Protection against stack-based memory corruption errors using SafeStack: compiler-rt runtime support library

[pcc]

Summary

This patch adds runtime support for the Safe Stack protection to compiler-rt (see http://reviews.llvm.org/D6094 for the detailed description of the Safe Stack).

This patch is our implementation of the safe stack on top of the current SVN HEAD of compiler-rt (r220991). The patch adds basic runtime support for the safe stack to compiler-rt that manages unsafe stack allocation/deallocation for each thread.

[theraven]

I've done a quick review, I'll do a more detailed follow-up once the comments inline have been addressed.

lib/safestack/safestack.cc

35

Yes. It must also be dynamic to respect pthread stack limits and system-wide rlimits.

76

There are magic numbers here again. Please reference either an ABI document or equivalent that indicates that these are safe locations to use.

146

Why is this Linux only? If the goal is to avoid LD_PRELOAD and similar interceptions, then it should be done everywhere (possibly with the exception of Darwin)

153

On FreeBSD, MAP_STACK should also be passed. Not sure about other BSDs. In general, however, these checks should be of the form:
#ifdef MAP_STACK

MAP_STACK

#endif
Not #if defined(linux)

256

This seems somewhat fragile. It doesn't guarantee that the other destructors won't be run after this, only that they get several opportunities to run before.

272

Why is this not on Linux?

281

This should check RLIMIT_STACK.

328

Why noinline? It is externally visible, so a non-inline version will be produced anyway. Why not let LTO builds inline it? Or is the noinline attribute because this function must be compiled *without* the safe stack support itself? If so, document it (or perhaps add the no_safestack attribute instead, to prevent it from being inlined in unsafe contexts).

341

I believe that this should work on most ELF platforms.

[ksvladimir]

Hi David,

Thanks a lot for the review, your feedback is very valuable! We will apply
it and resubmit the patch as soon as possible.

Two of your points seem to be more challenging to me to address, given my
limited experience with the libc internals:

Comment at: lib/safestack/safestack.cc:75
@@ +74,3 @@
+
+// The following locations are platform-specific

+# define GET_UNSAFE_STACK_PTR() (void*) THREAD_GETMEM_L(0x280)

There are magic numbers here again. Please reference either an ABI
document or equivalent that indicates that these are safe locations to use.

Do you know of any ABI documents that might be relevant to this? On
FreeBSD, we simply added corresponding fields to the tcb struct in libc
(in lib/libthr/arch/amd64/include/pthread_md.h). Do you think it would be
safer to use thread-local variables on Linux for now ? It would impact the
performance though. Perhaps in the future the glibc can be modified to add
the required fields to its tcb structure as well.

Comment at: lib/safestack/safestack.cc:255
@@ +254,3 @@
+void thread_cleanup_handler(void* _iter) {
+ // We want to free the unsafe stack only after all other destructors

+ // have already run. We force this function to be called multiple times.

This seems somewhat fragile. It doesn't guarantee that the other
destructors won't be run after this, only that they get several
opportunities to run before.

Yes, I was worried about this as well. It worked in our tests, but can
certainly break in some cases. The clean solution is to perform this
cleanup in the pthread code itself, which is what we did on FreeBSD. We
hope it will eventually be added to glibc as well. Do you have any better
suggestions on how to handle this in the meantime?

Thanks!

• Vova

[kcc]

lib/safestack/safestack.cc

19

You may find lots of utilities in sanitizer_common useful here.
E.g. try CHECK, CHECK_EQ, etc instead of assert.
In general, I'd like to see more code reuse between safe_stack and sanitizers.

43

Why not simply force -lpthread in the driver?

52

I might be missing something, but can't we just use TLS to store the second stack?

146

Don't you want to use internal_mmap from sanitizer_common/sanitizer_libc.h?

227

Where possible, please reuse functions from sanitizer_common, e.g. here you may try GetThreadStackTopAndBottom

267

please use static for anything that is is not supposed to be called/used from another module.

306

why NDEBUG?
I would prefer tnot to have a separate build for compiler-rt

308

can you use SANITIZER_INTERFACE_ATTRIBUTE?

[theraven]

lib/safestack/safestack.cc

43

The overhead of adding -pthread (-lpthread is non-portable) to single-threaded programs is measurably greater than the overhead of safe stack. We (current hat: FreeBSD) are willing to ship packages with SSP by default and would be very willing to ship packages with safe-stack, but if it forced -pthread then the overhead would be more than we'd be willing to accept.

52

C11 TLS does not have a way of attaching destructors. C++11 does (although the standard is undefined in the presence of shared library loading and unloading, which makes it less useful), but does not have any way of ordering the destruction.

[ksvladimir]

Addresses comments on the previous submission.

[ksvladimir]

You can find the detailed changelog since the previous submission in our repo: https://github.com/cpi-llvm/compiler-rt/commits/safestack-r221153

lib/safestack/safestack.cc

52

The main reason of putting the unsafe stack pointer in the tcb directly is performance: that way, the unsafe stack pointer can be loaded/stored with just one memory access. It's exactly the same optimization as the existing stack protector uses (see X86TargetLowering::getStackCookieLocation in X86ISelLowering.cpp:1925).

