Loading...
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Copyright 2011-2017 by the PaX Team <pageexec@freemail.hu>
4 * Modified by Alexander Popov <alex.popov@linux.com>
5 *
6 * Note: the choice of the license means that the compilation process is
7 * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
8 * but for the kernel it doesn't matter since it doesn't link against
9 * any of the gcc libraries
10 *
11 * This gcc plugin is needed for tracking the lowest border of the kernel stack.
12 * It instruments the kernel code inserting stackleak_track_stack() calls:
13 * - after alloca();
14 * - for the functions with a stack frame size greater than or equal
15 * to the "track-min-size" plugin parameter.
16 *
17 * This plugin is ported from grsecurity/PaX. For more information see:
18 * https://grsecurity.net/
19 * https://pax.grsecurity.net/
20 *
21 * Debugging:
22 * - use fprintf() to stderr, debug_generic_expr(), debug_gimple_stmt(),
23 * print_rtl_single() and debug_rtx();
24 * - add "-fdump-tree-all -fdump-rtl-all" to the plugin CFLAGS in
25 * Makefile.gcc-plugins to see the verbose dumps of the gcc passes;
26 * - use gcc -E to understand the preprocessing shenanigans;
27 * - use gcc with enabled CFG/GIMPLE/SSA verification (--enable-checking).
28 */
29
30#include "gcc-common.h"
31
32__visible int plugin_is_GPL_compatible;
33
34static int track_frame_size = -1;
35static bool build_for_x86 = false;
36static const char track_function[] = "stackleak_track_stack";
37static bool disable = false;
38static bool verbose = false;
39
40/*
41 * Mark these global variables (roots) for gcc garbage collector since
42 * they point to the garbage-collected memory.
43 */
44static GTY(()) tree track_function_decl;
45
46static struct plugin_info stackleak_plugin_info = {
47 .version = PLUGIN_VERSION,
48 .help = "track-min-size=nn\ttrack stack for functions with a stack frame size >= nn bytes\n"
49 "arch=target_arch\tspecify target build arch\n"
50 "disable\t\tdo not activate the plugin\n"
51 "verbose\t\tprint info about the instrumentation\n"
52};
53
54static void add_stack_tracking_gcall(gimple_stmt_iterator *gsi, bool after)
55{
56 gimple stmt;
57 gcall *gimple_call;
58 cgraph_node_ptr node;
59 basic_block bb;
60
61 /* Insert calling stackleak_track_stack() */
62 stmt = gimple_build_call(track_function_decl, 0);
63 gimple_call = as_a_gcall(stmt);
64 if (after)
65 gsi_insert_after(gsi, gimple_call, GSI_CONTINUE_LINKING);
66 else
67 gsi_insert_before(gsi, gimple_call, GSI_SAME_STMT);
68
69 /* Update the cgraph */
70 bb = gimple_bb(gimple_call);
71 node = cgraph_get_create_node(track_function_decl);
72 gcc_assert(node);
73 cgraph_create_edge(cgraph_get_node(current_function_decl), node,
74 gimple_call, bb->count,
75 compute_call_stmt_bb_frequency(current_function_decl, bb));
76}
77
78static bool is_alloca(gimple stmt)
79{
80 if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA))
81 return true;
82
83 if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA_WITH_ALIGN))
84 return true;
85
86 return false;
87}
88
89static tree get_current_stack_pointer_decl(void)
90{
91 varpool_node_ptr node;
92
93 FOR_EACH_VARIABLE(node) {
94 tree var = NODE_DECL(node);
95 tree name = DECL_NAME(var);
96
97 if (DECL_NAME_LENGTH(var) != sizeof("current_stack_pointer") - 1)
98 continue;
99
100 if (strcmp(IDENTIFIER_POINTER(name), "current_stack_pointer"))
101 continue;
102
103 return var;
104 }
105
106 if (verbose) {
107 fprintf(stderr, "stackleak: missing current_stack_pointer in %s()\n",
108 DECL_NAME_POINTER(current_function_decl));
109 }
110 return NULL_TREE;
111}
112
113static void add_stack_tracking_gasm(gimple_stmt_iterator *gsi, bool after)
114{
115 gasm *asm_call = NULL;
116 tree sp_decl, input;
117 vec<tree, va_gc> *inputs = NULL;
118
119 /* 'no_caller_saved_registers' is currently supported only for x86 */
120 gcc_assert(build_for_x86);
121
122 /*
123 * Insert calling stackleak_track_stack() in asm:
124 * asm volatile("call stackleak_track_stack"
125 * :: "r" (current_stack_pointer))
126 * Use ASM_CALL_CONSTRAINT trick from arch/x86/include/asm/asm.h.
127 * This constraint is taken into account during gcc shrink-wrapping
128 * optimization. It is needed to be sure that stackleak_track_stack()
129 * call is inserted after the prologue of the containing function,
130 * when the stack frame is prepared.
131 */
132 sp_decl = get_current_stack_pointer_decl();
133 if (sp_decl == NULL_TREE) {
134 add_stack_tracking_gcall(gsi, after);
135 return;
136 }
137 input = build_tree_list(NULL_TREE, build_const_char_string(2, "r"));
138 input = chainon(NULL_TREE, build_tree_list(input, sp_decl));
139 vec_safe_push(inputs, input);
140 asm_call = gimple_build_asm_vec("call stackleak_track_stack",
141 inputs, NULL, NULL, NULL);
142 gimple_asm_set_volatile(asm_call, true);
143 if (after)
144 gsi_insert_after(gsi, asm_call, GSI_CONTINUE_LINKING);
145 else
146 gsi_insert_before(gsi, asm_call, GSI_SAME_STMT);
147 update_stmt(asm_call);
148}
149
150static void add_stack_tracking(gimple_stmt_iterator *gsi, bool after)
151{
152 /*
153 * The 'no_caller_saved_registers' attribute is used for
154 * stackleak_track_stack(). If the compiler supports this attribute for
155 * the target arch, we can add calling stackleak_track_stack() in asm.
