arg;
162
163 void *unsafe_stack_start;
164 size_t unsafe_stack_size;
165 size_t unsafe_stack_guard;
166};
167
168/// Wrap the thread function in order to deallocate the unsafe stack when the
169/// thread terminates by returning from its main function.
170void *thread_start(void *arg) {
171 struct tinfo *tinfo = (struct tinfo *)arg;
172
173 void *(*start_routine)(void *) = tinfo->start_routine;
174 void *start_routine_arg = tinfo->start_routine_arg;
175
176 // Setup the unsafe stack; this will destroy tinfo content
177 unsafe_stack_setup(start: tinfo->unsafe_stack_start, size: tinfo->unsafe_stack_size,
178 guard: tinfo->unsafe_stack_guard);
179
180 // Make sure out thread-specific destructor will be called
181 pthread_setspecific(key: thread_cleanup_key, pointer: (void *)1);
182
183 return start_routine(start_routine_arg);
184}
185
186/// Linked list used to store exiting threads stack/thread information.
187struct thread_stack_ll {
188 struct thread_stack_ll *next;
189 void *stack_base;
190 size_t size;
191 pid_t pid;
192 ThreadId tid;
193};
194
195/// Linked list of unsafe stacks for threads that are exiting. We delay
196/// unmapping them until the thread exits.
197thread_stack_ll *thread_stacks = nullptr;
198pthread_mutex_t thread_stacks_mutex = PTHREAD_MUTEX_INITIALIZER;
199
200/// Thread-specific data destructor. We want to free the unsafe stack only after
201/// this thread is terminated. libc can call functions in safestack-instrumented
202/// code (like free) after thread-specific data destructors have run.
203void thread_cleanup_handler(void *_iter) {
204 SFS_CHECK(unsafe_stack_start != nullptr);
205 pthread_setspecific(key: thread_cleanup_key, NULL);
206
207 pthread_mutex_lock(mutex: &thread_stacks_mutex);
208 // Temporary list to hold the previous threads stacks so we don't hold the
209 // thread_stacks_mutex for long.
210 thread_stack_ll *temp_stacks = thread_stacks;
211 thread_stacks = nullptr;
212 pthread_mutex_unlock(mutex: &thread_stacks_mutex);
213
214 pid_t pid = getpid();
215 ThreadId tid = GetTid();
216
217 // Free stacks for dead threads
218 thread_stack_ll **stackp = &temp_stacks;
219 while (*stackp) {
220 thread_stack_ll *stack = *stackp;
221 if (stack->pid != pid ||
222 (-1 == TgKill(pid: stack->pid, tid: stack->tid, sig: 0) && errno == ESRCH)) {
223 Munmap(addr: stack->stack_base, length: stack->size);
224 *stackp = stack->next;
225 free(ptr: stack);
226 } else
227 stackp = &stack->next;
228 }
229
230 thread_stack_ll *cur_stack =
231 (thread_stack_ll *)malloc(size: sizeof(thread_stack_ll));
232 cur_stack->stack_base = (char *)unsafe_stack_start - unsafe_stack_guard;
233 cur_stack->size = unsafe_stack_size + unsafe_stack_guard;
234 cur_stack->pid = pid;
235 cur_stack->tid = tid;
236
237 pthread_mutex_lock(mutex: &thread_stacks_mutex);
238 // Merge thread_stacks with the current thread's stack and any remaining
239 // temp_stacks
240 *stackp = thread_stacks;
241 cur_stack->next = temp_stacks;
242 thread_stacks = cur_stack;
243 pthread_mutex_unlock(mutex: &thread_stacks_mutex);
244
245 unsafe_stack_start = nullptr;
246
247 // In case the sigalt stack was allocated, we need to unmap the used memory.
