Add control flow integrity diagnosis function to UBSan runtime library.

[pcc]

Summary

Also includes execution tests for the feature.

[pcc]

Refresh

[samsonov]

LGTM

test/cfi/lit.cfg

12

I think it would be easier to construct list of args for clangxx_cfi, and clangxx_cfi_diag, and then do ' '.join(...) for both of them. Leaving this up to you, though.

lib/ubsan/ubsan_handlers_cxx.h

 
 struct DynamicTypeCacheMissData {
   SourceLocation Loc;
   const TypeDescriptor &Type;
   void *TypeInfo;
   unsigned char TypeCheckKind;
 };
 
+struct CFIBadTypeData {
+  SourceLocation Loc;
+  const TypeDescriptor &Type;
+  unsigned char TypeCheckKind;
+};
+
 /// \brief Handle a runtime type check failure, caused by an incorrect vptr.
 /// When this handler is called, all we know is that the type was not in the
 /// cache; this does not necessarily imply the existence of a bug.
 extern "C" SANITIZER_INTERFACE_ATTRIBUTE
 void __ubsan_handle_dynamic_type_cache_miss(
   DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash);
 extern "C" SANITIZER_INTERFACE_ATTRIBUTE
 void __ubsan_handle_dynamic_type_cache_miss_abort(
   DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash);
 
+/// \brief Handle a control flow integrity check failure by printing a
+/// diagnostic.
+extern "C" SANITIZER_INTERFACE_ATTRIBUTE void
+__ubsan_handle_cfi_bad_type(CFIBadTypeData *Data, ValueHandle Vtable);
+extern "C" SANITIZER_INTERFACE_ATTRIBUTE void
+__ubsan_handle_cfi_bad_type_abort(CFIBadTypeData *Data, ValueHandle Vtable);
+
 }
 
 #endif // UBSAN_HANDLERS_H

lib/ubsan/ubsan_handlers_cxx.cc

 static void HandleDynamicTypeCacheMiss(
     DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash,
     ReportOptions Opts) {
   if (checkDynamicType((void*)Pointer, Data->TypeInfo, Hash))
     // Just a cache miss. The type matches after all.
     return;
 
   // Check if error report should be suppressed.
-  DynamicTypeInfo DTI = getDynamicTypeInfo((void*)Pointer);
+  DynamicTypeInfo DTI = getDynamicTypeInfoFromObject((void*)Pointer);
   if (DTI.isValid() && IsVptrCheckSuppressed(DTI.getMostDerivedTypeName()))
     return;
 
   SourceLocation Loc = Data->Loc.acquire();
   if (Loc.isDisabled())
     return;
 
   ScopedReport R(Opts, Loc);
void __ubsan::__ubsan_handle_dynamic_type_cache_miss(
   HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts);
 }
 void __ubsan::__ubsan_handle_dynamic_type_cache_miss_abort(
     DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
   GET_REPORT_OPTIONS(true);
   HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts);
 }
 
+static void HandleCFIBadType(CFIBadTypeData *Data, ValueHandle Vtable,
+                             ReportOptions Opts) {
+  SourceLocation Loc = Data->Loc.acquire();
+  ScopedReport R(Opts, Loc);
+  DynamicTypeInfo DTI = getDynamicTypeInfoFromVtable((void*)Vtable);
+
+  static const char *TypeCheckKinds[] = {
+    "virtual call",
+    "non-virtual call",
+    "base-to-derived cast",
+    "cast to unrelated type",
+  };
+
+  Diag(Loc, DL_Error, "control flow integrity check for type %0 failed during "
+                      "%1 (vtable address %2)")
+      << Data->Type << TypeCheckKinds[Data->TypeCheckKind] << (void *)Vtable;
+
+  // If possible, say what type it actually points to.
+  if (!DTI.isValid())
+    Diag(Vtable, DL_Note, "invalid vtable");
+  else
+    Diag(Vtable, DL_Note, "vtable is of type %0")
+        << MangledName(DTI.getMostDerivedTypeName());
+}
+
+void __ubsan::__ubsan_handle_cfi_bad_type(CFIBadTypeData *Data,
+                                          ValueHandle Vtable) {
+  GET_REPORT_OPTIONS(false);
+  HandleCFIBadType(Data, Vtable, Opts);
+}
+
+void __ubsan::__ubsan_handle_cfi_bad_type_abort(CFIBadTypeData *Data,
+                                                ValueHandle Vtable) {
+  GET_REPORT_OPTIONS(true);
+  HandleCFIBadType(Data, Vtable, Opts);
+}
+
 #endif  // CAN_SANITIZE_UB