156 * That improves performance: we avoid useless operations with the
157 * caller-saved registers in the functions from which we will remove
158 * stackleak_track_stack() call during the stackleak_cleanup pass.
159 */
160 if (lookup_attribute_spec(get_identifier("no_caller_saved_registers")))
161 add_stack_tracking_gasm(gsi, after);
162 else
163 add_stack_tracking_gcall(gsi, after);
164}
165
166/*
167 * Work with the GIMPLE representation of the code. Insert the
168 * stackleak_track_stack() call after alloca() and into the beginning
169 * of the function if it is not instrumented.
170 */
171static unsigned int stackleak_instrument_execute(void)
172{
173 basic_block bb, entry_bb;
174 bool prologue_instrumented = false, is_leaf = true;
175 gimple_stmt_iterator gsi = { 0 };
176
177 /*
178 * ENTRY_BLOCK_PTR is a basic block which represents possible entry
179 * point of a function. This block does not contain any code and
180 * has a CFG edge to its successor.
181 */
182 gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
183 entry_bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
184
185 /*
186 * Loop through the GIMPLE statements in each of cfun basic blocks.
187 * cfun is a global variable which represents the function that is
188 * currently processed.
189 */
190 FOR_EACH_BB_FN(bb, cfun) {
191 for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
192 gimple stmt;
193
194 stmt = gsi_stmt(gsi);
195
196 /* Leaf function is a function which makes no calls */
197 if (is_gimple_call(stmt))
198 is_leaf = false;
199
200 if (!is_alloca(stmt))
201 continue;
202
203 if (verbose) {
204 fprintf(stderr, "stackleak: be careful, alloca() in %s()\n",
205 DECL_NAME_POINTER(current_function_decl));
206 }
207
208 /* Insert stackleak_track_stack() call after alloca() */
209 add_stack_tracking(&gsi, true);
210 if (bb == entry_bb)
211 prologue_instrumented = true;
212 }
213 }
214
215 if (prologue_instrumented)
216 return 0;
217
218 /*
219 * Special cases to skip the instrumentation.
220 *
221 * Taking the address of static inline functions materializes them,
222 * but we mustn't instrument some of them as the resulting stack
223 * alignment required by the function call ABI will break other
224 * assumptions regarding the expected (but not otherwise enforced)
225 * register clobbering ABI.
226 *
227 * Case in point: native_save_fl on amd64 when optimized for size
228 * clobbers rdx if it were instrumented here.
229 *
230 * TODO: any more special cases?
231 */
232 if (is_leaf &&
233 !TREE_PUBLIC(current_function_decl) &&
234 DECL_DECLARED_INLINE_P(current_function_decl)) {
235 return 0;
236 }
237
238 if (is_leaf &&
239 !strncmp(IDENTIFIER_POINTER(DECL_NAME(current_function_decl)),
240 "_paravirt_", 10)) {
241 return 0;
242 }
243
244 /* Insert stackleak_track_stack() call at the function beginning */
245 bb = entry_bb;
246 if (!single_pred_p(bb)) {
247 /* gcc_assert(bb_loop_depth(bb) ||
248 (bb->flags & BB_IRREDUCIBLE_LOOP)); */
249 split_edge(single_succ_edge(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
250 gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
251 bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
252 }
253 gsi = gsi_after_labels(bb);
254 add_stack_tracking(&gsi, false);
255
256 return 0;
257}
258
259static bool large_stack_frame(void)
260{
261#if BUILDING_GCC_VERSION >= 8000
262 return maybe_ge(get_frame_size(), track_frame_size);
263#else
264 return (get_frame_size() >= track_frame_size);
265#endif
266}
267
268static void remove_stack_tracking_gcall(void)
269{
270 rtx_insn *insn, *next;
271
272 /*
273 * Find stackleak_track_stack() calls. Loop through the chain of insns,
274 * which is an RTL representation of the code for a function.
275 *
276 * The example of a matching insn:
277 * (call_insn 8 4 10 2 (call (mem (symbol_ref ("stackleak_track_stack")
278 * [flags 0x41] <function_decl 0x7f7cd3302a80 stackleak_track_stack>)
279 * [0 stackleak_track_stack S1 A8]) (0)) 675 {*call} (expr_list
280 * (symbol_ref ("stackleak_track_stack") [flags 0x41] <function_decl
281 * 0x7f7cd3302a80 stackleak_track_stack>) (expr_list (0) (nil))) (nil))
282 */
283 for (insn = get_insns(); insn; insn = next) {
284 rtx body;
285
286 next = NEXT_INSN(insn);
287
288 /* Check the expression code of the insn */
289 if (!CALL_P(insn))
290 continue;
291
292 /*
293 * Check the expression code of the insn body, which is an RTL
294 * Expression (RTX) describing the side effect performed by
295 * that insn.
296 */
297 body = PATTERN(insn);
298
299 if (GET_CODE(body) == PARALLEL)
300 body = XVECEXP(body, 0, 0);
301
302 if (GET_CODE(body) != CALL)
303 continue;
304
305 /*
306 * Check the first operand of the call expression. It should
307 * be a mem RTX describing the needed subroutine with a
308 * symbol_ref RTX.
