Page MenuHomePhabricator

Mark REAL(swapcontext) with indirect_return attribute on x86
ClosedPublic

Authored by hjl.tools on Jul 20 2018, 10:33 AM.

Details

Summary

When shadow stack from Intel CET is enabled, the first instruction of all
indirect branch targets must be a special instruction, ENDBR.

lib/asan/asan_interceptors.cc has

...

int res = REAL(swapcontext)(oucp, ucp);

...

REAL(swapcontext) is a function pointer to swapcontext in libc. Since
swapcontext may return via indirect branch on x86 when shadow stack is
enabled, as in this case,

int res = REAL(swapcontext)(oucp, ucp);

^^^^^^^^^^^^^^^^^^^^^^^^^^^^  This function may be

returned via an indirect branch.

Here compiler must insert ENDBR after call, like

call *bar(%rip)
endbr64

I opened an LLVM bug:

https://bugs.llvm.org/show_bug.cgi?id=38207

to add the indirect_return attribute so that it can be used to inform
compiler to insert ENDBR after REAL(swapcontext) call. We mark
REAL(swapcontext) with the indirect_return attribute if it is available.

Diff Detail

Event Timeline

hjl.tools created this revision.Jul 20 2018, 10:33 AM
Herald added subscribers: Restricted Project, kubamracek. · View Herald TranscriptJul 20 2018, 10:33 AM
eugenis added inline comments.
lib/asan/asan_interceptors.cc
278

Please add a __ has_attribute compatibility definition here (same as __ has_feature):
http://llvm-cs.pcc.me.uk/projects/compiler-rt/lib/sanitizer_common/sanitizer_internal_defs.h#122

Added a __ has_attribute compatibility definition.

eugenis added inline comments.Jul 20 2018, 12:14 PM
lib/sanitizer_common/sanitizer_internal_defs.h
127

an extra ")"

Remove the extra ")".

This revision is now accepted and ready to land.Jul 20 2018, 12:20 PM
This revision was automatically updated to reflect the committed changes.