Commits on Nov 22, 2021

1. add rustc option for using LLVM stack smash protection …

   LLVM has built-in heuristics for adding stack canaries to functions. These
   heuristics can be selected with LLVM function attributes. This patch adds a
   rustc option `-Z stack-protector={none,basic,strong,all}` which controls the use
   of these attributes. This gives rustc the same stack smash protection support as
   clang offers through options `-fno-stack-protector`, `-fstack-protector`,
   `-fstack-protector-strong`, and `-fstack-protector-all`. The protection this can
   offer is demonstrated in test/ui/abi/stack-protector.rs. This fills a gap in the
   current list of rustc exploit
   mitigations (https://doc.rust-lang.org/rustc/exploit-mitigations.html),
   originally discussed in rust-lang#15179.
   
   Stack smash protection adds runtime overhead and is therefore still off by
   default, but now users have the option to trade performance for security as they
   see fit. An example use case is adding Rust code in an existing C/C++ code base
   compiled with stack smash protection. Without the ability to add stack smash
   protection to the Rust code, the code base artifacts could be exploitable in
   ways not possible if the code base remained pure C/C++.
   
   Stack smash protection support is present in LLVM for almost all the current
   tier 1/tier 2 targets: see
   test/assembly/stack-protector/stack-protector-target-support.rs. The one
   exception is nvptx64-nvidia-cuda. This patch follows clang's example, and adds a
   warning message printed if stack smash protection is used with this target (see
   test/ui/stack-protector/warn-stack-protector-unsupported.rs). Support for tier 3
   targets has not been checked.
   
   Since the heuristics are applied at the LLVM level, the heuristics are expected
   to add stack smash protection to a fraction of functions comparable to C/C++.
   Some experiments demonstrating how Rust code is affected by the different
   heuristics can be found in
   test/assembly/stack-protector/stack-protector-heuristics-effect.rs. There is
   potential for better heuristics using Rust-specific safety information. For
   example it might be reasonable to skip stack smash protection in functions which
   transitively only use safe Rust code, or which uses only a subset of functions
   the user declares safe (such as anything under `std.*`). Such alternative
   heuristics could be added at a later point.
   
   LLVM also offers a "safestack" sanitizer as an alternative way to guard against
   stack smashing (see rust-lang#26612). This could possibly also be included as a
   stack-protection heuristic. An alternative is to add it as a sanitizer (rust-lang#39699).
   This is what clang does: safestack is exposed with option
   `-fsanitize=safe-stack`.
   
   The options are only supported by the LLVM backend, but as with other codegen
   options it is visible in the main codegen option help menu. The heuristic names
   "basic", "strong", and "all" are hopefully sufficiently generic to be usable in
   other backends as well.
   
   Reviewed-by: Nikita Popov <[email protected]>
   
   Extra commits during review:
   
   - [address-review] make the stack-protector option unstable
   
   - [address-review] reduce detail level of stack-protector option help text
   
   - [address-review] correct grammar in comment
   
   - [address-review] use compiler flag to avoid merging functions in test
   
   - [address-review] specify min LLVM version in fortanix stack-protector test
   
     Only for Fortanix test, since this target specifically requests the
     `--x86-experimental-lvi-inline-asm-hardening` flag.
   
   - [address-review] specify required LLVM components in stack-protector tests
   
   - move stack protector option enum closer to other similar option enums
   
   - rustc_interface/tests: sort debug option list in tracking hash test
   
   - add an explicit `none` stack-protector option
   
   Revert "set LLVM requirements for all stack protector support test revisions"
   
   This reverts commit a49b74f92a4e7d701d6f6cf63d207a8aff2e0f68.

   

   bbjornse committed Nov 22, 2021
   Configuration menu

   • View commit details
   • Copy full SHA for bb9dee9
   • Browse repository at this point

   Copy the full SHA

   bb9dee9 View commit details

   Browse the repository at this point in the history