Following David's suggestion, I will remove this optimization on Linux for now, until it can be properly implemented on the glibc side as well. I plan to only keep it on Darwin (where it seems to be cleaner, as I will explain in the comments). I will use TLS for unsafe_stack_(start|size|guard) on all platforms, as those are not performance critical in any way.

[ksvladimir]

Move mmap's #ifdef out of the functions to improve readability.

[ksvladimir]

Added tests for the safestack runtime support library.

[ksvladimir]

Simplified safestack public symbol names.

[pcc]

Refresh

[kcc]

a few random comments, not a thorough review yet.

lib/safestack/Makefile.mk

1 ↗

(On Diff #24339)

I don't think we want to support configure/make

lib/safestack/safestack.cc

57

can this code use more of sanitizer_common?
(here and in the rest of this file)

92

Why?
The recent OSX should support TLS well (or not?)

test/safestack/check-buffer-copy.c

2

(for all tests) please add a one-line test description

[pcc]

• Use internal_{mmap,munmap,mprotect} functions in sanitizer_common
• Remove Darwin platform-specific TLS code
• Tweak comment
• Remove Makefile stuff
• Add test descriptions
• Rename flag to -fsanitize=safe-stack

[pcc]

lib/safestack/Makefile.mk

1 ↗

(On Diff #24339)

Removed.

lib/safestack/safestack.cc

57

Yep, this now uses internal_mmap/internal_munmap and internal_mprotect below.

92

This now uses a __thread variable on all platforms.

According to Laszlo this was done solely for efficiency reasons, so we should be fine using __thread at least to begin with. I imagine that if the overhead matters in practice we can try to persuade the relevant people at Apple to allocate a TLS slot for us.

test/safestack/check-buffer-copy.c

2

Done

[samsonov]

lib/CMakeLists.txt

12

I thought you need to add this if COMPILER_RT_HAS_SAFESTACK is true.

test/safestack/CMakeLists.txt

6

I believe you also need ${SANIITIZER_COMMON_LIT_TEST_DEPS}

test/safestack/check-overflow.c

6

use not (here and below)

test/safestack/lit.site.cfg.in

6

You don't use this attribute anywhere, delete it.

[theraven]

A couple of high-level comments:

I don't really like making this a sanitizer. It is supposed to be useable in the same places stack canaries are used (i.e. in production, with a view to enabling it for 100% of code). Making it an -fsanitize option makes it seem like a debugging tool, not a mitigation tool.

I'm also not 100% convinced by the compiler-rt stuff. This needs to be in libc. What happens when a program dlopens libpthread? The pthread_create symbol won't exist on library load, so it looks as if your interceptor code will just see a null pointer. Then when the first thread is created, it will die horribly.

[pcc]

• Address review comments

lib/CMakeLists.txt

12

Done

test/safestack/CMakeLists.txt

6

Done

test/safestack/check-overflow.c

6

Done

test/safestack/lit.site.cfg.in

6

Done

[samsonov]

LGTM for CMake/lit part.

test/safestack/CMakeLists.txt

7

Looks like clang is already contained in SANITIZER_COMMON_LIT_TEST_DEPS

[kcc]

CMakeLists.txt

210

is this still valid?
Don't we use -fsanitize= syntax?

lib/safestack/safestack.cc

39

please no macros where constants work

46

do you really need this?

58

Mmm. I don't like that.
Why can't we just ensure that pthread is linked?

81

no macros, please, unless you have too, in which case describe in comments why.

102

I would use MmapOrDie (or create a similar one in sanitizer_common/sanitizer_posix.cc)
and get rid of mmap includes in this file.

115

use CHECK_EQ

127

UnmapOrDie

205

use CHECK

277

please make this similar to other sanitizers (SANITIZER_CAN_USE_PREINIT_ARRAY).

[pcc]

• Use constants, simplfy pthread stuff
• Remove more macros
• Use MmapOrDie etc.
• Use CHECK_* instead of assert

CMakeLists.txt

210

Updated.

lib/safestack/safestack.cc

39

Done

46

Removed; they are hints and are not required for correctness. We can bring them back if benchmarks show a clear benefit.

58

My understanding is that on some platforms (FreeBSD?) linking the pthread library has a performance impact.

We could probably consider moving pthread stuff to a separate library which is only linked when pthread is linked. I guess for now we can use the pthread symbols unconditionally. Then any later change will mostly be a matter of moving code around.

81

Removed

102

Done

115

Done

127

Done

205

Done

277

Done

test/safestack/CMakeLists.txt

7

Done

[kcc]

lib/safestack/safestack.cc

21

Please check if you still need so many headers. Remove anything you don't need.