309 */
310 body = XEXP(body, 0);
311 if (GET_CODE(body) != MEM)
312 continue;
313
314 body = XEXP(body, 0);
315 if (GET_CODE(body) != SYMBOL_REF)
316 continue;
317
318 if (SYMBOL_REF_DECL(body) != track_function_decl)
319 continue;
320
321 /* Delete the stackleak_track_stack() call */
322 delete_insn_and_edges(insn);
323#if BUILDING_GCC_VERSION < 8000
324 if (GET_CODE(next) == NOTE &&
325 NOTE_KIND(next) == NOTE_INSN_CALL_ARG_LOCATION) {
326 insn = next;
327 next = NEXT_INSN(insn);
328 delete_insn_and_edges(insn);
329 }
330#endif
331 }
332}
333
334static bool remove_stack_tracking_gasm(void)
335{
336 bool removed = false;
337 rtx_insn *insn, *next;
338
339 /* 'no_caller_saved_registers' is currently supported only for x86 */
340 gcc_assert(build_for_x86);
341
342 /*
343 * Find stackleak_track_stack() asm calls. Loop through the chain of
344 * insns, which is an RTL representation of the code for a function.
345 *
346 * The example of a matching insn:
347 * (insn 11 5 12 2 (parallel [ (asm_operands/v
348 * ("call stackleak_track_stack") ("") 0
349 * [ (reg/v:DI 7 sp [ current_stack_pointer ]) ]
350 * [ (asm_input:DI ("r")) ] [])
351 * (clobber (reg:CC 17 flags)) ]) -1 (nil))
352 */
353 for (insn = get_insns(); insn; insn = next) {
354 rtx body;
355
356 next = NEXT_INSN(insn);
357
358 /* Check the expression code of the insn */
359 if (!NONJUMP_INSN_P(insn))
360 continue;
361
362 /*
363 * Check the expression code of the insn body, which is an RTL
364 * Expression (RTX) describing the side effect performed by
365 * that insn.
366 */
367 body = PATTERN(insn);
368
369 if (GET_CODE(body) != PARALLEL)
370 continue;
371
372 body = XVECEXP(body, 0, 0);
373
374 if (GET_CODE(body) != ASM_OPERANDS)
375 continue;
376
377 if (strcmp(ASM_OPERANDS_TEMPLATE(body),
378 "call stackleak_track_stack")) {
379 continue;
380 }
381
382 delete_insn_and_edges(insn);
383 gcc_assert(!removed);
384 removed = true;
385 }
386
387 return removed;
388}
389
390/*
391 * Work with the RTL representation of the code.
392 * Remove the unneeded stackleak_track_stack() calls from the functions
393 * which don't call alloca() and don't have a large enough stack frame size.
394 */
395static unsigned int stackleak_cleanup_execute(void)
396{
397 const char *fn = DECL_NAME_POINTER(current_function_decl);
398 bool removed = false;
399
400 /*
401 * Leave stack tracking in functions that call alloca().
402 * Additional case:
403 * gcc before version 7 called allocate_dynamic_stack_space() from
404 * expand_stack_vars() for runtime alignment of constant-sized stack
405 * variables. That caused cfun->calls_alloca to be set for functions
406 * that in fact don't use alloca().
407 * For more info see gcc commit 7072df0aae0c59ae437e.
408 * Let's leave such functions instrumented as well.
409 */
410 if (cfun->calls_alloca) {
411 if (verbose)
412 fprintf(stderr, "stackleak: instrument %s(): calls_alloca\n", fn);
413 return 0;
414 }
415
416 /* Leave stack tracking in functions with large stack frame */
417 if (large_stack_frame()) {
418 if (verbose)
419 fprintf(stderr, "stackleak: instrument %s()\n", fn);
420 return 0;
421 }
422
423 if (lookup_attribute_spec(get_identifier("no_caller_saved_registers")))
424 removed = remove_stack_tracking_gasm();
425
426 if (!removed)
427 remove_stack_tracking_gcall();
428
429 return 0;
430}
431
432/*
433 * STRING_CST may or may not be NUL terminated:
434 * https://gcc.gnu.org/onlinedocs/gccint/Constant-expressions.html
435 */
436static inline bool string_equal(tree node, const char *string, int length)
437{
438 if (TREE_STRING_LENGTH(node) < length)
439 return false;
440 if (TREE_STRING_LENGTH(node) > length + 1)
441 return false;
442 if (TREE_STRING_LENGTH(node) == length + 1 &&
443 TREE_STRING_POINTER(node)[length] != '\0')
444 return false;
445 return !memcmp(TREE_STRING_POINTER(node), string, length);
446}
447#define STRING_EQUAL(node, str) string_equal(node, str, strlen(str))
448
449static bool stackleak_gate(void)
450{
451 tree section;
452
453 section = lookup_attribute("section",
454 DECL_ATTRIBUTES(current_function_decl));
455 if (section && TREE_VALUE(section)) {
456 section = TREE_VALUE(TREE_VALUE(section));
457
458 if (STRING_EQUAL(section, ".init.text"))
459 return false;
460 if (STRING_EQUAL(section, ".devinit.text"))
461 return false;
462 if (STRING_EQUAL(section, ".cpuinit.text"))
463 return false;
464 if (STRING_EQUAL(section, ".meminit.text"))
465 return false;
466 if (STRING_EQUAL(section, ".noinstr.text"))
467 return false;
468 if (STRING_EQUAL(section, ".entry.text"))
469 return false;
470 }
471
472 return track_frame_size >= 0;
473}
474
475/* Build the function declaration for stackleak_track_stack() */
476static void stackleak_start_unit(void *gcc_data __unused,
477 void *user_data __unused)
478{
479 tree fntype;
480
481 /* void stackleak_track_stack(void) */
482 fntype = build_function_type_list(void_type_node, NULL_TREE);
483 track_function_decl = build_fn_decl(track_function, fntype);
484 DECL_ASSEMBLER_NAME(track_function_decl); /* for LTO */
485 TREE_PUBLIC(track_function_decl) = 1;
486 TREE_USED(track_function_decl) = 1;
487 DECL_EXTERNAL(track_function_decl) = 1;
488 DECL_ARTIFICIAL(track_function_decl) = 1;
489 DECL_PRESERVE_P(track_function_decl) = 1;
490}
491
492/*
493 * Pass gate function is a predicate function that gets executed before the
494 * corresponding pass. If the return value is 'true' the pass gets executed,
495 * otherwise, it is skipped.