lib/ubsan/ubsan_type_hash.h

public:
   const char *getMostDerivedTypeName() const { return MostDerivedTypeName; }
   /// Get the offset from the most-derived type to this base class.
   sptr getOffset() const { return Offset; }
   /// Get the name of the most-derived type at the specified offset.
   const char *getSubobjectTypeName() const { return SubobjectTypeName; }
 };
 
 /// \brief Get information about the dynamic type of an object.
-DynamicTypeInfo getDynamicTypeInfo(void *Object);
+DynamicTypeInfo getDynamicTypeInfoFromObject(void *Object);
+
+/// \brief Get information about the dynamic type of an object from its vtable.
+DynamicTypeInfo getDynamicTypeInfoFromVtable(void *Vtable);
 
 /// \brief Check whether the dynamic type of \p Object has a \p Type subobject
 /// at offset 0.
 /// \return \c true if the type matches, \c false if not.
 bool checkDynamicType(void *Object, void *Type, HashValue Hash);
 
 const unsigned VptrTypeCacheSize = 128;
 

lib/ubsan/ubsan_type_hash.cc

 struct VtablePrefix {
   /// The offset from the vptr to the start of the most-derived object.
   /// This should never be greater than zero, and will usually be exactly
   /// zero.
   sptr Offset;
   /// The type_info object describing the most-derived class type.
   std::type_info *TypeInfo;
 };
-VtablePrefix *getVtablePrefix(void *Object) {
-  VtablePrefix **VptrPtr = reinterpret_cast<VtablePrefix**>(Object);
-  if (!*VptrPtr)
+VtablePrefix *getVtablePrefix(void *Vtable) {
+  VtablePrefix *Vptr = reinterpret_cast<VtablePrefix*>(Vtable);
+  if (!Vptr)
     return 0;
-  VtablePrefix *Prefix = *VptrPtr - 1;
+  VtablePrefix *Prefix = Vptr - 1;
   if (Prefix->Offset > 0 || !Prefix->TypeInfo)
     // This can't possibly be a valid vtable.
     return 0;
   return Prefix;
 }
 
 }
 
 bool __ubsan::checkDynamicType(void *Object, void *Type, HashValue Hash) {
   // A crash anywhere within this function probably means the vptr is corrupted.
   // FIXME: Perform these checks more cautiously.
 
   // Check whether this is something we've evicted from the cache.
   HashValue *Bucket = getTypeCacheHashTableBucket(Hash);
   if (*Bucket == Hash) {
     __ubsan_vptr_type_cache[Hash % VptrTypeCacheSize] = Hash;
     return true;
   }
 
-  VtablePrefix *Vtable = getVtablePrefix(Object);
+  void *VtablePtr = *reinterpret_cast<void **>(Object);
+  VtablePrefix *Vtable = getVtablePrefix(VtablePtr);
   if (!Vtable)
     return false;
 
   // Check that this is actually a type_info object for a class type.
   abi::__class_type_info *Derived =
     dynamic_cast<abi::__class_type_info*>(Vtable->TypeInfo);
   if (!Derived)
     return false;
 
   abi::__class_type_info *Base = (abi::__class_type_info*)Type;
   if (!isDerivedFromAtOffset(Derived, Base, -Vtable->Offset))
     return false;
 
   // Success. Cache this result.
   __ubsan_vptr_type_cache[Hash % VptrTypeCacheSize] = Hash;
   *Bucket = Hash;
   return true;
 }
 