65

MmapOrDie dies if it fails. You should not need the check

84

do you still need this comment?

test/safestack/check-pthread-cleanup.c

11

kBufferSize

[pcc]

• remove comment
• Remove MAP_FAILED check, remove unused #includes
• Use enum constant

lib/safestack/safestack.cc

21

Done

65

Removed

84

Removed

test/safestack/check-pthread-cleanup.c

11

Done

[pcc]

• Remove C++ marker

[kcc]

LGTM

Once everything is committed, please make sure this is tested on our bots.

[ksvladimir]

lib/safestack/safestack.cc

167

This should also use SANITIZER_CAN_USE_PREINIT_ARRAY: attribute((constructor(0))) should be added whenever preinit_array is not used.

[pcc]

• Use SANITIZER_CAN_USE_PREINIT_ARRAY in one more place

lib/safestack/safestack.cc

167

Done

[pcc]

• Add LTO test

[pcc]

• Fix copy-pasteo

[jfb]

Could you also run clang-format on the code? Preferably separate from other changes to the diff history is easier to read.

cmake/config-ix.cmake

258

I haven't been through the LLVM-side code yet, but what prevents other architectures from being supported? IIUC nothing is x86 specific since it's in `lib/Transforms`, right?

339

What's missing for Windows support? Thread and TLS support? It's the most significant platform for Chrome (well, and Android), and we're looking forward to LLVM support on Windows. Not having SafeStack would be sad. This can be a different patch, but I think it's important.

lib/safestack/safestack.cc

45

nullptr here and other pointers below.

55

It's probably not a huge issue for the unsafe stack, but I'd rather check that size + guard doesn't overflow uptr before calling MmapOrDie. The same applies in other parts of the code below.

72

Drop the (void) case.

107

s/intersepting/intercepting/

110

s/rutine/routine/

Though I'm not sure the comment is really helping me understand much here, I'd just drop it.

175

Is this initialization check useful if __attribute__((constructor(0))) was used? Can this be done concurrently, or is it just called multiple times from the same thread of execution? If concurrent then initialization is racy.

226

Please add a comment on why 2*sizeof(void*) is correct.

test/safestack/CMakeLists.txt

10

Does this force-build gold for this test? Or does it refuse to build the test if gold wasn't built? Also, comment on why PIC and+binutils_incdir require gold for testing.

15

Why does Apple require LTO for testing?

test/safestack/check-buffer-copy.c

10

Could you do the same test with a VLA?

15

Writing and then immediately reading back is pretty brittle if the optimizer decides to kick in and prove the code trivially dead. Could you add some optimizer smarts defeat mechanism here? I'm not sure if compiler-rt has a preferred method of doing this (asm volatile, barrier, volatile, separate noinline call, ...).

test/safestack/check-overflow.c

11

noinline would be appropriate, though IPO could still kick in. Maybe slap a volatile on there too?

14

I'd rather memset a bigger range which includes the buffer itself than just changing two values.

23

The optimizer knows that value1 and value2 don't escape main. This check is trivially true.

test/safestack/check-pthread.c

23

The buffer allocation and memset are dead code and can be eliminated.

[ksvladimir]

cmake/config-ix.cmake

258

Good point, in principle the code is fairly cross platform (although we only tested it on x86).

lib/safestack/safestack.cc

175

The primary reason for this check is to handle cases when libsafestack is linked into multiple DSOs and __safestack_init ends up being on multiple constructor lists. It can only be called concurrently if multiple DSOs are being dlopen'ed in parallel. I think that dlopen itself isn't thread-safe and shouldn't be used that way but, perhaps, for extra safety it's useful to make this code non-racy using atomics.

226

In fact, it might depend on the architecture and even on the calling convention. Perhaps we should just remove this function altogether, as it is not really related to SafeStack, and we ended up not using it anyway neither in Chrome nor FreeBSD.

[pcc]

• s/0/nullptr/ where appropriate
• Address remaining review comments

cmake/config-ix.cmake

258

Not much as far as I know, but I understand that the general policy for these clauses is that the person who adds support for a particular architecture gets to add their architecture to the list.

339

What's missing for Windows support? Thread and TLS support?

LLVM already supports TLS on Windows (I believe), but we will have to find some way to intercept thread creation to allocate both stacks.

This can be a different patch, but I think it's important.

Agree.

lib/safestack/safestack.cc

45

Done

55

Done

72

Done

107

Done

110

Removed

175

Is this initialization check useful if attribute((constructor(0))) was used?

I don't think it is. Removed.

(Regarding Vova's comment, we don't currently support linking SafeStack into DSOs.)

226

Removed

test/safestack/CMakeLists.txt

10

This (and the Apple stuff below) adds the relevant LTO plugin as an optional test dependency of the test suite if the plugin is being built. This is required to test the scenario where the program is compiled with LTO; see lto.c. The tests should still run with the exception of lto.c if LTO is not supported.

15

See above.

test/safestack/check-buffer-copy.c

10

Done

15

Done

test/safestack/check-overflow.c

11

Done

14

Done

23

Yes, but I'm not sure that there's much we can do to defeat optimization in this case. (We want value1 and value2 to live on the safe stack, but inserting a call to break_optimization would move them to the unsafe stack.) Perhaps it would be best to simply rely on -O0 doing the right thing in this case.

test/safestack/check-pthread.c

23

I think the idea behind this part of the test is to check that the thread has an addressable unsafe stack. I've added a call to break_optimization to make sure this code is run.