496 */
497static bool stackleak_instrument_gate(void)
498{
499 return stackleak_gate();
500}
501
502#define PASS_NAME stackleak_instrument
503#define PROPERTIES_REQUIRED PROP_gimple_leh | PROP_cfg
504#define TODO_FLAGS_START TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts
505#define TODO_FLAGS_FINISH TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func \
506 | TODO_update_ssa | TODO_rebuild_cgraph_edges
507#include "gcc-generate-gimple-pass.h"
508
509static bool stackleak_cleanup_gate(void)
510{
511 return stackleak_gate();
512}
513
514#define PASS_NAME stackleak_cleanup
515#define TODO_FLAGS_FINISH TODO_dump_func
516#include "gcc-generate-rtl-pass.h"
517
518/*
519 * Every gcc plugin exports a plugin_init() function that is called right
520 * after the plugin is loaded. This function is responsible for registering
521 * the plugin callbacks and doing other required initialization.
522 */
523__visible int plugin_init(struct plugin_name_args *plugin_info,
524 struct plugin_gcc_version *version)
525{
526 const char * const plugin_name = plugin_info->base_name;
527 const int argc = plugin_info->argc;
528 const struct plugin_argument * const argv = plugin_info->argv;
529 int i = 0;
530
531 /* Extra GGC root tables describing our GTY-ed data */
532 static const struct ggc_root_tab gt_ggc_r_gt_stackleak[] = {
533 {
534 .base = &track_function_decl,
535 .nelt = 1,
536 .stride = sizeof(track_function_decl),
537 .cb = >_ggc_mx_tree_node,
538 .pchw = >_pch_nx_tree_node
539 },
540 LAST_GGC_ROOT_TAB
541 };
542
543 /*
544 * The stackleak_instrument pass should be executed before the
545 * "optimized" pass, which is the control flow graph cleanup that is
546 * performed just before expanding gcc trees to the RTL. In former
547 * versions of the plugin this new pass was inserted before the
548 * "tree_profile" pass, which is currently called "profile".
549 */
550 PASS_INFO(stackleak_instrument, "optimized", 1,
551 PASS_POS_INSERT_BEFORE);
552
553 /*
554 * The stackleak_cleanup pass should be executed before the "*free_cfg"
555 * pass. It's the moment when the stack frame size is already final,
556 * function prologues and epilogues are generated, and the
557 * machine-dependent code transformations are not done.
558 */
559 PASS_INFO(stackleak_cleanup, "*free_cfg", 1, PASS_POS_INSERT_BEFORE);
560
561 if (!plugin_default_version_check(version, &gcc_version)) {
562 error(G_("incompatible gcc/plugin versions"));
563 return 1;
564 }
565
566 /* Parse the plugin arguments */
567 for (i = 0; i < argc; i++) {
568 if (!strcmp(argv[i].key, "track-min-size")) {
569 if (!argv[i].value) {
570 error(G_("no value supplied for option '-fplugin-arg-%s-%s'"),
571 plugin_name, argv[i].key);
572 return 1;
573 }
574
575 track_frame_size = atoi(argv[i].value);
576 if (track_frame_size < 0) {
577 error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"),
578 plugin_name, argv[i].key, argv[i].value);
579 return 1;
580 }
581 } else if (!strcmp(argv[i].key, "arch")) {
582 if (!argv[i].value) {
583 error(G_("no value supplied for option '-fplugin-arg-%s-%s'"),
584 plugin_name, argv[i].key);
585 return 1;
586 }
587
588 if (!strcmp(argv[i].value, "x86"))
589 build_for_x86 = true;
590 } else if (!strcmp(argv[i].key, "disable")) {
591 disable = true;
592 } else if (!strcmp(argv[i].key, "verbose")) {
593 verbose = true;
594 } else {
595 error(G_("unknown option '-fplugin-arg-%s-%s'"),
596 plugin_name, argv[i].key);
597 return 1;
598 }
599 }
600
601 if (disable) {
602 if (verbose)
603 fprintf(stderr, "stackleak: disabled for this translation unit\n");
604 return 0;
605 }
606
607 /* Give the information about the plugin */
608 register_callback(plugin_name, PLUGIN_INFO, NULL,
609 &stackleak_plugin_info);
610
611 /* Register to be called before processing a translation unit */
612 register_callback(plugin_name, PLUGIN_START_UNIT,
613 &stackleak_start_unit, NULL);
614
615 /* Register an extra GCC garbage collector (GGC) root table */
616 register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL,
617 (void *)>_ggc_r_gt_stackleak);
618
619 /*
620 * Hook into the Pass Manager to register new gcc passes.
621 *
622 * The stack frame size info is available only at the last RTL pass,
623 * when it's too late to insert complex code like a function call.
