Protection against stack-based memory corruption errors using SafeStack: Clang command line option and function attribute

[pcc]

Summary

This patch adds the -fsafe-stack command line argument for clang, which enables the Safe Stack protection (see http://reviews.llvm.org/D6094 for the detailed description of the Safe Stack).

This patch is our implementation of the safe stack on top of the current SVN HEAD of Clang (r221154). The patches make the following changes:

• Add -fsafe-stack and -fno-safe-stack options to clang to control safe stack usage (the safe stack is disabled by default).
• Add attribute((no_safe_stack)) attribute to clang that can be used to disable the safe stack for individual functions even when enabled globally.

[theraven]

include/clang/Basic/AttrDocs.td

868

It would be nice if this documentation didn't assume that everyone reading it knew what the safe stack instrumentation was. In particular, it should say what kind of functions might need to use this attribute (ones that do stack introspection?).

lib/Driver/Tools.cpp

2189

This is Linux specific. Most other platforms don't need anything explicitly linked to support dl*()

lib/Frontend/InitPreprocessor.cpp

830

It would be worth surveying a corpus of code and seeing what uses the __SSP defines. We may find that it's worth defining some of them in SafeStack mode, as it may cause the same kind of breakage.

[kcc]

lib/Frontend/InitPreprocessor.cpp

830

Note that AddressSanitizer does not define any preprocessor symbol.
I tried to introduce ADDRESS_SANITIZER but failed to convince the clang folks.
Instead, we use hasfeature(address_sanitizer), which is sadly incompatible with GCC's asan implementation, but works fine.

[ksvladimir]

Addresses comments on the previous submission.

[ksvladimir]

You can find the detailed changelog since the previous submission in our repo: https://github.com/cpi-llvm/clang/commits/safestack-r221153

[ksvladimir]

Added unittests for the -fsafe-stack and -fno-safe-stack options in clang and -fstack-protector 4 option in clang-cc1.

[ksvladimir]

Added tests for attribute((no_safe_stack)).

[ksvladimir]

Added documentation for the no_safe_stack attribute. Simplified safestack public symbol names.

[ksvladimir]

Fixed symbol naming on Mac.

[pcc]

Refresh

[kcc]

I'd like Alexey to co-review the clang part.

A top-level comment so far: don't we want to have the flag as -f[no-]sanitize=safe_stack?
This will make it consistent with the rest of sanitizers, including cfi

[kcc]

more comments

docs/SafeStack.rst

12 ↗

(On Diff #24338)

.. based on stack-based...

I'd remove the second "based"

44 ↗

(On Diff #24338)

is this true about libc?

83 ↗

(On Diff #24338)

See my previous comment about macros and ADDRESS_SANITIZER.
You may have to change this to __has_feature(safe_stack)

[gribozavr]

test/SemaCXX/attr-no-safestack.cpp

13

Rather than relying on line continuations, you could use expected-error@-1.

[pcc]

• Rename flag to -fsanitize=safe-stack
• SAFESTACK -> __has_feature(safe_stack), doc updates

[pcc]

docs/SafeStack.rst

12 ↗

(On Diff #24338)

Done

44 ↗

(On Diff #24338)

Not currently. Removed.

83 ↗

(On Diff #24338)

Done

test/SemaCXX/attr-no-safestack.cpp

13

Done

[samsonov]

docs/AttributeReference.rst

486

Do you need this attribute right now? If we decide to finally implement universal no_sanitize attribute, this attribute will become deprecated in favor of __attribute__((no_sanitize("safe-stack"))).

lib/CodeGen/CodeGenModule.cpp

741

Do you need to respect -fsanitize-blacklist for this?

lib/Driver/ToolChains.cpp

13

Accidental change?

lib/Driver/Tools.cpp

2241

Note that you're adding -ldl here, but we tend to add dependencies of compiler-rt runtimes later in the linker invocation (see NeedsSanitizerDeps vars) - so that they are added after AddLinkerInputs is called.

7797

Do we really want to support OS we don't build safestack runtime for? I'd just use Linux/MacOS for a start.

[pcc]

• Move safestack driver code to collectSanitizerRuntimes; eliminate SSPSafeStack
• Revert unnecessary change
• Update tests for new flags
• Revert changes to AttributeReference.rst (updated automatically)

docs/AttributeReference.rst

486

It's needed for Chromium and FreeBSD so far as I understand it.

lib/CodeGen/CodeGenModule.cpp

741

Done

lib/Driver/ToolChains.cpp

13

Reverted

lib/Driver/Tools.cpp

2241

This now works like the other sanitizers.

7797

addSafeStackRT is now gone, as well as these call sites.

[samsonov]

I understand that you probably need no_safe_stack attribute for Chromium/FreeBSD integration *right now*, and rather proceed with this and not wait until someone implements generic no_sanitize attribute, but... maybe we should at least not document it?

lib/CodeGen/CodeGenModule.cpp

759

Do you also need to add it to CodeGenModule::CreateGlobalInitOrDestructFunction?

lib/Driver/Tools.cpp

2299

This code is now dead - presence of -shared is checked at the top of this function. Can we silently discard -fsanitize=safe-stack while linking DSO?

5882

Looks like you should set AlwaysLink argument of AddLinkRuntimeLib to true.

[pcc]

• Address review comments

[pcc]

maybe we should at least not document it?