[pcc]

• clang-format

[jfb]

lgtm after the two comments are addressed.

cmake/config-ix.cmake

339

Tagging @rnk FYI.

lib/safestack/safestack.cc

62

Overflow check here too, and with guard.

175

Gotcha. Would it be useful to have nothing here for now (@pcc just deleted the code), but add a comment explaining @ksvladimir's point?

[pcc]

• Add more overflow checks; add detailed documentation of limitations (from Laszlo)

[pcc]

I've added more detailed documentation on solutions to the limitations as a TODO in safestack.cc rather than the documentation where it isn't really actionable to a typical reader of the doc who probably just wants to use safe stack.

lib/safestack/safestack.cc

175

I don't think we need to add an explanation here. It would only make sense to do so if we supported multiple copies of the library in multiple DSOs, which isn't necessarily something we'll even want to support.

CMakeLists.txt

 
 # Provide some common commmandline flags for Sanitizer runtimes.
 append_list_if(COMPILER_RT_HAS_FPIC_FLAG -fPIC SANITIZER_COMMON_CFLAGS)
 append_list_if(COMPILER_RT_HAS_FNO_BUILTIN_FLAG -fno-builtin SANITIZER_COMMON_CFLAGS)
 append_list_if(COMPILER_RT_HAS_FNO_EXCEPTIONS_FLAG -fno-exceptions SANITIZER_COMMON_CFLAGS)
 append_list_if(COMPILER_RT_HAS_FOMIT_FRAME_POINTER_FLAG -fomit-frame-pointer SANITIZER_COMMON_CFLAGS)
 append_list_if(COMPILER_RT_HAS_FUNWIND_TABLES_FLAG -funwind-tables SANITIZER_COMMON_CFLAGS)
 append_list_if(COMPILER_RT_HAS_FNO_STACK_PROTECTOR_FLAG -fno-stack-protector SANITIZER_COMMON_CFLAGS)
+append_list_if(COMPILER_RT_HAS_FNO_SANITIZE_SAFE_STACK_FLAG -fno-sanitize=safe-stack SANITIZER_COMMON_CFLAGS)
 append_list_if(COMPILER_RT_HAS_FVISIBILITY_HIDDEN_FLAG -fvisibility=hidden SANITIZER_COMMON_CFLAGS)
 append_list_if(COMPILER_RT_HAS_FNO_FUNCTION_SECTIONS_FLAG -fno-function-sections SANITIZER_COMMON_CFLAGS)
 append_list_if(COMPILER_RT_HAS_FNO_LTO_FLAG -fno-lto SANITIZER_COMMON_CFLAGS)
 
 if(MSVC)
   # Replace the /MD[d] flags with /MT.
   # FIXME: In fact, sanitizers should support both /MT and /MD, see PR20214.
   if(COMPILER_RT_HAS_MT_FLAG)

cmake/config-ix.cmake

 # CodeGen options.
 check_cxx_compiler_flag(-fPIC                COMPILER_RT_HAS_FPIC_FLAG)
 check_cxx_compiler_flag(-fPIE                COMPILER_RT_HAS_FPIE_FLAG)
 check_cxx_compiler_flag(-fno-builtin         COMPILER_RT_HAS_FNO_BUILTIN_FLAG)
 check_cxx_compiler_flag(-fno-exceptions      COMPILER_RT_HAS_FNO_EXCEPTIONS_FLAG)
 check_cxx_compiler_flag(-fomit-frame-pointer COMPILER_RT_HAS_FOMIT_FRAME_POINTER_FLAG)
 check_cxx_compiler_flag(-funwind-tables      COMPILER_RT_HAS_FUNWIND_TABLES_FLAG)
 check_cxx_compiler_flag(-fno-stack-protector COMPILER_RT_HAS_FNO_STACK_PROTECTOR_FLAG)
+check_cxx_compiler_flag(-fno-sanitize=safe-stack COMPILER_RT_HAS_FNO_SANITIZE_SAFE_STACK_FLAG)
 check_cxx_compiler_flag(-fvisibility=hidden  COMPILER_RT_HAS_FVISIBILITY_HIDDEN_FLAG)
 check_cxx_compiler_flag(-fno-rtti            COMPILER_RT_HAS_FNO_RTTI_FLAG)
 check_cxx_compiler_flag(-ffreestanding       COMPILER_RT_HAS_FFREESTANDING_FLAG)
 check_cxx_compiler_flag("-Werror -fno-function-sections" COMPILER_RT_HAS_FNO_FUNCTION_SECTIONS_FLAG)
 check_cxx_compiler_flag(-std=c++11           COMPILER_RT_HAS_STD_CXX11_FLAG)
 check_cxx_compiler_flag(-ftls-model=initial-exec COMPILER_RT_HAS_FTLS_MODEL_INITIAL_EXEC)
 check_cxx_compiler_flag(-fno-lto             COMPILER_RT_HAS_FNO_LTO_FLAG)
 check_cxx_compiler_flag(-msse3               COMPILER_RT_HAS_MSSE3_FLAG)