624 * So we register two gcc passes to instrument every function at first
625 * and remove the unneeded instrumentation later.
626 */
627 register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL,
628 &stackleak_instrument_pass_info);
629 register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL,
630 &stackleak_cleanup_pass_info);
631
632 return 0;
633}
1/*
2 * Copyright 2011-2017 by the PaX Team <pageexec@freemail.hu>
3 * Modified by Alexander Popov <alex.popov@linux.com>
4 * Licensed under the GPL v2
5 *
6 * Note: the choice of the license means that the compilation process is
7 * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
8 * but for the kernel it doesn't matter since it doesn't link against
9 * any of the gcc libraries
10 *
11 * This gcc plugin is needed for tracking the lowest border of the kernel stack.
12 * It instruments the kernel code inserting stackleak_track_stack() calls:
13 * - after alloca();
14 * - for the functions with a stack frame size greater than or equal
15 * to the "track-min-size" plugin parameter.
16 *
17 * This plugin is ported from grsecurity/PaX. For more information see:
18 * https://grsecurity.net/
19 * https://pax.grsecurity.net/
20 *
21 * Debugging:
22 * - use fprintf() to stderr, debug_generic_expr(), debug_gimple_stmt(),
23 * print_rtl_single() and debug_rtx();
24 * - add "-fdump-tree-all -fdump-rtl-all" to the plugin CFLAGS in
25 * Makefile.gcc-plugins to see the verbose dumps of the gcc passes;
26 * - use gcc -E to understand the preprocessing shenanigans;
27 * - use gcc with enabled CFG/GIMPLE/SSA verification (--enable-checking).
28 */
29
30#include "gcc-common.h"
31
32__visible int plugin_is_GPL_compatible;
33
34static int track_frame_size = -1;
35static bool build_for_x86 = false;
36static const char track_function[] = "stackleak_track_stack";
37static bool disable = false;
38static bool verbose = false;
39
40/*
41 * Mark these global variables (roots) for gcc garbage collector since
42 * they point to the garbage-collected memory.
43 */
44static GTY(()) tree track_function_decl;
45
46static struct plugin_info stackleak_plugin_info = {
47 .version = "201707101337",
48 .help = "track-min-size=nn\ttrack stack for functions with a stack frame size >= nn bytes\n"
49 "arch=target_arch\tspecify target build arch\n"
50 "disable\t\tdo not activate the plugin\n"
51 "verbose\t\tprint info about the instrumentation\n"
52};
53
54static void add_stack_tracking_gcall(gimple_stmt_iterator *gsi, bool after)
55{
56 gimple stmt;
57 gcall *gimple_call;
58 cgraph_node_ptr node;
59 basic_block bb;
60
61 /* Insert calling stackleak_track_stack() */
62 stmt = gimple_build_call(track_function_decl, 0);
63 gimple_call = as_a_gcall(stmt);
64 if (after)
65 gsi_insert_after(gsi, gimple_call, GSI_CONTINUE_LINKING);
66 else
67 gsi_insert_before(gsi, gimple_call, GSI_SAME_STMT);
68
69 /* Update the cgraph */
70 bb = gimple_bb(gimple_call);
71 node = cgraph_get_create_node(track_function_decl);
72 gcc_assert(node);
73 cgraph_create_edge(cgraph_get_node(current_function_decl), node,
74 gimple_call, bb->count,
75 compute_call_stmt_bb_frequency(current_function_decl, bb));
76}
77
78static bool is_alloca(gimple stmt)
79{
80 if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA))
81 return true;
82
83#if BUILDING_GCC_VERSION >= 4007
84 if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA_WITH_ALIGN))
85 return true;
86#endif
87
88 return false;
89}
90
91static tree get_current_stack_pointer_decl(void)
92{
93 varpool_node_ptr node;
94
95 FOR_EACH_VARIABLE(node) {
96 tree var = NODE_DECL(node);
97 tree name = DECL_NAME(var);
98
99 if (DECL_NAME_LENGTH(var) != sizeof("current_stack_pointer") - 1)
100 continue;
101
102 if (strcmp(IDENTIFIER_POINTER(name), "current_stack_pointer"))
103 continue;
104
105 return var;
106 }
107
108 if (verbose) {
109 fprintf(stderr, "stackleak: missing current_stack_pointer in %s()\n",
110 DECL_NAME_POINTER(current_function_decl));
111 }
112 return NULL_TREE;
113}
114
115static void add_stack_tracking_gasm(gimple_stmt_iterator *gsi, bool after)
116{
117 gasm *asm_call = NULL;
118 tree sp_decl, input;
119 vec<tree, va_gc> *inputs = NULL;
120
121 /* 'no_caller_saved_registers' is currently supported only for x86 */
122 gcc_assert(build_for_x86);
123
124 /*
125 * Insert calling stackleak_track_stack() in asm:
126 * asm volatile("call stackleak_track_stack"
127 * :: "r" (current_stack_pointer))
128 * Use ASM_CALL_CONSTRAINT trick from arch/x86/include/asm/asm.h.
129 * This constraint is taken into account during gcc shrink-wrapping
130 * optimization. It is needed to be sure that stackleak_track_stack()
131 * call is inserted after the prologue of the containing function,
132 * when the stack frame is prepared.