I'd rather document it than have some undocumented attribute in use somewhere.

I'll take a shot at implementing no_sanitize tomorrow and hopefully make this a moot point.

lib/CodeGen/CodeGenModule.cpp

759

Yes, done.

lib/Driver/Tools.cpp

2299

We can, but only if the DSO is linked against a main executable that is linked against the safe stack runtime. (Generally for the other sanitizers we can make this true, but in deployment scenarios you might not be able to control the main executable.)

There are a number of possible solutions to this problem, which we plan to deal with in a future change, but at least removing the check makes things work in that specific scenario. So I've removed it.

5882

Done

[samsonov]

I'm fine with this patch, modulo the attribute issue.

[pcc]

• Remove no_safe_stack attribute

[samsonov]

LGTM

[pcc]

• Implement attribute((no_sanitize("safe-stack")))

[pcc]

• Fix documentation typo

[ksvladimir]

include/clang/Basic/LangOptions.def

195

Since SSPSafeStack no longer exists, this should be reverted as well.

lib/Driver/Tools.cpp

5889

Is this still required, even though we have AlwaysLink=true above?

[pcc]

• Remove unnecessary linker flag
• Revert langopts change
• Improve precision of safestack-attr.cpp test

include/clang/Basic/LangOptions.def

195

Done

lib/Driver/Tools.cpp

5889

No, removed.

[jfb]

The patch description mentions `__attribute__((no_safe_stack))` which isn't the name used anymore.

docs/SafeStack.rst

18 ↗

(On Diff #26105)

It would be good to document the limitations that this approach has.

Off the top of my head:

• The safe stack is merely hidden from attackers by being somewhere in the address space. That's nice, but can be predictable even on 64-bit address spaces because not all the bits are addressable, multiple threads each have their stack, ...
• This approach doesn't prevent an attacker from "imbalancing" the safe stack by say having just one call, and doing two rets (thereby returning to an address that wasn't meant as a return address).

51 ↗

(On Diff #26105)

Does this have any security implications by making Oilpan spill the SafeStack address? I'm assuming that care must be taken not to do so!

55 ↗

(On Diff #26105)

Format `dlopen()`

97 ↗

(On Diff #26105)

What implications does this attribute have on the overall system's security?

109 ↗

(On Diff #26105)

What happens when calling `__builtin_frame_address` with SafeStack?

[pcc]

• Implement attribute((no_sanitize("safe-stack")))
• Fix documentation typo
• Remove unnecessary linker flag
• Revert langopts change
• Improve precision of safestack-attr.cpp test
• Document limitations
• More documentation updates
• More updates

[pcc]

docs/SafeStack.rst

18 ↗

(On Diff #26105)

Done

51 ↗

(On Diff #26105)

Yes. I now mention this in the limitations section.

55 ↗

(On Diff #26105)

Done

97 ↗

(On Diff #26105)

Added a relevant paragraph.

109 ↗

(On Diff #26105)

I believe it will return a pointer to the safe stack. I've added some stuff to the Limitations section about this.

[jfb]

You should also update the patch description.

Besides my new comment on warnings (which could be added separately), this patch LGTM.

docs/SafeStack.rst

109 ↗

(On Diff #26105)

Would it be possible to have clang warn when doing safe-stack and __builtin_frame_address is used, or the stack leaks in other inadvertent ways? We want to avoid noisy warnings, but converting an existing codebase should probably require explicitly adding no-safe-stack attributes where required.

[jfb]

docs/SafeStack.rst

72 ↗

(On Diff #26542)

Could you document the current limitations on DSO?

[pcc]

• Add a note regarding leak detection
• Document DSO limitation

docs/SafeStack.rst

72 ↗

(On Diff #26542)

Done

docs/AttributeReference.rst

 
 .. _langext-thread_sanitizer:
 
 Use ``__attribute__((no_sanitize_thread))`` on a function declaration to
 specify that checks for data races on plain (non-atomic) memory accesses should
 not be inserted by ThreadSanitizer. The function is still instrumented by the
 tool to avoid false positives and provide meaningful stack traces.
 
+no_safe_stack
+-------------
+
+.. csv-table:: Supported Syntaxes
+   :header: "GNU", "C++11", "__declspec", "Keyword"
+
+   "X","","",""
+
+.. _langext-safe_stack:
+
+Use ``__attribute__((no_safe_stack))`` on a function declaration to specify
+that the safe stack instrumentation should not be applied to that function,
+even if enabled globally (see -fsafe-stack flag). This attribute may be
+required for functions that make assumptions about the exact layout of their
+stack frames.
 
 no_split_stack (gnu::no_split_stack)
 ------------------------------------
 .. csv-table:: Supported Syntaxes
    :header: "GNU", "C++11", "__declspec", "Keyword"
 
    "X","X","",""
 

include/clang/Basic/Attr.td

 def X86ForceAlignArgPointer : InheritableAttr, TargetSpecificAttr<TargetX86> {
   let Spellings = [GNU<"force_align_arg_pointer">];
   // Technically, this appertains to a FunctionDecl, but the target-specific
   // code silently allows anything function-like (such as typedefs or function
   // pointers), but does not apply the attribute to them.
   let Documentation = [Undocumented];
 }
 
+// Attribute to disable SafeStack (or equivalent) instrumentation.
+def NoSafeStack : InheritableAttr {
+  let Spellings = [GCC<"no_safe_stack">];
+  let Subjects = SubjectList<[Function], ErrorDiag>;
+  let Documentation = [NoSafeStackDocs];
+}
+
 // Attribute to disable AddressSanitizer (or equivalent) checks.
 def NoSanitizeAddress : InheritableAttr {
   let Spellings = [GCC<"no_address_safety_analysis">,
                    GCC<"no_sanitize_address">];
   let Subjects = SubjectList<[Function], ErrorDiag>;
   let Documentation = [NoSanitizeAddressDocs];
 }
 

include/clang/Basic/AttrDocs.td

 Each ``class`` that uses any of the typestate annotations must first be marked
 using the ``consumable`` attribute.  Failure to do so will result in a warning.
 