-__ubsan::DynamicTypeInfo __ubsan::getDynamicTypeInfo(void *Object) {
-  VtablePrefix *Vtable = getVtablePrefix(Object);
+__ubsan::DynamicTypeInfo __ubsan::getDynamicTypeInfoFromObject(void *Object) {
+  void *VtablePtr = *reinterpret_cast<void **>(Object);
+  return getDynamicTypeInfoFromVtable(VtablePtr);
+}
+
+__ubsan::DynamicTypeInfo
+__ubsan::getDynamicTypeInfoFromVtable(void *VtablePtr) {
+  VtablePrefix *Vtable = getVtablePrefix(VtablePtr);
   if (!Vtable)
     return DynamicTypeInfo(0, 0, 0);
   const abi::__class_type_info *ObjectType = findBaseAtOffset(
     static_cast<const abi::__class_type_info*>(Vtable->TypeInfo),
     -Vtable->Offset);
   return DynamicTypeInfo(Vtable->TypeInfo->__type_name, -Vtable->Offset,
                          ObjectType ? ObjectType->__type_name : "<unknown>");
 }
 
 #endif  // CAN_SANITIZE_UB

test/cfi/CMakeLists.txt

 configure_lit_site_cfg(
   ${CMAKE_CURRENT_SOURCE_DIR}/lit.site.cfg.in
   ${CMAKE_CURRENT_BINARY_DIR}/lit.site.cfg
   )
 
 set(CFI_TEST_DEPS)
 if(NOT COMPILER_RT_STANDALONE_BUILD)
   list(APPEND CFI_TEST_DEPS
     FileCheck
     clang
     not
+    ubsan
   )
   if(LLVM_ENABLE_PIC AND LLVM_BINUTILS_INCDIR)
     list(APPEND CFI_TEST_DEPS
       LLVMgold
     )
   endif()
   if(APPLE)
     list(APPEND CFI_TEST_DEPS

test/cfi/anon-namespace.cpp

 // RUN: %clangxx_cfi -o %t %t1.o %t2.o
 // RUN: not --crash %t 2>&1 | FileCheck --check-prefix=CFI %s
 
 // RUN: %clangxx -c -DTU1 -o %t1.o %s
 // RUN: %clangxx -c -DTU2 -o %t2.o %S/../cfi/anon-namespace.cpp
 // RUN: %clangxx -o %t %t1.o %t2.o
 // RUN: %t 2>&1 | FileCheck --check-prefix=NCFI %s
 
+// RUN: %clangxx_cfi_diag -c -DTU1 -o %t1.o %s
+// RUN: %clangxx_cfi_diag -c -DTU2 -o %t2.o %S/../cfi/anon-namespace.cpp
+// RUN: %clangxx_cfi_diag -o %t %t1.o %t2.o
+// RUN: %t 2>&1 | FileCheck --check-prefix=CFI-DIAG %s
+
 // Tests that the CFI mechanism treats classes in the anonymous namespace in
 // different translation units as having distinct identities. This is done by
 // compiling two translation units TU1 and TU2 containing a class named B in an
 // anonymous namespace, and testing that the program crashes if TU2 attempts to
 // use a TU1 B as a TU2 B.
 
 // FIXME: This test should not require that the paths supplied to the compiler
 // are different. It currently does so because bitset names have global scope
#endif
 
   A *a = mkb();
   break_optimization(a);
 
   // CFI: 1
   // NCFI: 1
   fprintf(stderr, "1\n");
 
+  // CFI-DIAG: runtime error: control flow integrity check for type '(anonymous namespace)::B' failed during base-to-derived cast
+  // CFI-DIAG-NEXT: note: vtable is of type '(anonymous namespace)::B'
+  // CFI-DIAG: runtime error: control flow integrity check for type '(anonymous namespace)::B' failed during virtual call
+  // CFI-DIAG-NEXT: note: vtable is of type '(anonymous namespace)::B'
   ((B *)a)->f(); // UB here
 
   // CFI-NOT: 2
   // NCFI: 2
   fprintf(stderr, "2\n");
 }
 
 #endif  // TU2

test/cfi/bad-cast.cpp

 // RUN: %t b 2>&1 | FileCheck --check-prefix=PASS %s
 // RUN: %t c 2>&1 | FileCheck --check-prefix=PASS %s
 // RUN: %t d 2>&1 | FileCheck --check-prefix=PASS %s
 // RUN: %t e 2>&1 | FileCheck --check-prefix=PASS %s
 // RUN: %t f 2>&1 | FileCheck --check-prefix=PASS %s
 // RUN: %t g 2>&1 | FileCheck --check-prefix=PASS %s
 // RUN: %t h 2>&1 | FileCheck --check-prefix=PASS %s
 