248 if (unsafe_sigalt_stack_start) {
249 unsafe_sigalt_stack_ptr = nullptr;
250 Munmap(addr: unsafe_sigalt_stack_start, length: unsafe_sigalt_stack_size);
251 unsafe_sigalt_stack_start = nullptr;
252 unsafe_sigalt_stack_size = 0;
253 }
254}
255
256void EnsureInterceptorsInitialized();
257
258/// Intercept thread creation operation to allocate and setup the unsafe stack
259INTERCEPTOR(int, pthread_create, pthread_t *thread,
260 const pthread_attr_t *attr,
261 void *(*start_routine)(void*), void *arg) {
262 EnsureInterceptorsInitialized();
263 size_t size = 0;
264 size_t guard = 0;
265
266 if (attr) {
267 pthread_attr_getstacksize(attr: attr, stacksize: &size);
268 pthread_attr_getguardsize(attr: attr, guardsize: &guard);
269 } else {
270 // get pthread default stack size
271 pthread_attr_t tmpattr;
272 pthread_attr_init(attr: &tmpattr);
273 pthread_attr_getstacksize(attr: &tmpattr, stacksize: &size);
274 pthread_attr_getguardsize(attr: &tmpattr, guardsize: &guard);
275 pthread_attr_destroy(attr: &tmpattr);
276 }
277
278#if SANITIZER_SOLARIS
279 // Solaris pthread_attr_init initializes stacksize to 0 (the default), so
280 // hardcode the actual values as documented in pthread_create(3C).
281 if (size == 0)
282# if defined(_LP64)
283 size = 2 * 1024 * 1024;
284# else
285 size = 1024 * 1024;
286# endif
287#endif
288
289 SFS_CHECK(size);
290 size = RoundUpTo(size, boundary: kStackAlign);
291
292 void *addr = unsafe_stack_alloc(size, guard);
293 // Put tinfo at the end of the buffer. guard may be not page aligned.
294 // If that is so then some bytes after addr can be mprotected.
295 struct tinfo *tinfo =
296 (struct tinfo *)(((char *)addr) + size - sizeof(struct tinfo));
297 tinfo->start_routine = start_routine;
298 tinfo->start_routine_arg = arg;
299 tinfo->unsafe_stack_start = addr;
300 tinfo->unsafe_stack_size = size;
301 tinfo->unsafe_stack_guard = guard;
302
303 return REAL(pthread_create)(thread, attr, thread_start, tinfo);
304}
305
306// We are intercepting sigaction in order to keep note of the set sigaction and
307// overwrite it our own function to execute the switching if the unsafe stack
308// pointer before and after the signal is handled.
309// In this version, we are simply making sure the interceptor is functional.
310// sigaction is required to be async-signal-safe.
311INTERCEPTOR(int, sigaction, int sig, const struct sigaction* act,
312 struct sigaction* oldact) {
313 return REAL(sigaction)(sig, act, oldact);
314}
315
316// Since sigaltstack is required to be async-signal-safe, we cannot simply
317// intercept it to allocate the the unsafe stack. Instead if the users wishes to
318// setup an unsafe sigalt stack can call unsafe_sigaltstack(ss_size size)
319// explicitliy.
320int setup_unsafe_sigaltstack(size_t ss_size) {
321 EnsureInterceptorsInitialized();
322
323 SFS_CHECK(ss_size);
324 ss_size = RoundUpTo(size: ss_size, boundary: kStackAlign);
325
326 // For now always map a new unsafe sigaltstack when setting a new
327 // sigaltstack. Potentially if the size is identical, this step can be
328 // skipped.
329 void* prev_sigalt_stack_start = unsafe_sigalt_stack_start;
330 size_t prev_sigalt_stack_size = unsafe_sigalt_stack_size;
331 void* sigalt_addr = unsafe_stack_alloc(size: ss_size, guard: 0);
332 unsafe_sigalt_stack_setup(start: sigalt_addr, size: ss_size);
333 if (prev_sigalt_stack_start != nullptr) {
334 Munmap(addr: prev_sigalt_stack_start, length: prev_sigalt_stack_size);
335 }
336
337 return 0;
338}
339
340pthread_mutex_t interceptor_init_mutex = PTHREAD_MUTEX_INITIALIZER;
341bool interceptors_inited = false;
342
343void EnsureInterceptorsInitialized() {
344 MutexLock lock(interceptor_init_mutex);
345 if (interceptors_inited)
346 return;
347
348 // Initialize pthread interceptors for thread allocation
349 INTERCEPT_FUNCTION(pthread_create);
350 // Initialize sigaction interceptor to overwrite the signal handler.