133 */
134 sp_decl = get_current_stack_pointer_decl();
135 if (sp_decl == NULL_TREE) {
136 add_stack_tracking_gcall(gsi, after);
137 return;
138 }
139 input = build_tree_list(NULL_TREE, build_const_char_string(2, "r"));
140 input = chainon(NULL_TREE, build_tree_list(input, sp_decl));
141 vec_safe_push(inputs, input);
142 asm_call = gimple_build_asm_vec("call stackleak_track_stack",
143 inputs, NULL, NULL, NULL);
144 gimple_asm_set_volatile(asm_call, true);
145 if (after)
146 gsi_insert_after(gsi, asm_call, GSI_CONTINUE_LINKING);
147 else
148 gsi_insert_before(gsi, asm_call, GSI_SAME_STMT);
149 update_stmt(asm_call);
150}
151
152static void add_stack_tracking(gimple_stmt_iterator *gsi, bool after)
153{
154 /*
155 * The 'no_caller_saved_registers' attribute is used for
156 * stackleak_track_stack(). If the compiler supports this attribute for
157 * the target arch, we can add calling stackleak_track_stack() in asm.
158 * That improves performance: we avoid useless operations with the
159 * caller-saved registers in the functions from which we will remove
160 * stackleak_track_stack() call during the stackleak_cleanup pass.
161 */
162 if (lookup_attribute_spec(get_identifier("no_caller_saved_registers")))
163 add_stack_tracking_gasm(gsi, after);
164 else
165 add_stack_tracking_gcall(gsi, after);
166}
167
168/*
169 * Work with the GIMPLE representation of the code. Insert the
170 * stackleak_track_stack() call after alloca() and into the beginning
171 * of the function if it is not instrumented.
172 */
173static unsigned int stackleak_instrument_execute(void)
174{
175 basic_block bb, entry_bb;
176 bool prologue_instrumented = false, is_leaf = true;
177 gimple_stmt_iterator gsi = { 0 };
178
179 /*
180 * ENTRY_BLOCK_PTR is a basic block which represents possible entry
181 * point of a function. This block does not contain any code and
182 * has a CFG edge to its successor.
183 */
184 gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
185 entry_bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
186
187 /*
188 * Loop through the GIMPLE statements in each of cfun basic blocks.
189 * cfun is a global variable which represents the function that is
190 * currently processed.
191 */
192 FOR_EACH_BB_FN(bb, cfun) {
193 for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
194 gimple stmt;
195
196 stmt = gsi_stmt(gsi);
197
198 /* Leaf function is a function which makes no calls */
199 if (is_gimple_call(stmt))
200 is_leaf = false;
201
202 if (!is_alloca(stmt))
203 continue;
204
205 if (verbose) {
206 fprintf(stderr, "stackleak: be careful, alloca() in %s()\n",
207 DECL_NAME_POINTER(current_function_decl));
208 }
209
210 /* Insert stackleak_track_stack() call after alloca() */
211 add_stack_tracking(&gsi, true);
212 if (bb == entry_bb)
213 prologue_instrumented = true;
214 }
215 }
216
217 if (prologue_instrumented)
218 return 0;
219
220 /*
221 * Special cases to skip the instrumentation.
222 *
223 * Taking the address of static inline functions materializes them,
224 * but we mustn't instrument some of them as the resulting stack
225 * alignment required by the function call ABI will break other
226 * assumptions regarding the expected (but not otherwise enforced)
227 * register clobbering ABI.
228 *
229 * Case in point: native_save_fl on amd64 when optimized for size
230 * clobbers rdx if it were instrumented here.
231 *
232 * TODO: any more special cases?
233 */
234 if (is_leaf &&
235 !TREE_PUBLIC(current_function_decl) &&
236 DECL_DECLARED_INLINE_P(current_function_decl)) {
237 return 0;
238 }
239
240 if (is_leaf &&
241 !strncmp(IDENTIFIER_POINTER(DECL_NAME(current_function_decl)),
242 "_paravirt_", 10)) {
243 return 0;
244 }
245
246 /* Insert stackleak_track_stack() call at the function beginning */
247 bb = entry_bb;
248 if (!single_pred_p(bb)) {
249 /* gcc_assert(bb_loop_depth(bb) ||
250 (bb->flags & BB_IRREDUCIBLE_LOOP)); */
251 split_edge(single_succ_edge(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
252 gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
253 bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
254 }
255 gsi = gsi_after_labels(bb);
256 add_stack_tracking(&gsi, false);
257
258 return 0;
259}
260
261static bool large_stack_frame(void)
262{
263#if BUILDING_GCC_VERSION >= 8000
264 return maybe_ge(get_frame_size(), track_frame_size);
265#else
266 return (get_frame_size() >= track_frame_size);
267#endif
268}
269
270static void remove_stack_tracking_gcall(void)
271{
272 rtx_insn *insn, *next;
273
274 /*
275 * Find stackleak_track_stack() calls. Loop through the chain of insns,
276 * which is an RTL representation of the code for a function.
277 *
278 * The example of a matching insn:
279 * (call_insn 8 4 10 2 (call (mem (symbol_ref ("stackleak_track_stack")
280 * [flags 0x41] <function_decl 0x7f7cd3302a80 stackleak_track_stack>)
281 * [0 stackleak_track_stack S1 A8]) (0)) 675 {*call} (expr_list
282 * (symbol_ref ("stackleak_track_stack") [flags 0x41] <function_decl
283 * 0x7f7cd3302a80 stackleak_track_stack>) (expr_list (0) (nil))) (nil))
284 */
285 for (insn = get_insns(); insn; insn = next) {
286 rtx body;
287
288 next = NEXT_INSN(insn);
289
290 /* Check the expression code of the insn */
291 if (!CALL_P(insn))
292 continue;
293
294 /*
295 * Check the expression code of the insn body, which is an RTL
296 * Expression (RTX) describing the side effect performed by
297 * that insn.