+// RUN: %clangxx_cfi_diag -o %t %s
+// RUN: %t a 2>&1 | FileCheck --check-prefix=CFI-DIAG-D %s
+// RUN: %t b 2>&1 | FileCheck --check-prefix=CFI-DIAG-D %s
+// RUN: %t c 2>&1 | FileCheck --check-prefix=CFI-DIAG-D %s
+// RUN: %t g 2>&1 | FileCheck --check-prefix=CFI-DIAG-U %s
+
 // Tests that the CFI enforcement detects bad casts.
 
 #include <stdio.h>
 #include "utils.h"
 
 struct A {
   virtual void f();
 };
#endif
   B *b = new B;
   break_optimization(b);
 
   // FAIL: 1
   // PASS: 1
   fprintf(stderr, "1\n");
 
   A a;
+
+  // CFI-DIAG-D: runtime error: control flow integrity check for type 'B' failed during base-to-derived cast
+  // CFI-DIAG-D-NEXT: note: vtable is of type 'A'
+
+  // CFI-DIAG-U: runtime error: control flow integrity check for type 'B' failed during cast to unrelated type
+  // CFI-DIAG-U-NEXT: note: vtable is of type 'A'
+
   switch (argv[1][0]) {
     case 'a':
       static_cast<B *>(&a); // UB
       break;
     case 'b':
       static_cast<B &>(a); // UB
       break;
     case 'c':

test/cfi/lit.cfg

 import lit.formats
 import os
 
 config.name = 'cfi'
 config.suffixes = ['.cpp']
 config.test_source_root = os.path.dirname(__file__)
 
 clangxx = ' '.join([config.clang] + config.cxx_mode_flags)
 
 config.substitutions.append((r"%clangxx ", clangxx + ' '))
 if config.lto_supported:
-  config.substitutions.append((r"%clangxx_cfi ", ' '.join(config.lto_launch + [clangxx] + config.lto_flags + ['-fsanitize=cfi '])))
+  clangxx_cfi = ' '.join(config.lto_launch + [clangxx] + config.lto_flags + ['-fsanitize=cfi '])
+  config.substitutions.append((r"%clangxx_cfi ", clangxx_cfi))
+  config.substitutions.append((r"%clangxx_cfi_diag ", clangxx_cfi + '-fno-sanitize-trap=cfi -fsanitize-recover=cfi '))
 else:
   config.unsupported = True
 
 if lit_config.params.get('check_supported', None) and config.unsupported:
   raise BaseException("Tests unsupported")

test/cfi/multiple-inheritance.cpp

 // RUN: %clangxx_cfi -DBM -o %t %s
 // RUN: not --crash %t 2>&1 | FileCheck --check-prefix=CFI %s
 // RUN: not --crash %t x 2>&1 | FileCheck --check-prefix=CFI %s
 
 // RUN: %clangxx -o %t %s
 // RUN: %t 2>&1 | FileCheck --check-prefix=NCFI %s
 // RUN: %t x 2>&1 | FileCheck --check-prefix=NCFI %s
 
+// RUN: %clangxx_cfi_diag -o %t %s
+// RUN: %t 2>&1 | FileCheck --check-prefix=CFI-DIAG2 %s
+// RUN: %t x 2>&1 | FileCheck --check-prefix=CFI-DIAG1 %s
+
 // Tests that the CFI mechanism is sensitive to multiple inheritance and only
 // permits calls via virtual tables for the correct base class.
 
