1 // Copyright 2021 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #ifdef UNSAFE_BUFFERS_BUILD
6 // TODO(crbug.com/40284755): Remove this and spanify to fix the errors.
7 #pragma allow_unsafe_buffers
8 #endif
9
10 #include "base/stack_canary_linux.h"
11
12 #include <dlfcn.h>
13 #include <stdint.h>
14 #include <sys/mman.h>
15
16 #include "base/bits.h"
17 #include "base/check_op.h"
18 #include "base/compiler_specific.h"
19 #include "base/logging.h"
20 #include "base/memory/page_size.h"
21 #include "base/rand_util.h"
22 #include "build/build_config.h"
23
24 namespace base {
25
26 #if defined(LIBC_GLIBC)
27
28 #if defined(ARCH_CPU_ARM_FAMILY)
29 // On ARM, Glibc uses a global variable (exported) called __stack_chk_guard.
30 extern "C" {
31 extern uintptr_t __stack_chk_guard;
32 }
33 #endif // defined(ARCH_CPU_ARM_FAMILY)
34
35 #if !defined(NDEBUG)
36 // In debug builds, if we detect stack smashing in old stack frames after
37 // changing the canary, it's nice to let someone know that it's because the
38 // canary changed and they should prevent their function from using stack
39 // canaries.
40 static bool g_emit_debug_message = false;
41
42 extern "C" {
43 typedef __attribute__((noreturn)) void(GLibcStackChkFailFunction)();
44
45 // This overrides glibc's version of __stack_chk_fail(), which is called when
46 // the canary doesn't match.
47 __attribute__((visibility("default"), noinline, noreturn)) void
__stack_chk_fail()48 __stack_chk_fail() {
49 if (g_emit_debug_message) {
50 RAW_LOG(
51 FATAL,
52 "Stack smashing detected. The canary was changed during runtime "
53 "(see crbug.com/1206626). You may need to mark your function with "
54 "the no_stack_protector attribute, or just exit() before stack "
55 "smashing occurs. You can also disable this canary-changing feature "
56 "by adding --change-stack-guard-on-fork=disable to the command line.");
57 }
58
59 // Call the real __stack_chk_fail().
60 // Note that dlsym may not be safe to perform since this is called during
61 // corruption, but this code purposely only runs in debug builds and in the
62 // normal case might provide better debug information.
63 GLibcStackChkFailFunction* glibc_stack_chk_fail =
64 reinterpret_cast<GLibcStackChkFailFunction*>(
65 dlsym(RTLD_NEXT, "__stack_chk_fail"));
66 (*glibc_stack_chk_fail)();
67 }
68 }
69 #endif // !defined(NDEBUG)
70
ResetStackCanaryIfPossible()71 NO_STACK_PROTECTOR void ResetStackCanaryIfPossible() {
72 uintptr_t canary;
73 base::RandBytes(base::byte_span_from_ref(canary));
74 // First byte should be the null byte for string functions.
75 canary &= ~static_cast<uintptr_t>(0xff);
76
77 // The x86/x64 offsets should work for musl too.
78 #if defined(ARCH_CPU_X86_64)
79 asm volatile("movq %q0,%%fs:%P1" : : "er"(canary), "i"(0x28));
80 #elif defined(ARCH_CPU_X86)
81 asm volatile("movl %0,%%gs:%P1" : : "ir"(canary), "i"(0x14));
82 #elif defined(ARCH_CPU_ARM_FAMILY)
83 // ARM's stack canary is held on a relro page. So, we'll need to make the page
84 // writable, change the stack canary, and then make the page ro again.
85 // We want to be single-threaded when changing page permissions, since it's
86 // reasonable for other threads to assume that page permissions for global
87 // variables don't change.
88 size_t page_size = base::GetPageSize();
89 uintptr_t __stack_chk_guard_page = base::bits::AlignDown(
90 reinterpret_cast<uintptr_t>(&__stack_chk_guard), page_size);
91 PCHECK(0 == mprotect(reinterpret_cast<void*>(__stack_chk_guard_page),
92 page_size, PROT_READ | PROT_WRITE));
93 __stack_chk_guard = canary;
94 PCHECK(0 == mprotect(reinterpret_cast<void*>(__stack_chk_guard_page),
95 page_size, PROT_READ));
96 #endif
97 }
98
SetStackSmashingEmitsDebugMessage()99 void SetStackSmashingEmitsDebugMessage() {
100 #if !defined(NDEBUG)
101 g_emit_debug_message = true;
102 #endif // !defined(NDEBUG)
103 }
104
105 #else // defined(LIBC_GLIBC)
106
107 // We don't know how to reset the canary if not compiling for glibc.
108 void ResetStackCanaryIfPossible() {}
109
110 void SetStackSmashingEmitsDebugMessage() {}
111
112 #endif // defined(LIBC_GLIBC)
113 } // namespace base
114