 This attribute accepts a single parameter that must be one of the following:
 ``unknown``, ``consumed``, or ``unconsumed``.
   }];
 }
 
+def NoSafeStackDocs : Documentation {
+  let Category = DocCatFunction;
+  let Content = [{
+Use ``__attribute__((no_safe_stack))`` on a function declaration to specify
+that the safe stack instrumentation should not be applied to that function,
+even if enabled globally (see -fsafe-stack flag). This attribute may be
+required for functions that make assumptions about the exact layout of their
+stack frames.
+  }];
+}
+
 def NoSanitizeAddressDocs : Documentation {
   let Category = DocCatFunction;
   // This function has multiple distinct spellings, and so it requires a custom
   // heading to be specified. The most common spelling is sufficient.
   let Heading = "no_sanitize_address (no_address_safety_analysis, gnu::no_address_safety_analysis, gnu::no_sanitize_address)";
   let Content = [{
 .. _langext-address_sanitizer:
 

include/clang/Basic/LangOptions.h

 
 /// \brief Keeps track of the various options that can be
 /// enabled, which controls the dialect of C or C++ that is accepted.
 class LangOptions : public LangOptionsBase {
 public:
   typedef clang::Visibility Visibility;
   
   enum GCMode { NonGC, GCOnly, HybridGC };
-  enum StackProtectorMode { SSPOff, SSPOn, SSPStrong, SSPReq };
+  enum StackProtectorMode { SSPOff, SSPOn, SSPStrong, SSPReq, SSPSafeStack };
   
   enum SignedOverflowBehaviorTy {
     SOB_Undefined,  // Default C standard behavior.
     SOB_Defined,    // -fwrapv
     SOB_Trapping    // -ftrapv
   };
 
   enum PragmaMSPointersToMembersKind {

include/clang/Basic/LangOptions.def

 BENIGN_LANGOPT(DelayedTemplateParsing , 1, 0, "delayed template parsing")
 LANGOPT(BlocksRuntimeOptional , 1, 0, "optional blocks runtime")
 
 ENUM_LANGOPT(GC, GCMode, 2, NonGC, "Objective-C Garbage Collection mode")
 ENUM_LANGOPT(ValueVisibilityMode, Visibility, 3, DefaultVisibility,
              "value symbol visibility")
 ENUM_LANGOPT(TypeVisibilityMode, Visibility, 3, DefaultVisibility,
              "type symbol visibility")
-ENUM_LANGOPT(StackProtector, StackProtectorMode, 2, SSPOff,
+ENUM_LANGOPT(StackProtector, StackProtectorMode, 3, SSPOff,
              "stack protector mode")
 ENUM_LANGOPT(SignedOverflowBehavior, SignedOverflowBehaviorTy, 2, SOB_Undefined,
              "signed integer overflow handling")
 
 BENIGN_LANGOPT(ArrowDepth, 32, 256,
                "maximum number of operator->s to follow")
 BENIGN_LANGOPT(InstantiationDepth, 32, 256,
                "maximum template instantiation depth")

include/clang/Driver/Options.td

def fno_signed_char : Flag<["-"], "fno-signed-char">, Flags<[CC1Option]>,
     Group<clang_ignored_f_Group>, HelpText<"Char is unsigned">;
 def fsplit_stack : Flag<["-"], "fsplit-stack">, Group<f_Group>;
 def fstack_protector_all : Flag<["-"], "fstack-protector-all">, Group<f_Group>,
   HelpText<"Force the usage of stack protectors for all functions">;
 def fstack_protector_strong : Flag<["-"], "fstack-protector-strong">, Group<f_Group>,
   HelpText<"Use a strong heuristic to apply stack protectors to functions">;
 def fstack_protector : Flag<["-"], "fstack-protector">, Group<f_Group>,
   HelpText<"Enable stack protectors for functions potentially vulnerable to stack smashing">;
+def fsafe_stack : Flag<["-"], "fsafe-stack">, Group<f_Group>,
+  HelpText<"Enable safe stack protection against stack-based memory corruption errors">;
+def fno_safe_stack : Flag<["-"], "fno-safe-stack">, Group<f_Group>,
+  HelpText<"Disable safe stack protection against stack-based memory corruption errors">;
 def fstandalone_debug : Flag<["-"], "fstandalone-debug">, Group<f_Group>, Flags<[CC1Option]>,
   HelpText<"Emit full debug info for all types used by the program">;
 def fno_standalone_debug : Flag<["-"], "fno-standalone-debug">, Group<f_Group>, Flags<[CC1Option]>,
   HelpText<"Limit debug information produced to reduce size of debug binary">;
 def flimit_debug_info : Flag<["-"], "flimit-debug-info">, Alias<fno_standalone_debug>;
 def fno_limit_debug_info : Flag<["-"], "fno-limit-debug-info">, Alias<fstandalone_debug>;
 def fstrict_aliasing : Flag<["-"], "fstrict-aliasing">, Group<f_Group>,
   Flags<[DriverOption, CoreOption]>;

