102 lines
4.0 KiB
Diff
102 lines
4.0 KiB
Diff
commit c43c5796121bc5bcc0867f02e5536874aa8196c1
|
|
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
|
|
Date: Wed Dec 30 11:54:00 2020 +0530
|
|
|
|
Introduce _FORTIFY_SOURCE=3
|
|
|
|
Introduce a new _FORTIFY_SOURCE level of 3 to enable additional
|
|
fortifications that may have a noticeable performance impact, allowing
|
|
more fortification coverage at the cost of some performance.
|
|
|
|
With llvm 9.0 or later, this will replace the use of
|
|
__builtin_object_size with __builtin_dynamic_object_size.
|
|
|
|
__builtin_dynamic_object_size
|
|
-----------------------------
|
|
|
|
__builtin_dynamic_object_size is an LLVM builtin that is similar to
|
|
__builtin_object_size. In addition to what __builtin_object_size
|
|
does, i.e. replace the builtin call with a constant object size,
|
|
__builtin_dynamic_object_size will replace the call site with an
|
|
expression that evaluates to the object size, thus expanding its
|
|
applicability. In practice, __builtin_dynamic_object_size evaluates
|
|
these expressions through malloc/calloc calls that it can associate
|
|
with the object being evaluated.
|
|
|
|
A simple motivating example is below; -D_FORTIFY_SOURCE=2 would miss
|
|
this and emit memcpy, but -D_FORTIFY_SOURCE=3 with the help of
|
|
__builtin_dynamic_object_size is able to emit __memcpy_chk with the
|
|
allocation size expression passed into the function:
|
|
|
|
void *copy_obj (const void *src, size_t alloc, size_t copysize)
|
|
{
|
|
void *obj = malloc (alloc);
|
|
memcpy (obj, src, copysize);
|
|
return obj;
|
|
}
|
|
|
|
Limitations
|
|
-----------
|
|
|
|
If the object was allocated elsewhere that the compiler cannot see, or
|
|
if it was allocated in the function with a function that the compiler
|
|
does not recognize as an allocator then __builtin_dynamic_object_size
|
|
also returns -1.
|
|
|
|
Further, the expression used to compute object size may be non-trivial
|
|
and may potentially incur a noticeable performance impact. These
|
|
fortifications are hence enabled at a new _FORTIFY_SOURCE level to
|
|
allow developers to make a choice on the tradeoff according to their
|
|
environment.
|
|
|
|
diff --git a/include/features.h b/include/features.h
|
|
index ea7673ee115bcf0a..fe9fe16d034fad1b 100644
|
|
--- a/include/features.h
|
|
+++ b/include/features.h
|
|
@@ -381,6 +381,11 @@
|
|
# warning _FORTIFY_SOURCE requires compiling with optimization (-O)
|
|
# elif !__GNUC_PREREQ (4, 1)
|
|
# warning _FORTIFY_SOURCE requires GCC 4.1 or later
|
|
+# elif _FORTIFY_SOURCE > 2 && __glibc_clang_prereq (9, 0)
|
|
+# if _FORTIFY_SOURCE > 3
|
|
+# warning _FORTIFY_SOURCE > 3 is treated like 3 on this platform
|
|
+# endif
|
|
+# define __USE_FORTIFY_LEVEL 3
|
|
# elif _FORTIFY_SOURCE > 1
|
|
# if _FORTIFY_SOURCE > 2
|
|
# warning _FORTIFY_SOURCE > 2 is treated like 2 on this platform
|
|
diff --git a/manual/creature.texi b/manual/creature.texi
|
|
index 8876b2ab779c988f..64f361f27a7d6cdf 100644
|
|
--- a/manual/creature.texi
|
|
+++ b/manual/creature.texi
|
|
@@ -247,7 +247,8 @@ included.
|
|
@standards{GNU, (none)}
|
|
If this macro is defined to @math{1}, security hardening is added to
|
|
various library functions. If defined to @math{2}, even stricter
|
|
-checks are applied.
|
|
+checks are applied. If defined to @math{3}, @theglibc{} may also use
|
|
+checks that may have an additional performance overhead.
|
|
@end defvr
|
|
|
|
@defvr Macro _REENTRANT
|
|
diff --git a/misc/sys/cdefs.h b/misc/sys/cdefs.h
|
|
index 3f6fe3cc8563b493..1e39307b0ebcf38f 100644
|
|
--- a/misc/sys/cdefs.h
|
|
+++ b/misc/sys/cdefs.h
|
|
@@ -123,6 +123,15 @@
|
|
#define __bos(ptr) __builtin_object_size (ptr, __USE_FORTIFY_LEVEL > 1)
|
|
#define __bos0(ptr) __builtin_object_size (ptr, 0)
|
|
|
|
+/* Use __builtin_dynamic_object_size at _FORTIFY_SOURCE=3 when available. */
|
|
+#if __USE_FORTIFY_LEVEL == 3 && __glibc_clang_prereq (9, 0)
|
|
+# define __glibc_objsize0(__o) __builtin_dynamic_object_size (__o, 0)
|
|
+# define __glibc_objsize(__o) __builtin_dynamic_object_size (__o, 1)
|
|
+#else
|
|
+# define __glibc_objsize0(__o) __bos0 (__o)
|
|
+# define __glibc_objsize(__o) __bos (__o)
|
|
+#endif
|
|
+
|
|
#if __GNUC_PREREQ (4,3)
|
|
# define __warndecl(name, msg) \
|
|
extern void name (void) __attribute__((__warning__ (msg)))
|