298 */
299 body = PATTERN(insn);
300
301 if (GET_CODE(body) == PARALLEL)
302 body = XVECEXP(body, 0, 0);
303
304 if (GET_CODE(body) != CALL)
305 continue;
306
307 /*
308 * Check the first operand of the call expression. It should
309 * be a mem RTX describing the needed subroutine with a
310 * symbol_ref RTX.
311 */
312 body = XEXP(body, 0);
313 if (GET_CODE(body) != MEM)
314 continue;
315
316 body = XEXP(body, 0);
317 if (GET_CODE(body) != SYMBOL_REF)
318 continue;
319
320 if (SYMBOL_REF_DECL(body) != track_function_decl)
321 continue;
322
323 /* Delete the stackleak_track_stack() call */
324 delete_insn_and_edges(insn);
325#if BUILDING_GCC_VERSION >= 4007 && BUILDING_GCC_VERSION < 8000
326 if (GET_CODE(next) == NOTE &&
327 NOTE_KIND(next) == NOTE_INSN_CALL_ARG_LOCATION) {
328 insn = next;
329 next = NEXT_INSN(insn);
330 delete_insn_and_edges(insn);
331 }
332#endif
333 }
334}
335
336static bool remove_stack_tracking_gasm(void)
337{
338 bool removed = false;
339 rtx_insn *insn, *next;
340
341 /* 'no_caller_saved_registers' is currently supported only for x86 */
342 gcc_assert(build_for_x86);
343
344 /*
345 * Find stackleak_track_stack() asm calls. Loop through the chain of
346 * insns, which is an RTL representation of the code for a function.
347 *
348 * The example of a matching insn:
349 * (insn 11 5 12 2 (parallel [ (asm_operands/v
350 * ("call stackleak_track_stack") ("") 0
351 * [ (reg/v:DI 7 sp [ current_stack_pointer ]) ]
352 * [ (asm_input:DI ("r")) ] [])
353 * (clobber (reg:CC 17 flags)) ]) -1 (nil))
354 */
355 for (insn = get_insns(); insn; insn = next) {
356 rtx body;
357
358 next = NEXT_INSN(insn);
359
360 /* Check the expression code of the insn */
361 if (!NONJUMP_INSN_P(insn))
362 continue;
363
364 /*
365 * Check the expression code of the insn body, which is an RTL
366 * Expression (RTX) describing the side effect performed by
367 * that insn.
368 */
369 body = PATTERN(insn);
370
371 if (GET_CODE(body) != PARALLEL)
372 continue;
373
374 body = XVECEXP(body, 0, 0);
375
376 if (GET_CODE(body) != ASM_OPERANDS)
377 continue;
378
379 if (strcmp(ASM_OPERANDS_TEMPLATE(body),
380 "call stackleak_track_stack")) {
381 continue;
382 }
383
384 delete_insn_and_edges(insn);
385 gcc_assert(!removed);
386 removed = true;
387 }
388
389 return removed;
390}
391
392/*
393 * Work with the RTL representation of the code.
394 * Remove the unneeded stackleak_track_stack() calls from the functions
395 * which don't call alloca() and don't have a large enough stack frame size.
396 */
397static unsigned int stackleak_cleanup_execute(void)
398{
399 const char *fn = DECL_NAME_POINTER(current_function_decl);
400 bool removed = false;
401
402 /*
403 * Leave stack tracking in functions that call alloca().
404 * Additional case:
405 * gcc before version 7 called allocate_dynamic_stack_space() from
406 * expand_stack_vars() for runtime alignment of constant-sized stack
407 * variables. That caused cfun->calls_alloca to be set for functions
408 * that in fact don't use alloca().
409 * For more info see gcc commit 7072df0aae0c59ae437e.
410 * Let's leave such functions instrumented as well.
411 */
412 if (cfun->calls_alloca) {
413 if (verbose)
414 fprintf(stderr, "stackleak: instrument %s(): calls_alloca\n", fn);
415 return 0;
416 }
417
418 /* Leave stack tracking in functions with large stack frame */
419 if (large_stack_frame()) {
420 if (verbose)
421 fprintf(stderr, "stackleak: instrument %s()\n", fn);
422 return 0;
423 }
424
425 if (lookup_attribute_spec(get_identifier("no_caller_saved_registers")))
426 removed = remove_stack_tracking_gasm();
427
428 if (!removed)
429 remove_stack_tracking_gcall();
430
431 return 0;
432}
433
434static bool stackleak_gate(void)
435{
436 tree section;
437
438 section = lookup_attribute("section",
439 DECL_ATTRIBUTES(current_function_decl));
440 if (section && TREE_VALUE(section)) {
441 section = TREE_VALUE(TREE_VALUE(section));
442
443 if (!strncmp(TREE_STRING_POINTER(section), ".init.text", 10))
444 return false;
445 if (!strncmp(TREE_STRING_POINTER(section), ".devinit.text", 13))
446 return false;
447 if (!strncmp(TREE_STRING_POINTER(section), ".cpuinit.text", 13))
448 return false;
449 if (!strncmp(TREE_STRING_POINTER(section), ".meminit.text", 13))
450 return false;
451 }
452
453 return track_frame_size >= 0;
454}
455
456/* Build the function declaration for stackleak_track_stack() */
457static void stackleak_start_unit(void *gcc_data __unused,
458 void *user_data __unused)
459{
460 tree fntype;
461
462 /* void stackleak_track_stack(void) */
463 fntype = build_function_type_list(void_type_node, NULL_TREE);
464 track_function_decl = build_fn_decl(track_function, fntype);
465 DECL_ASSEMBLER_NAME(track_function_decl); /* for LTO */
466 TREE_PUBLIC(track_function_decl) = 1;
467 TREE_USED(track_function_decl) = 1;
468 DECL_EXTERNAL(track_function_decl) = 1;
469 DECL_ARTIFICIAL(track_function_decl) = 1;
470 DECL_PRESERVE_P(track_function_decl) = 1;
471}
472
473/*
474 * Pass gate function is a predicate function that gets executed before the
475 * corresponding pass. If the return value is 'true' the pass gets executed,
476 * otherwise, it is skipped.