 filter_available_targets(DFSAN_SUPPORTED_ARCH x86_64 mips64 mips64el)
 filter_available_targets(LSAN_SUPPORTED_ARCH x86_64 mips64 mips64el)
 filter_available_targets(MSAN_SUPPORTED_ARCH x86_64 mips64 mips64el)
 filter_available_targets(PROFILE_SUPPORTED_ARCH x86_64 i386 i686 arm mips mips64
   mipsel mips64el aarch64 powerpc64 powerpc64le)
 filter_available_targets(TSAN_SUPPORTED_ARCH x86_64 mips64 mips64el)
 filter_available_targets(UBSAN_SUPPORTED_ARCH x86_64 i386 i686 arm aarch64 mips
   mipsel mips64 mips64el powerpc64 powerpc64le)
+filter_available_targets(SAFESTACK_SUPPORTED_ARCH x86_64 i386 i686)
 
 if(ANDROID)
   set(OS_NAME "Android")
 else()
   set(OS_NAME "${CMAKE_SYSTEM_NAME}")
 endif()
 
 if (SANITIZER_COMMON_SUPPORTED_ARCH AND NOT LLVM_USE_SANITIZER AND

 
 # -msse3 flag is not valid for Mips therefore clang gives a warning
 # message with -msse3. But check_c_compiler_flags() checks only for
 # compiler error messages. Therefore COMPILER_RT_HAS_MSSE3_FLAG turns out to be
 # true on Mips, so we make it false here.
 if("${LLVM_NATIVE_ARCH}" STREQUAL "Mips")
   set(COMPILER_RT_HAS_MSSE3_FLAG FALSE)
 endif()
+
+if (SAFESTACK_SUPPORTED_ARCH AND
+    OS_NAME MATCHES "Darwin|Linux|FreeBSD")
+  set(COMPILER_RT_HAS_SAFESTACK TRUE)
+else()
+  set(COMPILER_RT_HAS_SAFESTACK FALSE)
+endif()

lib/CMakeLists.txt

 # First, add the subdirectories which contain feature-based runtime libraries
 # and several convenience helper libraries.
 
 include(AddCompilerRT)
 include(SanitizerUtils)
 
 if(COMPILER_RT_HAS_SANITIZER_COMMON)
   add_subdirectory(interception)
   add_subdirectory(sanitizer_common)
   add_subdirectory(lsan)
   add_subdirectory(ubsan)
 endif()
 
 if(COMPILER_RT_HAS_ASAN)
   add_subdirectory(asan)
 endif()
 
 add_subdirectory(builtins)
 
 if(COMPILER_RT_HAS_DFSAN)
   add_subdirectory(dfsan)
 endif()
 
 if(COMPILER_RT_HAS_MSAN)
   add_subdirectory(msan)
 endif()
 
 if(COMPILER_RT_HAS_PROFILE)
   add_subdirectory(profile)
 endif()
 
 if(COMPILER_RT_HAS_TSAN)
   add_subdirectory(tsan)
   add_subdirectory(tsan/dd)
 endif()
 
+if(COMPILER_RT_HAS_SAFESTACK)
+  add_subdirectory(safestack)
+endif()

lib/safestack/CMakeLists.txt

+add_custom_target(safestack)
+
+set(SAFESTACK_SOURCES safestack.cc)
+
+include_directories(..)
+
+set(SAFESTACK_CFLAGS ${SANITIZER_COMMON_CFLAGS})
+
+if(APPLE)
+  # Build universal binary on APPLE.
+  add_compiler_rt_osx_static_runtime(clang_rt.safestack_osx
+    ARCH ${SAFESTACK_SUPPORTED_ARCH}
+    SOURCES ${SAFESTACK_SOURCES}
+            $<TARGET_OBJECTS:RTInterception.osx>
+            $<TARGET_OBJECTS:RTSanitizerCommon.osx>
+    CFLAGS ${SAFESTACK_CFLAGS})
+  add_dependencies(safestack clang_rt.safestack_osx)
+else()
+  # Otherwise, build separate libraries for each target.
+  foreach(arch ${SAFESTACK_SUPPORTED_ARCH})
+    add_compiler_rt_runtime(clang_rt.safestack-${arch} ${arch} STATIC
+      SOURCES ${SAFESTACK_SOURCES}
+              $<TARGET_OBJECTS:RTInterception.${arch}>
+              $<TARGET_OBJECTS:RTSanitizerCommon.${arch}>
+      CFLAGS ${SAFESTACK_CFLAGS})
+    add_dependencies(safestack clang_rt.safestack-${arch})
+  endforeach()
+endif()