lib/CodeGen/CodeGenModule.cpp

void CodeGenModule::SetLLVMFunctionAttributesForDefinition(const Decl *D,
   }
 
   if (LangOpts.getStackProtector() == LangOptions::SSPOn)
     B.addAttribute(llvm::Attribute::StackProtect);
   else if (LangOpts.getStackProtector() == LangOptions::SSPStrong)
     B.addAttribute(llvm::Attribute::StackProtectStrong);
   else if (LangOpts.getStackProtector() == LangOptions::SSPReq)
     B.addAttribute(llvm::Attribute::StackProtectReq);
+  else if (LangOpts.getStackProtector() == LangOptions::SSPSafeStack)
+    if (!D->hasAttr<NoSafeStackAttr>())
+      B.addAttribute(llvm::Attribute::SafeStack);
 
   // Add sanitizer attributes if function is not blacklisted.
   if (!isInSanitizerBlacklist(F, D->getLocation())) {
     // When AddressSanitizer is enabled, set SanitizeAddress attribute
     // unless __attribute__((no_sanitize_address)) is used.
     if (LangOpts.Sanitize.Address && !D->hasAttr<NoSanitizeAddressAttr>())
       B.addAttribute(llvm::Attribute::SanitizeAddress);
     // Same for ThreadSanitizer and __attribute__((no_sanitize_thread))
     if (LangOpts.Sanitize.Thread && !D->hasAttr<NoSanitizeThreadAttr>())
       B.addAttribute(llvm::Attribute::SanitizeThread);
     // Same for MemorySanitizer and __attribute__((no_sanitize_memory))
     if (LangOpts.Sanitize.Memory && !D->hasAttr<NoSanitizeMemoryAttr>())
       B.addAttribute(llvm::Attribute::SanitizeMemory);
   }
 
   F->addAttributes(llvm::AttributeSet::FunctionIndex,
                    llvm::AttributeSet::get(
                        F->getContext(), llvm::AttributeSet::FunctionIndex, B));
 
   if (isa<CXXConstructorDecl>(D) || isa<CXXDestructorDecl>(D))
     F->setUnnamedAddr(true);
   else if (const auto *MD = dyn_cast<CXXMethodDecl>(D))
     if (MD->isVirtual())
       F->setUnnamedAddr(true);

lib/Driver/ToolChains.cpp

 //===--- ToolChains.cpp - ToolChain Implementations -----------------------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 
 #include "ToolChains.h"
 #include "clang/Basic/ObjCRuntime.h"
 #include "clang/Basic/Version.h"
+#include "clang/Basic/LangOptions.h"
 #include "clang/Config/config.h" // for GCC_INSTALL_PREFIX
 #include "clang/Driver/Compilation.h"
 #include "clang/Driver/Driver.h"
 #include "clang/Driver/DriverDiagnostic.h"
 #include "clang/Driver/Options.h"
 #include "clang/Driver/SanitizerArgs.h"
 #include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/SmallString.h"

lib/Driver/Tools.cpp

static void addProfileRT(
 
   SmallString<128> LibProfile = getCompilerRTLibDir(TC);
   llvm::sys::path::append(LibProfile,
       Twine(Lib) + getArchNameForCompilerRTLib(TC) + ".a");
 
   CmdArgs.push_back(Args.MakeArgString(LibProfile));
 }
 
+static void addSafeStackRT(
+    const ToolChain &TC, const ArgList &Args, ArgStringList &CmdArgs) {
+  if (!Args.hasFlag(options::OPT_fsafe_stack,
+                    options::OPT_fno_safe_stack, false))
+    return;
+
+  const char *LibBaseName = "libclang_rt.safestack-";
+  SmallString<128> LibName = getCompilerRTLibDir(TC);
+  llvm::sys::path::append(LibName,
+      Twine(LibBaseName) + getArchNameForCompilerRTLib(TC) + ".a");
+
+  CmdArgs.push_back(Args.MakeArgString(LibName));
+
+  // Safestack runtime requires dl on Linux
+  if (TC.getTriple().isOSLinux())
+    CmdArgs.push_back("-ldl");
+
+  // We need to ensure that the safe stack init function from the safestack
+  // runtime library is linked in, even though it might not be referenced by
+  // any code in the module before LTO optimizations are applied.
+  CmdArgs.push_back("-u");
+  CmdArgs.push_back("__safestack_init");
+}
+
 static SmallString<128> getSanitizerRTLibName(const ToolChain &TC,
                                               StringRef Sanitizer,
                                               bool Shared) {
   // Sanitizer runtime has name "libclang_rt.<Sanitizer>-<ArchName>.{a,so}"
   // (or "libclang_rt.<Sanitizer>-<ArchName>-android.so for Android)
   const char *EnvSuffix =
     TC.getTriple().getEnvironment() == llvm::Triple::Android ?  "-android" : "";
   SmallString<128> LibSanitizer = getCompilerRTLibDir(TC);
static bool addSanitizerDynamicList(const ToolChain &TC, const ArgList &Args,
   if (llvm::sys::fs::exists(LibSanitizer + ".syms")) {
     CmdArgs.push_back(
         Args.MakeArgString("--dynamic-list=" + LibSanitizer + ".syms"));
     return true;
   }
   return false;
 }
 