351 INTERCEPT_FUNCTION(sigaction);
352
353 interceptors_inited = true;
354}
355
356} // namespace
357
358extern "C" __attribute__((visibility("default")))
359#if !SANITIZER_CAN_USE_PREINIT_ARRAY
360// On ELF platforms, the constructor is invoked using .preinit_array (see below)
361__attribute__((constructor(0)))
362#endif
363void __safestack_init() {
364 // Determine the stack size for the main thread.
365 size_t size = kDefaultUnsafeStackSize;
366 size_t guard = 4096;
367
368 struct rlimit limit;
369 if (getrlimit(RLIMIT_STACK, rlimits: &limit) == 0 && limit.rlim_cur != RLIM_INFINITY)
370 size = limit.rlim_cur;
371
372 // Allocate unsafe stack for main thread
373 void *addr = unsafe_stack_alloc(size, guard);
374 unsafe_stack_setup(start: addr, size, guard);
375
376 // Setup the cleanup handler
377 pthread_key_create(key: &thread_cleanup_key, destr_function: thread_cleanup_handler);
378
379 EnsureInterceptorsInitialized();
380}
381
382#if SANITIZER_CAN_USE_PREINIT_ARRAY
383// On ELF platforms, run safestack initialization before any other constructors.
384// On other platforms we use the constructor attribute to arrange to run our
385// initialization early.
386extern "C" {
387__attribute__((section(".preinit_array"),
388 used)) void (*__safestack_preinit)(void) = __safestack_init;
389}
390#endif
391
392extern "C" SANITIZER_INTERFACE_ATTRIBUTE const void*
393__safestack_get_unsafe_stack_bottom() {
394 return unsafe_stack_start;
395}
396
397extern "C" SANITIZER_INTERFACE_ATTRIBUTE const void*
398__safestack_get_unsafe_stack_top() {
399 return (char*)unsafe_stack_start + unsafe_stack_size;
400}
401
402extern "C" SANITIZER_INTERFACE_ATTRIBUTE const void*
403__safestack_get_unsafe_stack_ptr() {
404 return __safestack_unsafe_stack_ptr;
405}
406
407extern "C" SANITIZER_INTERFACE_ATTRIBUTE const void*
408__safestack_get_unsafe_sigalt_stack_bottom() {
409 return unsafe_sigalt_stack_start;
410}
411
412extern "C" SANITIZER_INTERFACE_ATTRIBUTE const void*
413__safestack_get_unsafe_sigalt_stack_top() {
414 return (char*)unsafe_sigalt_stack_start + unsafe_sigalt_stack_size;
415}
416
417extern "C" SANITIZER_INTERFACE_ATTRIBUTE const void*
418__safestack_get_unsafe_sigalt_stack_ptr() {
419 return unsafe_sigalt_stack_ptr;
420}
421
422extern "C" SANITIZER_INTERFACE_ATTRIBUTE int __safestack_unsafe_sigaltstack(
423 size_t ss_size) {
424 return setup_unsafe_sigaltstack(ss_size);
425}
426
427// Compatibility aliases
428extern "C" SANITIZER_INTERFACE_ATTRIBUTE void* __get_unsafe_stack_bottom() {
429 return const_cast<void*>(__safestack_get_unsafe_stack_bottom());
430}
431
432extern "C" SANITIZER_INTERFACE_ATTRIBUTE void* __get_unsafe_stack_top() {
433 return const_cast<void*>(__safestack_get_unsafe_stack_top());
434}
435
436extern "C" SANITIZER_INTERFACE_ATTRIBUTE void* __get_unsafe_stack_start() {
437 return const_cast<void*>(__safestack_get_unsafe_stack_bottom());
438}
439
440extern "C" SANITIZER_INTERFACE_ATTRIBUTE void* __get_unsafe_stack_ptr() {
441 return const_cast<void*>(__safestack_get_unsafe_stack_ptr());
442}
443