 #include <stdio.h>
 #include "utils.h"
 
 struct A {
   virtual void f() = 0;
#endif
   break_optimization(c);
 
   // CFI: 1
   // NCFI: 1
   fprintf(stderr, "1\n");
 
   if (argc > 1) {
     A *a = c;
+    // CFI-DIAG1: runtime error: control flow integrity check for type 'B' failed during cast to unrelated type
+    // CFI-DIAG1-NEXT: note: vtable is of type 'C'
     ((B *)a)->g(); // UB here
   } else {
+    // CFI-DIAG2: runtime error: control flow integrity check for type 'A' failed during cast to unrelated type
+    // CFI-DIAG2-NEXT: note: vtable is of type 'C'
     B *b = c;
     ((A *)b)->f(); // UB here
   }
 
   // CFI-NOT: 2
   // NCFI: 2
   fprintf(stderr, "2\n");
 }

test/cfi/nvcall.cpp

 // RUN: %clangxx_cfi -o %t %s
 // RUN: not --crash %t 2>&1 | FileCheck --check-prefix=CFI %s
 
 // RUN: %clangxx_cfi -DB32 -o %t %s
 // RUN: not --crash %t 2>&1 | FileCheck --check-prefix=CFI %s
 
 // RUN: %clangxx_cfi -DB64 -o %t %s
 // RUN: not --crash %t 2>&1 | FileCheck --check-prefix=CFI %s
 
 // RUN: %clangxx_cfi -DBM -o %t %s
 // RUN: not --crash %t 2>&1 | FileCheck --check-prefix=CFI %s
 
 // RUN: %clangxx -o %t %s
 // RUN: %t 2>&1 | FileCheck --check-prefix=NCFI %s
 
+// RUN: %clangxx_cfi_diag -o %t %s
+// RUN: %t 2>&1 | FileCheck --check-prefix=CFI-DIAG %s
+
 // Tests that the CFI mechanism crashes the program when making a non-virtual
 // call to an object of the wrong class, by casting a pointer to such an object
 // and attempting to make a call through it.
 
 #include <stdio.h>
 #include "utils.h"
 
 struct A {
-  virtual void f();
+  virtual void v();
 };
 
-void A::f() {}
+void A::v() {}
 
 struct B {
   void f();
   virtual void g();
 };
 
 void B::f() {}
 void B::g() {}
#endif
 
   A *a = new A;
   break_optimization(a);
 
   // CFI: 1
   // NCFI: 1
   fprintf(stderr, "1\n");
 
+  // CFI-DIAG: runtime error: control flow integrity check for type 'B' failed during non-virtual call
+  // CFI-DIAG-NEXT: note: vtable is of type 'A'
   ((B *)a)->f(); // UB here
 
   // CFI-NOT: 2
   // NCFI: 2
   fprintf(stderr, "2\n");
 }

test/cfi/overwrite.cpp

 // RUN: %clangxx_cfi -o %t %s
 // RUN: not --crash %t 2>&1 | FileCheck --check-prefix=CFI %s
 
 // RUN: %clangxx_cfi -DB32 -o %t %s
 // RUN: not --crash %t 2>&1 | FileCheck --check-prefix=CFI %s
 
 // RUN: %clangxx_cfi -DB64 -o %t %s
 // RUN: not --crash %t 2>&1 | FileCheck --check-prefix=CFI %s
 
 // RUN: %clangxx_cfi -DBM -o %t %s
 // RUN: not --crash %t 2>&1 | FileCheck --check-prefix=CFI %s
 
 // RUN: %clangxx -o %t %s
 // RUN: %t 2>&1 | FileCheck --check-prefix=NCFI %s
 
+// RUN: %clangxx_cfi_diag -o %t %s
+// RUN: %t 2>&1 | FileCheck --check-prefix=CFI-DIAG %s
+
 // Tests that the CFI mechanism crashes the program when a virtual table is
 // replaced with a compatible table of function pointers that does not belong to
 // any class, by manually overwriting the virtual table of an object and
 // attempting to make a call through it.
 