 static void linkSanitizerRuntimeDeps(const ToolChain &TC,
                                      ArgStringList &CmdArgs) {
   // Force linking against the system libraries sanitizers depends on
   // (see PR15823 why this is necessary).
   CmdArgs.push_back("--no-as-needed");
   CmdArgs.push_back("-lpthread");
   CmdArgs.push_back("-lrt");
   CmdArgs.push_back("-lm");
   // There's no libdl on FreeBSD.
if (SanArgs.needsUbsanRt()) {
     // sanitizer_common explicitly.
     if (StaticRuntimes.empty())
       HelperStaticRuntimes.push_back("san");
     StaticRuntimes.push_back("ubsan");
     if (SanArgs.linkCXXRuntimes())
       StaticRuntimes.push_back("ubsan_cxx");
   }
 }
 
 // Should be called before we add system libraries (C++ ABI, libstdc++/libc++,
 // C runtime, etc). Returns true if sanitizer system deps need to be linked in.
 static bool addSanitizerRuntimes(const ToolChain &TC, const ArgList &Args,
                                  ArgStringList &CmdArgs) {
   SmallVector<StringRef, 4> SharedRuntimes, StaticRuntimes,
       HelperStaticRuntimes;
   collectSanitizerRuntimes(TC, Args, SharedRuntimes, StaticRuntimes,
                            HelperStaticRuntimes);

   Args.AddLastArg(CmdArgs, options::OPT_funroll_loops,
                   options::OPT_fno_unroll_loops);
 
   Args.AddLastArg(CmdArgs, options::OPT_pthread);
 
 
   // -stack-protector=0 is default.
   unsigned StackProtectorLevel = 0;
-  if (Arg *A = Args.getLastArg(options::OPT_fno_stack_protector,
+  if (Args.hasFlag(options::OPT_fsafe_stack,
+                   options::OPT_fno_safe_stack, false)) {
+    StackProtectorLevel = LangOptions::SSPSafeStack;
+    Args.ClaimAllArgs(options::OPT_fno_stack_protector);
+    Args.ClaimAllArgs(options::OPT_fstack_protector_all);
+    Args.ClaimAllArgs(options::OPT_fstack_protector_strong);
+    Args.ClaimAllArgs(options::OPT_fstack_protector);
+  } else if (Arg *A = Args.getLastArg(options::OPT_fno_stack_protector,
                                options::OPT_fstack_protector_all,
                                options::OPT_fstack_protector_strong,
                                options::OPT_fstack_protector)) {
     if (A->getOption().matches(options::OPT_fstack_protector)) {
       StackProtectorLevel = std::max<unsigned>(LangOptions::SSPOn,
         getToolChain().GetDefaultStackProtectorLevel(KernelOrKext));
     } else if (A->getOption().matches(options::OPT_fstack_protector_strong))
       StackProtectorLevel = LangOptions::SSPStrong;
void darwin::Link::ConstructJob(Compilation &C, const JobAction &JA,
 
   CmdArgs.push_back("-o");
   CmdArgs.push_back(Output.getFilename());
 
   if (!Args.hasArg(options::OPT_nostdlib) &&
       !Args.hasArg(options::OPT_nostartfiles))
     getMachOToolChain().addStartObjectFileArgs(Args, CmdArgs);
 
+  // SafeStack requires its own runtime libraries
+  // These libraries should be linked first, to make sure the
+  // __safestack_init constructor executes before everything else
+  if (Args.hasFlag(options::OPT_fsafe_stack,
+                   options::OPT_fno_safe_stack, false)) {
+    getMachOToolChain().AddLinkRuntimeLib(Args, CmdArgs,
+                                          "libclang_rt.safestack_osx.a");
+
+    // We need to ensure that the safe stack init function from the safestack
+    // runtime library is linked in, even though it might not be referenced by
+    // any code in the module before LTO optimizations are applied.
+    CmdArgs.push_back("-u");
+    CmdArgs.push_back("___safestack_init");
+  }
+
   Args.AddAllArgs(CmdArgs, options::OPT_L);
 
   LibOpenMP UsedOpenMPLib = LibUnknown;
   if (Args.hasArg(options::OPT_fopenmp)) {
     UsedOpenMPLib = LibGOMP;
   } else if (const Arg *A = Args.getLastArg(options::OPT_fopenmp_EQ)) {
     UsedOpenMPLib = llvm::StringSwitch<LibOpenMP>(A->getValue())
         .Case("libgomp",  LibGOMP)
if (!Args.hasArg(options::OPT_shared)) {
       CmdArgs.push_back(Args.MakeArgString(GCCLibPath + "crtbegin.o"));
     }
     if (getToolChain().getDriver().CCCIsCXX())
       CmdArgs.push_back(Args.MakeArgString(LibPath + "cxa_finalize.o"));
   }
 
   CmdArgs.push_back(Args.MakeArgString("-L" + GCCLibPath));
 