lib/safestack/safestack.cc

+//===-- safestack.cc --------------------------------------------*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file implements the runtime support for the safe stack protection
+// mechanism. The runtime manages allocation/deallocation of the unsafe stack
+// for the main thread, as well as all pthreads that are created/destroyed
+// during program execution.
+//
+//===----------------------------------------------------------------------===//
+
+#include <limits.h>
+#include <pthread.h>
+#include <stddef.h>
+#include <sys/resource.h>
+#include <sys/user.h>
+
+#include "interception/interception.h"
+#include "sanitizer_common/sanitizer_common.h"
+
+/// Minimum stack alignment for the unsafe stack.
+const unsigned kStackAlign = 16;
+
+/// Default size of the unsafe stack. This value is only used if the stack
+/// size rlimit is set to infinity.
+const unsigned kDefaultUnsafeStackSize = 0x2800000;
+
+// TODO: To make accessing the unsafe stack pointer faster, we plan to
+// eventually store it directly in the thread control block data structure on
+// platforms where this structure is pointed to by %fs or %gs. This is exactly
+// the same mechanism as currently being used by the traditional stack
+// protector pass to store the stack guard (see getStackCookieLocation()
+// function above). Doing so requires changing the tcbhead_t struct in glibc
+// on Linux and tcb struct in libc on FreeBSD.
+//
+// For now, store it in a thread-local variable.
+extern "C" {
+  __attribute__((visibility ("default")))
+  __thread void  *__safestack_unsafe_stack_ptr = 0;
+}
+
+// Per-thread unsafe stack information. It's not frequently accessed, so there
+// it can be kept out of the tcb in normal thread-local variables.
+static __thread void  *unsafe_stack_start = 0;
+static __thread size_t unsafe_stack_size = 0;
+static __thread size_t unsafe_stack_guard = 0;
+
+static inline void *unsafe_stack_alloc(size_t size, size_t guard) {
+  void *addr = MmapOrDie(size + guard, "unsafe_stack_alloc");
+  MprotectNoAccess((uptr)addr, (uptr)guard);
+  return (char*) addr + guard;
+}
+
+static inline void unsafe_stack_setup(void *start, size_t size, size_t guard) {
+  void* stack_ptr = (char*) start + size;
+  CHECK_EQ((((size_t)stack_ptr) & (kStackAlign-1)), 0);
+
+  __safestack_unsafe_stack_ptr = stack_ptr;
+  unsafe_stack_start = start;
+  unsafe_stack_size = size;
+  unsafe_stack_guard = guard;
+}
+
+static void unsafe_stack_free() {
+  if (unsafe_stack_start) {
+    (void)UnmapOrDie(
+      (char*) unsafe_stack_start - unsafe_stack_guard,
+      unsafe_stack_size + unsafe_stack_guard);
+  }
+  unsafe_stack_start = 0;
+}
+
+/// Thread data for the cleanup handler
+static pthread_key_t thread_cleanup_key;
+
+/// Safe stack per-thread information passed to the thread_start function
+struct tinfo {
+  void *(*start_routine)(void*);
+  void *start_routine_arg;
+
+  void *unsafe_stack_start;
+  size_t unsafe_stack_size;
+  size_t unsafe_stack_guard;
+};
+
+/// Wrap the thread function in order to deallocate the unsafe stack when the
+/// thread terminates by returning from its main function.
+static void* thread_start(void *arg) {
+  struct tinfo *tinfo = (struct tinfo*) arg;
+
+  void *(*start_routine)(void*) = tinfo->start_routine;
+  void *start_routine_arg = tinfo->start_routine_arg;
+
+  // Setup the unsafe stack; this will destroy tinfo content
+  unsafe_stack_setup(tinfo->unsafe_stack_start,
+                     tinfo->unsafe_stack_size,
+                     tinfo->unsafe_stack_guard);
+
+  // Make sure out thread-specific destructor will be called
+  // FIXME: we can do this only any other specific key is set by
+  // intersepting the pthread_setspecific function itself
+  pthread_setspecific(thread_cleanup_key, (void*) 1);
+
+  // Start the original thread rutine
+  return start_routine(start_routine_arg);
+}
+
+/// Thread-specific data destructor
+static void thread_cleanup_handler(void* _iter) {
+  // We want to free the unsafe stack only after all other destructors
+  // have already run. We force this function to be called multiple times.
+  // User destructors that might run more then PTHREAD_DESTRUCTOR_ITERATIONS-1
+  // times might still end up executing after the unsafe stack is deallocated.
+  size_t iter = (size_t) _iter;
+  if (iter < PTHREAD_DESTRUCTOR_ITERATIONS) {
+    pthread_setspecific(thread_cleanup_key, (void*) (iter + 1));
+  } else {
+    // This is the last iteration
+    unsafe_stack_free();
+  }
+}
+
+/// Intercept thread creation operation to allocate and setup the unsafe stack
+INTERCEPTOR(int, pthread_create, pthread_t *thread,
+            const pthread_attr_t *attr,
+            void *(*start_routine)(void*), void *arg) {
+
+  size_t size = 0;
+  size_t guard = 0;
+
+  if (attr != NULL) {
+    pthread_attr_getstacksize(attr, &size);
+    pthread_attr_getguardsize(attr, &guard);
+  } else {
+    // get pthread default stack size
+    pthread_attr_t tmpattr;
+    pthread_attr_init(&tmpattr);
+    pthread_attr_getstacksize(&tmpattr, &size);
+    pthread_attr_getguardsize(&tmpattr, &guard);
+    pthread_attr_destroy(&tmpattr);
+  }
+
+  CHECK_NE(size, 0);
+  CHECK_EQ((size & (kStackAlign-1)), 0);
+  CHECK_EQ((guard & (PAGE_SIZE-1)), 0);
+
+  void *addr = unsafe_stack_alloc(size, guard);
+  struct tinfo *tinfo = (struct tinfo*) (
+        ((char*)addr) + size - sizeof(struct tinfo));
+  tinfo->start_routine = start_routine;
+  tinfo->start_routine_arg = arg;
+  tinfo->unsafe_stack_start = addr;
+  tinfo->unsafe_stack_size = size;
+  tinfo->unsafe_stack_guard = guard;
+
+  return REAL(pthread_create)(thread, attr, thread_start, tinfo);
+}
+
+extern "C"
+__attribute__((visibility ("default")))
+#ifndef __ELF__
+// On ELF platforms, the constructor is invoked using .preinit_array (see below)
+__attribute__((constructor(0)))
+#endif
+void __safestack_init() {
+  static int initialized = 0;
+
+  if (initialized)
+    return;
+
+  initialized = 1;
+
+  // Determine the stack size for the main thread.
+  size_t size = kDefaultUnsafeStackSize;
+  size_t guard = 4096;
+
+  struct rlimit limit;
+  if (getrlimit(RLIMIT_STACK, &limit) == 0
+      && limit.rlim_cur != RLIM_INFINITY)
+    size = limit.rlim_cur;
+
+  // Allocate unsafe stack for main thread
+  void *addr = unsafe_stack_alloc(size, guard);
+
+  unsafe_stack_setup(addr, size, guard);
+
+  // Initialize pthread interceptors for thread allocation
+  INTERCEPT_FUNCTION(pthread_create);
+
+  // Setup the cleanup handler
+  pthread_key_create(&thread_cleanup_key, thread_cleanup_handler);
+}
+
+#if SANITIZER_CAN_USE_PREINIT_ARRAY
+// Run safestack initialization before any other constructors.
+// FIXME: can we do something similar on non-ELF platforms, e.g., on Mac?
+extern "C" {
+__attribute__((section(".preinit_array"), used))
+void (*__safestack_preinit)(void) = __safestack_init;
+}
+#endif
+
+extern "C"
+__attribute__((visibility ("default")))
+void *__get_unsafe_stack_start() {
+  return unsafe_stack_start;
+}
+
+extern "C"
+__attribute__((visibility ("default")))
+void *__get_unsafe_stack_ptr() {
+  return __safestack_unsafe_stack_ptr;
+}
+
+extern "C"
+__attribute__((visibility ("default")))
+__attribute__((noinline)) // required for __builtin_frame_address(0) to work
+void *__get_safe_stack_ptr() {
+  return (char*) __builtin_frame_address(0) + 2*sizeof(void*);
+}