 #include <stdio.h>
 #include "utils.h"
 
 struct A {
   virtual void f();
 };
 
 void A::f() {}
 
 void foo() {
   fprintf(stderr, "foo\n");
 }
 
-void *fake_vtable[] = { (void *)&foo };
+void *fake_vtable[] = { 0, 0, (void *)&foo };
 
 int main() {
 #ifdef B32
   break_optimization(new Deriver<A, 0>);
 #endif
 
 #ifdef B64
   break_optimization(new Deriver<A, 0>);
   break_optimization(new Deriver<A, 1>);
 #endif
 
 #ifdef BM
   break_optimization(new Deriver<A, 0>);
   break_optimization(new Deriver<A, 1>);
   break_optimization(new Deriver<A, 2>);
 #endif
 
   A *a = new A;
-  *((void **)a) = fake_vtable; // UB here
+  *((void **)a) = fake_vtable + 2; // UB here
   break_optimization(a);
 
   // CFI: 1
   // NCFI: 1
   fprintf(stderr, "1\n");
 
   // CFI-NOT: foo
   // NCFI: foo
+  // CFI-DIAG: runtime error: control flow integrity check for type 'A' failed during virtual call
+  // CFI-DIAG-NEXT: note: invalid vtable
   a->f();
 
   // CFI-NOT: 2
   // NCFI: 2
   fprintf(stderr, "2\n");
 }

test/cfi/simple-fail.cpp

 // RUN: not --crash %t 2>&1 | FileCheck --check-prefix=CFI %s
 
 // RUN: %clangxx_cfi -O3 -DB64 -o %t %s
 // RUN: not --crash %t 2>&1 | FileCheck --check-prefix=CFI %s
 
 // RUN: %clangxx_cfi -O3 -DBM -o %t %s
 // RUN: not --crash %t 2>&1 | FileCheck --check-prefix=CFI %s
 
+// RUN: %clangxx_cfi_diag -o %t %s
+// RUN: %t 2>&1 | FileCheck --check-prefix=CFI-DIAG %s
+
 // RUN: %clangxx -o %t %s
 // RUN: %t 2>&1 | FileCheck --check-prefix=NCFI %s
 
 // Tests that the CFI mechanism crashes the program when making a virtual call
 // to an object of the wrong class but with a compatible vtable, by casting a
 // pointer to such an object and attempting to make a call through it.
 
 #include <stdio.h>
#endif
 
   A *a = new A;
   break_optimization(a);
 
   // CFI: 1
   // NCFI: 1
   fprintf(stderr, "1\n");
 
+  // CFI-DIAG: runtime error: control flow integrity check for type 'B' failed during cast to unrelated type
+  // CFI-DIAG-NEXT: note: vtable is of type 'A'
+  // CFI-DIAG: runtime error: control flow integrity check for type 'B' failed during virtual call
+  // CFI-DIAG-NEXT: note: vtable is of type 'A'
   ((B *)a)->f(); // UB here
 
   // CFI-NOT: 2
   // NCFI: 2
   fprintf(stderr, "2\n");
 }

test/cfi/vdtor.cpp

 // RUN: %clangxx_cfi -o %t %s
 // RUN: not --crash %t 2>&1 | FileCheck --check-prefix=CFI %s
 
 // RUN: %clangxx_cfi -DB32 -o %t %s
 // RUN: not --crash %t 2>&1 | FileCheck --check-prefix=CFI %s
 
 // RUN: %clangxx_cfi -DB64 -o %t %s
 // RUN: not --crash %t 2>&1 | FileCheck --check-prefix=CFI %s
 
 // RUN: %clangxx_cfi -DBM -o %t %s
 // RUN: not --crash %t 2>&1 | FileCheck --check-prefix=CFI %s
 
 // RUN: %clangxx -o %t %s
 // RUN: %t 2>&1 | FileCheck --check-prefix=NCFI %s
 
+// RUN: %clangxx_cfi_diag -o %t %s
+// RUN: %t 2>&1 | FileCheck --check-prefix=CFI-DIAG %s
+
 // Tests that the CFI enforcement also applies to virtual destructor calls made
 // via 'delete'.
 
 #include <stdio.h>
 #include "utils.h"
 
 struct A {
   virtual ~A();
#endif
 
   A *a = new A;
   break_optimization(a);
 
   // CFI: 1
   // NCFI: 1
   fprintf(stderr, "1\n");
 
+  // CFI-DIAG: runtime error: control flow integrity check for type 'B' failed during virtual call
+  // CFI-DIAG-NEXT: note: vtable is of type 'A'
   delete (B *)a; // UB here
 
   // CFI-NOT: 2
   // NCFI: 2
   fprintf(stderr, "2\n");
 }