+  addSafeStackRT(getToolChain(), Args, CmdArgs);
+
   Args.AddAllArgs(CmdArgs, options::OPT_L);
   Args.AddAllArgs(CmdArgs, options::OPT_T_Group);
   Args.AddAllArgs(CmdArgs, options::OPT_e);
   Args.AddAllArgs(CmdArgs, options::OPT_r);
 
   AddLinkerInputs(getToolChain(), Inputs, Args, CmdArgs);
 
   if (!Args.hasArg(options::OPT_nostdlib) &&
if (!Args.hasArg(options::OPT_nostdlib) &&
     else if (Args.hasArg(options::OPT_shared) || IsPIE)
       crtbegin = "crtbeginS.o";
     else
       crtbegin = "crtbegin.o";
 
     CmdArgs.push_back(Args.MakeArgString(ToolChain.GetFilePath(crtbegin)));
   }
 
+  addSafeStackRT(getToolChain(), Args, CmdArgs);
+
   Args.AddAllArgs(CmdArgs, options::OPT_L);
   const ToolChain::path_list &Paths = ToolChain.getFilePaths();
   for (const auto &Path : Paths)
     CmdArgs.push_back(Args.MakeArgString(StringRef("-L") + Path));
   Args.AddAllArgs(CmdArgs, options::OPT_T_Group);
   Args.AddAllArgs(CmdArgs, options::OPT_e);
   Args.AddAllArgs(CmdArgs, options::OPT_s);
   Args.AddAllArgs(CmdArgs, options::OPT_t);
if (!Args.hasArg(options::OPT_nostdlib) &&
     } else {
       CmdArgs.push_back(Args.MakeArgString(
                               getToolChain().GetFilePath("crti.o")));
       CmdArgs.push_back(Args.MakeArgString(
                               getToolChain().GetFilePath("crtbeginS.o")));
     }
   }
 
+  addSafeStackRT(getToolChain(), Args, CmdArgs);
+
   Args.AddAllArgs(CmdArgs, options::OPT_L);
   Args.AddAllArgs(CmdArgs, options::OPT_T_Group);
   Args.AddAllArgs(CmdArgs, options::OPT_e);
   Args.AddAllArgs(CmdArgs, options::OPT_s);
   Args.AddAllArgs(CmdArgs, options::OPT_t);
   Args.AddAllArgs(CmdArgs, options::OPT_Z_Flag);
   Args.AddAllArgs(CmdArgs, options::OPT_r);
 
if (!Args.hasArg(options::OPT_nostdlib) &&
     else
       crtbegin = isAndroid ? "crtbegin_dynamic.o" : "crtbegin.o";
     CmdArgs.push_back(Args.MakeArgString(ToolChain.GetFilePath(crtbegin)));
 
     // Add crtfastmath.o if available and fast math is enabled.
     ToolChain.AddFastMathRuntimeIfAvailable(Args, CmdArgs);
   }
 
+  addSafeStackRT(getToolChain(), Args, CmdArgs);
+
   Args.AddAllArgs(CmdArgs, options::OPT_L);
   Args.AddAllArgs(CmdArgs, options::OPT_u);
 
   const ToolChain::path_list &Paths = ToolChain.getFilePaths();
 
   for (const auto &Path : Paths)
     CmdArgs.push_back(Args.MakeArgString(StringRef("-L") + Path));
 
void minix::Link::ConstructJob(Compilation &C, const JobAction &JA,
   if (!Args.hasArg(options::OPT_nostdlib) &&
       !Args.hasArg(options::OPT_nostartfiles)) {
       CmdArgs.push_back(Args.MakeArgString(getToolChain().GetFilePath("crt1.o")));
       CmdArgs.push_back(Args.MakeArgString(getToolChain().GetFilePath("crti.o")));
       CmdArgs.push_back(Args.MakeArgString(getToolChain().GetFilePath("crtbegin.o")));
       CmdArgs.push_back(Args.MakeArgString(getToolChain().GetFilePath("crtn.o")));
   }
 
+  addSafeStackRT(getToolChain(), Args, CmdArgs);
+
   Args.AddAllArgs(CmdArgs, options::OPT_L);
   Args.AddAllArgs(CmdArgs, options::OPT_T_Group);
   Args.AddAllArgs(CmdArgs, options::OPT_e);
 
   AddLinkerInputs(getToolChain(), Inputs, Args, CmdArgs);
 
   addProfileRT(getToolChain(), Args, CmdArgs);
 
if (!Args.hasArg(options::OPT_nostdlib) &&
     if (Args.hasArg(options::OPT_shared) || Args.hasArg(options::OPT_pie))
       CmdArgs.push_back(Args.MakeArgString(
                               getToolChain().GetFilePath("crtbeginS.o")));
     else
       CmdArgs.push_back(Args.MakeArgString(
                               getToolChain().GetFilePath("crtbegin.o")));
   }
 
+  addSafeStackRT(getToolChain(), Args, CmdArgs);
+
   Args.AddAllArgs(CmdArgs, options::OPT_L);
   Args.AddAllArgs(CmdArgs, options::OPT_T_Group);
   Args.AddAllArgs(CmdArgs, options::OPT_e);
 