test/CMakeLists.txt

if(COMPILER_RT_CAN_EXECUTE_TESTS)
   endif()
   if(COMPILER_RT_HAS_TSAN)
     add_subdirectory(tsan)
   endif()
   if(COMPILER_RT_HAS_UBSAN)
     add_subdirectory(ubsan)
   endif()
   add_subdirectory(cfi)
+  if(COMPILER_RT_HAS_SAFESTACK)
+    add_subdirectory(safestack)
+  endif()
 endif()
 
 if(COMPILER_RT_STANDALONE_BUILD)
   # Now that we've traversed all the directories and know all the lit testsuites,
   # introduce a rule to run to run all of them.
   get_property(LLVM_LIT_TESTSUITES GLOBAL PROPERTY LLVM_LIT_TESTSUITES)
   get_property(LLVM_LIT_DEPENDS GLOBAL PROPERTY LLVM_LIT_DEPENDS)
   add_lit_target(check-all
     "Running all regression tests"
     ${LLVM_LIT_TESTSUITES}
     DEPENDS ${LLVM_LIT_DEPENDS})
 endif()

test/safestack/CMakeLists.txt

+set(SAFESTACK_LIT_SOURCE_DIR ${CMAKE_CURRENT_SOURCE_DIR})
+set(SAFESTACK_LIT_BINARY_DIR ${CMAKE_CURRENT_BINARY_DIR})
+
+set(SAFESTACK_TEST_DEPS ${SANITIZER_COMMON_LIT_TEST_DEPS})
+if(NOT COMPILER_RT_STANDALONE_BUILD)
+  list(APPEND SAFESTACK_TEST_DEPS safestack)
+endif()
+
+configure_lit_site_cfg(
+  ${CMAKE_CURRENT_SOURCE_DIR}/lit.site.cfg.in
+  ${CMAKE_CURRENT_BINARY_DIR}/lit.site.cfg
+  )
+
+add_lit_testsuite(check-safestack "Running the SafeStack tests"
+  ${CMAKE_CURRENT_BINARY_DIR}
+  DEPENDS ${SAFESTACK_TEST_DEPS})
+set_target_properties(check-safestack PROPERTIES FOLDER "SafeStack tests")