477 */
478static bool stackleak_instrument_gate(void)
479{
480 return stackleak_gate();
481}
482
483#define PASS_NAME stackleak_instrument
484#define PROPERTIES_REQUIRED PROP_gimple_leh | PROP_cfg
485#define TODO_FLAGS_START TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts
486#define TODO_FLAGS_FINISH TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func \
487 | TODO_update_ssa | TODO_rebuild_cgraph_edges
488#include "gcc-generate-gimple-pass.h"
489
490static bool stackleak_cleanup_gate(void)
491{
492 return stackleak_gate();
493}
494
495#define PASS_NAME stackleak_cleanup
496#define TODO_FLAGS_FINISH TODO_dump_func
497#include "gcc-generate-rtl-pass.h"
498
499/*
500 * Every gcc plugin exports a plugin_init() function that is called right
501 * after the plugin is loaded. This function is responsible for registering
502 * the plugin callbacks and doing other required initialization.
503 */
504__visible int plugin_init(struct plugin_name_args *plugin_info,
505 struct plugin_gcc_version *version)
506{
507 const char * const plugin_name = plugin_info->base_name;
508 const int argc = plugin_info->argc;
509 const struct plugin_argument * const argv = plugin_info->argv;
510 int i = 0;
511
512 /* Extra GGC root tables describing our GTY-ed data */
513 static const struct ggc_root_tab gt_ggc_r_gt_stackleak[] = {
514 {
515 .base = &track_function_decl,
516 .nelt = 1,
517 .stride = sizeof(track_function_decl),
518 .cb = >_ggc_mx_tree_node,
519 .pchw = >_pch_nx_tree_node
520 },
521 LAST_GGC_ROOT_TAB
522 };
523
524 /*
525 * The stackleak_instrument pass should be executed before the
526 * "optimized" pass, which is the control flow graph cleanup that is
527 * performed just before expanding gcc trees to the RTL. In former
528 * versions of the plugin this new pass was inserted before the
529 * "tree_profile" pass, which is currently called "profile".
530 */
531 PASS_INFO(stackleak_instrument, "optimized", 1,
532 PASS_POS_INSERT_BEFORE);
533
534 /*
535 * The stackleak_cleanup pass should be executed before the "*free_cfg"
536 * pass. It's the moment when the stack frame size is already final,
537 * function prologues and epilogues are generated, and the
538 * machine-dependent code transformations are not done.
539 */
540 PASS_INFO(stackleak_cleanup, "*free_cfg", 1, PASS_POS_INSERT_BEFORE);
541
542 if (!plugin_default_version_check(version, &gcc_version)) {
543 error(G_("incompatible gcc/plugin versions"));
544 return 1;
545 }
546
547 /* Parse the plugin arguments */
548 for (i = 0; i < argc; i++) {
549 if (!strcmp(argv[i].key, "track-min-size")) {
550 if (!argv[i].value) {
551 error(G_("no value supplied for option '-fplugin-arg-%s-%s'"),
552 plugin_name, argv[i].key);
553 return 1;
554 }
555
556 track_frame_size = atoi(argv[i].value);
557 if (track_frame_size < 0) {
558 error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"),
559 plugin_name, argv[i].key, argv[i].value);
560 return 1;
561 }
562 } else if (!strcmp(argv[i].key, "arch")) {
563 if (!argv[i].value) {
564 error(G_("no value supplied for option '-fplugin-arg-%s-%s'"),
565 plugin_name, argv[i].key);
566 return 1;
567 }
568
569 if (!strcmp(argv[i].value, "x86"))
570 build_for_x86 = true;
571 } else if (!strcmp(argv[i].key, "disable")) {
572 disable = true;
573 } else if (!strcmp(argv[i].key, "verbose")) {
574 verbose = true;
575 } else {
576 error(G_("unknown option '-fplugin-arg-%s-%s'"),
577 plugin_name, argv[i].key);
578 return 1;
579 }
580 }
581
582 if (disable) {
583 if (verbose)
584 fprintf(stderr, "stackleak: disabled for this translation unit\n");
585 return 0;
586 }
587
588 /* Give the information about the plugin */
589 register_callback(plugin_name, PLUGIN_INFO, NULL,
590 &stackleak_plugin_info);
591
592 /* Register to be called before processing a translation unit */
593 register_callback(plugin_name, PLUGIN_START_UNIT,
594 &stackleak_start_unit, NULL);
595
596 /* Register an extra GCC garbage collector (GGC) root table */
597 register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL,
598 (void *)>_ggc_r_gt_stackleak);
599
600 /*
601 * Hook into the Pass Manager to register new gcc passes.
602 *
603 * The stack frame size info is available only at the last RTL pass,
604 * when it's too late to insert complex code like a function call.
605 * So we register two gcc passes to instrument every function at first
606 * and remove the unneeded instrumentation later.
607 */
608 register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL,
609 &stackleak_instrument_pass_info);
610 register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL,
611 &stackleak_cleanup_pass_info);
612
613 return 0;
614}