   AddLinkerInputs(getToolChain(), Inputs, Args, CmdArgs);
 
   if (!Args.hasArg(options::OPT_nostdlib) &&
       !Args.hasArg(options::OPT_nodefaultlibs)) {

lib/Frontend/CompilerInvocation.cpp

#include "clang/Frontend/LangStandards.def"
   default:
     Diags.Report(diag::err_drv_invalid_value)
       << Args.getLastArg(OPT_stack_protector)->getAsString(Args) << SSP;
     break;
   case 0: Opts.setStackProtector(LangOptions::SSPOff); break;
   case 1: Opts.setStackProtector(LangOptions::SSPOn);  break;
   case 2: Opts.setStackProtector(LangOptions::SSPStrong); break;
   case 3: Opts.setStackProtector(LangOptions::SSPReq); break;
+  case 4: Opts.setStackProtector(LangOptions::SSPSafeStack); break;
   }
 
   // Parse -fsanitize= arguments.
   std::vector<std::string> Sanitizers = Args.getAllArgValues(OPT_fsanitize_EQ);
   for (unsigned I = 0, N = Sanitizers.size(); I != N; ++I) {
     // Since the Opts.Sanitize* values are bitfields, it's a little tricky to
     // efficiently map string values to them. Perform the mapping indirectly:
     // convert strings to enumerated values, then switch over the enum to set

lib/Frontend/InitPreprocessor.cpp

#undef DEFINE_LOCK_FREE_MACRO
   Builder.defineMacro("__DECIMAL_DIG__", Twine(Dig));
 
   if (LangOpts.getStackProtector() == LangOptions::SSPOn)
     Builder.defineMacro("__SSP__");
   else if (LangOpts.getStackProtector() == LangOptions::SSPStrong)
     Builder.defineMacro("__SSP_STRONG__", "2");
   else if (LangOpts.getStackProtector() == LangOptions::SSPReq)
     Builder.defineMacro("__SSP_ALL__", "3");
+  else if (LangOpts.getStackProtector() == LangOptions::SSPSafeStack)
+    Builder.defineMacro("__SAFESTACK__", "4");
 
   if (FEOpts.ProgramAction == frontend::RewriteObjC)
     Builder.defineMacro("__weak", "__attribute__((objc_gc(weak)))");
 
   // Define a macro that exists only when using the static analyzer.
   if (FEOpts.ProgramAction == frontend::RunAnalysis)
     Builder.defineMacro("__clang_analyzer__");
 

lib/Sema/SemaDeclAttr.cpp

case AttributeList::AT_GuardedVar:
     handleSimpleAttribute<GuardedVarAttr>(S, D, Attr);
     break;
   case AttributeList::AT_PtGuardedVar:
     handlePtGuardedVarAttr(S, D, Attr);
     break;
   case AttributeList::AT_ScopedLockable:
     handleSimpleAttribute<ScopedLockableAttr>(S, D, Attr);
     break;
+  case AttributeList::AT_NoSafeStack:
+    handleSimpleAttribute<NoSafeStackAttr>(S, D, Attr);
+    break;
   case AttributeList::AT_NoSanitizeAddress:
     handleSimpleAttribute<NoSanitizeAddressAttr>(S, D, Attr);
     break;
   case AttributeList::AT_NoThreadSafetyAnalysis:
     handleSimpleAttribute<NoThreadSafetyAnalysisAttr>(S, D, Attr);
     break;
   case AttributeList::AT_NoSanitizeThread:
     handleSimpleAttribute<NoSanitizeThreadAttr>(S, D, Attr);

runtime/compiler-rt/Makefile

 # support.
 RuntimeDirs :=
 ifeq ($(OS),Darwin)
 RuntimeDirs += darwin macho_embedded
 RuntimeLibrary.darwin.Configs := \
   eprintf.a 10.4.a osx.a ios.a cc_kext.a cc_kext_ios5.a \
   asan_osx_dynamic.dylib \
   profile_osx.a profile_ios.a \
-  ubsan_osx.a
+  ubsan_osx.a safestack_osx.a
 
 RuntimeLibrary.macho_embedded.Configs := \
   hard_static.a hard_pic.a
 ifneq (,$(findstring ARM,$(TARGETS_TO_BUILD)))
 RuntimeLibrary.macho_embedded.Configs += \
   soft_static.a soft_pic.a
 endif
 
for flag in $(3); do \
       cflags="$$cflags $$flag"; \
     done; \
     $(1) $$cflags $(2) -o /dev/null > /dev/null 2> /dev/null ; \
     echo $$?)
 
 # We try to build 32-bit runtimes both on 32-bit hosts and 64-bit hosts.
 Runtime32BitConfigs = \
   builtins-i386.a profile-i386.a san-i386.a asan-i386.a asan_cxx-i386.a \
-  ubsan-i386.a ubsan_cxx-i386.a
+  ubsan-i386.a ubsan_cxx-i386.a safestack-i386.a
 
