[RFC PATCH v2 4/4] add SafeStack build support

["LeMay, Michael" <michael.lemay@intel.com>]

The SafeStack sanitizer in LLVM Clang seeks to mitigate stack memory
corruption vulnerabilities [1].  This patch enhances configure to
detect the compiler flag that enables SafeStack.  It also enhances the
Makefile to specify the necessary compiler flags for specific files.

[1] http://clang.llvm.org/docs/SafeStack.html

Signed-off-by: Michael LeMay <michael.lemay@intel.com>
---
 Makefile  | 42 +++++++++++++++++++++++++++++++++++++++++-
 configure | 10 ++++++++++
 2 files changed, 51 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 8246b78..0bc51ac 100644
--- a/Makefile
+++ b/Makefile
@@ -47,7 +47,9 @@ CFLAGS_C99FSE = -std=c99 -ffreestanding -nostdinc
 
 CFLAGS_ALL = $(CFLAGS_C99FSE)
 CFLAGS_ALL += -D_XOPEN_SOURCE=700 -I$(srcdir)/arch/$(ARCH) -I$(srcdir)/arch/generic -Iobj/src/internal -I$(srcdir)/src/internal -Iobj/include -I$(srcdir)/include
-CFLAGS_ALL += $(CPPFLAGS) $(CFLAGS_AUTO) $(CFLAGS)
+CFLAGS_ALL += $(CPPFLAGS) $(CFLAGS_AUTO)
+# This flag is selectively re-added for certain files below.
+CFLAGS_ALL += $(filter-out -fsanitize=safe-stack,$(CFLAGS))
 
 LDFLAGS_ALL = $(LDFLAGS_AUTO) $(LDFLAGS)
 
@@ -132,6 +134,44 @@ NOSSP_SRCS = $(wildcard crt/*.c) \
 	ldso/dlstart.c ldso/dynlink.c
 $(NOSSP_SRCS:%.c=obj/%.o) $(NOSSP_SRCS:%.c=obj/%.lo): CFLAGS_ALL += $(CFLAGS_NOSSP)
 
+# The safestack attribute will be selectively forced within the __init_tls.c file below.
+SAFE_STACK_OBJS = $(filter-out $(CRT_OBJS) obj/ldso/dlstart.o obj/src/env/__init_tls.o,$(ALL_OBJS))
+
+ifeq ($(SAFE_STACK),yes)
+
+CFLAGS_ALL += -DSAFE_STACK=1
+
+define FORCE_ATTR =
+ $(eval $(addprefix obj/$(1).,o lo): CFLAGS_ALL += $(foreach func,$(2),-mllvm -force-attribute=$(func):$(FORCED_ATTR)))
+endef
+
+FORCED_ATTR = noinline
+
+# The no_sanitize attribute will only take effect if there are no inlined
+# functions that lack the attribute. That is why noinline is applied to the
+# following functions that are called from functions with the no_sanitize
+# attribute.
+$(call FORCE_ATTR,ldso/dynlink, \
+	__pthread_self a_crash decode_dyn decode_vec find_sym \
+	kernel_mapped_dso load_deps load_preload make_global makefuncdescs \
+	map_library reclaim_gaps reloc_all search_vec update_tls_size)
+$(call FORCE_ATTR,src/env/__init_tls, a_crash)
+$(call FORCE_ATTR,src/env/__libc_start_main, a_crash)
+$(call FORCE_ATTR,src/internal/safe_stack, __pthread_self a_crash)
+
+FORCED_ATTR = safestack
+
+# Since __init_tp switches to a new thread control block, it is necessary to
+# avoid accessing the unsafe stack pointer from the time that switch occurs
+# until the unsafe_stack_ptr field in the new thread control block has been
+# initialized.  That is why only the following function in __init_tls.c is
+# instrumented with SafeStack.
+$(call FORCE_ATTR,src/env/__init_tls, __copy_tls)
+
+$(SAFE_STACK_OBJS) $(SAFE_STACK_OBJS:%.o=%.lo): CFLAGS_ALL += -fsanitize=safe-stack
+
+endif
+
 $(CRT_OBJS): CFLAGS_ALL += -DCRT
 
 $(LOBJS) $(LDSO_OBJS): CFLAGS_ALL += -fPIC
diff --git a/configure b/configure
index 707eb12..a70009f 100755
--- a/configure
+++ b/configure
@@ -141,6 +141,7 @@ static=yes
 wrapper=auto
 gcc_wrapper=no
 clang_wrapper=no
+SAFE_STACK=no
 
 for arg ; do
 case "$arg" in
@@ -596,10 +597,18 @@ printf "using compiler runtime libraries: %s\n" "$LIBCC"
 SUBARCH=
 t="$CFLAGS_C99FSE $CPPFLAGS $CFLAGS"
 
+fnmatch '-fsanitize=safe-stack*|*\ -fsanitize=safe-stack*' "$CFLAGS" && SAFE_STACK=yes
+
 if test "$ARCH" = "x86_64" ; then
 trycppif __ILP32__ "$t" && ARCH=x32
 fi
 
+if test "$ARCH" = "x32" -a "$SAFE_STACK" = "yes" ; then
+# x32 would change the offset of the unsafe stack pointer in the thread control
+# block.
+fail "$0: error: SafeStack unsupported for x32"
+fi
+
 if test "$ARCH" = "arm" ; then
 trycppif __ARMEB__ "$t" && SUBARCH=${SUBARCH}eb
 trycppif __ARM_PCS_VFP "$t" && SUBARCH=${SUBARCH}hf
@@ -751,6 +760,7 @@ OPTIMIZE_GLOBS = $OPTIMIZE_GLOBS
 ALL_TOOLS = $tools
 TOOL_LIBS = $tool_libs
 ADD_CFI = $ADD_CFI
+SAFE_STACK = $SAFE_STACK
 EOF
 test "x$static" = xno && echo "STATIC_LIBS ="
 test "x$shared" = xno && echo "SHARED_LIBS ="
-- 
2.7.4