test/safestack/check-buffer-copy.c

+// RUN: %clang_safestack %s -o %t
+// RUN: %run %t
+
+// Test that loads/stores work correctly for variables on the unsafe stack.
+
+int main(int argc, char **argv)
+{
+  int i;
+  char buffer[128];
+
+  // check that we can write to a buffer
+  for (i = 0; argv[0][i] && i < sizeof (buffer) - 1; ++i)
+    buffer[i] = argv[0][i];
+  buffer[i] = '\0';
+
+  // check that we can read from a buffer
+  for (i = 0; argv[0][i] && i < sizeof (buffer) - 1; ++i)
+    if (buffer[i] != argv[0][i])
+      return 1;
+  return 0;
+}

test/safestack/check-init.c

+// RUN: %clang_safestack %s -o %t
+// RUN: %run %t
+
+// Basic smoke test for the runtime library.
+
+int main(int argc, char **argv)
+{
+  return 0;
+}

test/safestack/check-overflow.c

+// RUN: %clang_safestack %s -o %t
+// RUN: %run %t
+
+// RUN: %clang_nosafestack -fno-stack-protector %s -o %t
+// RUN: not %run %t
+
+// Test that buffer overflows on the unsafe stack do not affect variables on the
+// safe stack.
+
+void fct(int *buffer)
+{
+  buffer[-1] = 36;
+  buffer[6] = 36;
+}
+
+int main(int argc, char **argv)
+{
+  int value1 = 42;
+  int buffer[5];
+  int value2 = 42;
+  fct(buffer);
+  return value1 != 42 || value2 != 42;
+}

test/safestack/check-pthread-cleanup.c

+// RUN: %clang_safestack %s -pthread -o %t
+// RUN: not --crash %run %t
+
+// Test that unsafe stacks are deallocated correctly on thread exit.
+
+#include <stdlib.h>
+#include <string.h>
+#include <pthread.h>
+
+enum { kBufferSize = (1 << 15) };
+
+void *t1_start(void *ptr)
+{
+  char buffer[kBufferSize];
+  return buffer;
+}
+
+int main(int argc, char **argv)
+{
+  pthread_t t1;
+  char *buffer = NULL;
+
+  if (pthread_create(&t1, NULL, t1_start, NULL))
+    abort();
+  if (pthread_join(t1, &buffer))
+    abort();
+
+  // should segfault here
+  memset(buffer, 0, kBufferSize);
+  return 0;
+}

test/safestack/check-pthread.c

+// RUN: %clang_safestack %s -pthread -o %t
+// RUN: %run %t
+
+// Test that pthreads receive their own unsafe stack.
+
+#include <stdlib.h>
+#include <string.h>
+#include <pthread.h>
+
+static int ptr_test = 42;
+
+void *t1_start(void *ptr)
+{
+  if (ptr != &ptr_test)
+    abort();
+
+  // safe stack
+  int val = ptr_test * 5;
+
+  // unsafe stack
+  char buffer[8096]; // two pages
+  memset(buffer, val, sizeof (buffer));
+
+  return ptr;
+}
+
+int main(int argc, char **argv)
+{
+  pthread_t t1;
+  void *ptr = NULL;
+  if (pthread_create(&t1, NULL, t1_start, &ptr_test))
+    abort();
+  if (pthread_join(t1, &ptr))
+    abort();
+  if (ptr != &ptr_test)
+    abort();
+  return 0;
+}

test/safestack/lit.cfg

+# -*- Python -*-
+
+import os
+
+# Setup config name.
+config.name = 'SafeStack'
+
+# Setup source root.
+config.test_source_root = os.path.dirname(__file__)
+
+# Test suffixes.
+config.suffixes = ['.c', '.cc', '.cpp', '.m', '.mm', '.ll', '.test']
+
+# Add clang substitutions.
+config.substitutions.append( ("%clang_nosafestack ", config.clang + " -O0 -fno-sanitize=safe-stack ") )
+config.substitutions.append( ("%clang_safestack ", config.clang + " -O0 -fsanitize=safe-stack ") )
+
+# SafeStack tests are currently supported on Linux, FreeBSD and Darwin only.
+if config.host_os not in ['Linux', 'FreeBSD', 'Darwin']:
+   config.unsupported = True

test/safestack/lit.site.cfg.in

+## Autogenerated by LLVM/Clang configuration.
+# Do not edit!
+
+# Load common config for all compiler-rt lit tests.
+lit_config.load_config(config, "@COMPILER_RT_BINARY_DIR@/test/lit.common.configured")
+
+# Load tool-specific config that would do the real work.
+lit_config.load_config(config, "@SAFESTACK_LIT_SOURCE_DIR@/lit.cfg")