 # We currently only try to generate runtime libraries on x86.
 ifeq ($(ARCH),x86)
 RuntimeLibrary.linux.Configs += $(Runtime32BitConfigs)
 endif
 
 ifeq ($(ARCH),x86_64)
 RuntimeLibrary.linux.Configs += \
   builtins-x86_64.a profile-x86_64.a san-x86_64.a asan-x86_64.a \
   asan_cxx-x86_64.a tsan-x86_64.a msan-x86_64.a ubsan-x86_64.a \
-  ubsan_cxx-x86_64.a dfsan-x86_64.a lsan-x86_64.a
+  ubsan_cxx-x86_64.a dfsan-x86_64.a lsan-x86_64.a safestack-x86_64.a
 # We need to build 32-bit ASan/UBsan libraries on 64-bit platform, and add them
 # to the list of runtime libraries to make
 # "clang -fsanitize=(address|undefined) -m32" work.
 # We check that Clang can produce working 32-bit binaries by compiling a simple
 # executable.
 test_source = $(LLVM_SRC_ROOT)/tools/clang/runtime/compiler-rt/clang_linux_test_input.c
 ifeq ($(call TryCompile,$(ToolDir)/clang,$(test_source),-m32),0)
 RuntimeLibrary.linux.Configs += $(Runtime32BitConfigs)

test/CodeGen/safestack-attr.cpp

+// RUN: %clang_cc1 -triple x86_64-linux-unknown -emit-llvm -o - %s -stack-protector 4 | FileCheck -check-prefix=SP %s
+
+__attribute__((no_safe_stack))
+int foo(int *a) {  return *a; }
+
+// SP-NOT: attributes #{{.*}} = { nounwind safestack{{.*}} }

test/CodeGen/stack-protector.c

 // RUN: %clang_cc1 -emit-llvm -o - %s -stack-protector 0 | FileCheck -check-prefix=NOSSP %s
 // NOSSP: define void @test1(i8* %msg) #0 {
 // RUN: %clang_cc1 -emit-llvm -o - %s -stack-protector 1 | FileCheck -check-prefix=WITHSSP %s
 // WITHSSP: define void @test1(i8* %msg) #0 {
 // RUN: %clang_cc1 -emit-llvm -o - %s -stack-protector 2 | FileCheck -check-prefix=SSPSTRONG %s
 // SSPSTRONG: define void @test1(i8* %msg) #0 {
 // RUN: %clang_cc1 -emit-llvm -o - %s -stack-protector 3 | FileCheck -check-prefix=SSPREQ %s
 // SSPREQ: define void @test1(i8* %msg) #0 {
+// RUN: %clang_cc1 -emit-llvm -o - %s -stack-protector 4 | FileCheck -check-prefix=SAFESTACK %s
+// SAFESTACK: define void @test1(i8* %msg) #0 {
 
 typedef __SIZE_TYPE__ size_t;
 
 int printf(const char * _Format, ...);
 size_t strlen(const char *s);
 char *strcpy(char *s1, const char *s2);
 
 void test1(const char *msg) {
   char a[strlen(msg) + 1];
   strcpy(a, msg);
   printf("%s\n", a);
 }
 
 // NOSSP: attributes #{{.*}} = { nounwind{{.*}} }
 
 // WITHSSP: attributes #{{.*}} = { nounwind ssp{{.*}} }
 
 // SSPSTRONG: attributes #{{.*}} = { nounwind sspstrong{{.*}} }
 
 // SSPREQ: attributes #{{.*}} = { nounwind sspreq{{.*}} }
+
+// SAFESTACK: attributes #{{.*}} = { nounwind safestack{{.*}} }

test/Driver/safestack.c

+// RUN: %clang -fno-safe-stack -### %s 2>&1 | FileCheck %s -check-prefix=NOSP
+// NOSP-NOT: "-stack-protector" "4"
+
+// RUN: %clang -fsafe-stack -### %s 2>&1 | FileCheck %s -check-prefix=SP
+// RUN: %clang -fsanatizer=address -fsafe-stack -### %s 2>&1 | FileCheck %s -check-prefix=SP
+// RUN: %clang -fstack-protector -fsafe-stack -### %s 2>&1 | FileCheck %s -check-prefix=SP
+// RUN: %clang -fsafe-stack -fstack-protector-all -### %s 2>&1 | FileCheck %s -check-prefix=SP
+// SP: "-stack-protector" "4"

test/SemaCXX/attr-no-safestack.cpp

+// RUN: %clang_cc1 -fsyntax-only -verify  %s
+
+#define NO_SAFE_STACK __attribute__((no_safe_stack))
+
+#if !__has_attribute(no_safe_stack)
+#error "Should support no_safe_stack"
+#endif
+
+void nosp_fun() NO_SAFE_STACK;
+
+void nosp_fun_args() __attribute__((no_safe_stack(1))); // \
+  // expected-error {{'no_safe_stack' attribute takes no arguments}}
+
+int nosp_testfn(int y) NO_SAFE_STACK;
+
+int nosp_testfn(int y) {
+  int x NO_SAFE_STACK = y; // \
+    // expected-error {{'no_safe_stack' attribute only applies to functions}}
+  return x;
+}
+
+int nosp_test_var NO_SAFE_STACK; // \
+  // expected-error {{'no_safe_stack' attribute only applies to functions}}
+
+class NoSPFoo {
+ private:
+  int test_field NO_SAFE_STACK; // \
+    // expected-error {{'no_safe_stack' attribute only applies to functions}}
+  void test_method() NO_SAFE_STACK;
+};
+
+class NO_SAFE_STACK NoSPTestClass { // \
+  // expected-error {{'no_safe_stack' attribute only applies to functions}}
+};
+
+void nosp_fun_params(int lvar NO_SAFE_STACK); // \
+  // expected-error {{'no_safe_stack' attribute only applies to functions}}