Skip to content

Commit a67ab4a

Browse files
davidtwcodavidtwco
committed
sess: stabilize -C stack-protector=all
Signed-off-by: David Wood <david@davidtw.co>
1 parent 2c243d9 commit a67ab4a

20 files changed

+104
-34
lines changed

‎compiler/rustc_interface/src/tests.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -629,6 +629,7 @@ fn test_codegen_options_tracking_hash() {
629629
tracked!(relro_level, Some(RelroLevel::Full));
630630
tracked!(soft_float, true);
631631
tracked!(split_debuginfo, Some(SplitDebuginfo::Packed));
632+
tracked!(stack_protector, StackProtector::All);
632633
tracked!(symbol_mangling_version, Some(SymbolManglingVersion::V0));
633634
tracked!(target_cpu, Some(String::from("abc")));
634635
tracked!(target_feature, String::from("all the features, all of them"));
@@ -836,7 +837,6 @@ fn test_unstable_options_tracking_hash() {
836837
tracked!(simulate_remapped_rust_src_base, Some(PathBuf::from("/rustc/abc")));
837838
tracked!(split_lto_unit, Some(true));
838839
tracked!(src_hash_algorithm, Some(SourceFileHashAlgorithm::Sha1));
839-
tracked!(stack_protector, StackProtector::All);
840840
tracked!(teach, true);
841841
tracked!(thinlto, Some(true));
842842
tracked!(tiny_const_eval_limit, true);

‎compiler/rustc_session/messages.ftl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ session_split_lto_unit_requires_lto = `-Zsplit-lto-unit` requires `-Clto`, `-Clt
109109
110110
session_target_requires_unwind_tables = target requires unwind tables, they cannot be disabled with `-C force-unwind-tables=no`
111111
112-
session_target_stack_protector_not_supported = `-Z stack-protector={$stack_protector}` is not supported for target {$target_triple} and will be ignored
112+
session_target_stack_protector_not_supported = `-C stack-protector={$stack_protector}` is not supported for target {$target_triple} and will be ignored
113113
114114
session_unleashed_feature_help_named = skipping check for `{$gate}` feature
115115
session_unleashed_feature_help_unnamed = skipping check that does not even have a feature gate

‎compiler/rustc_session/src/config.rs

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ use rustc_span::edition::{Edition, DEFAULT_EDITION, EDITION_NAME_LIST, LATEST_ST
2020
use rustc_span::source_map::FilePathMapping;
2121
use rustc_span::{FileName, FileNameDisplayPreference, RealFileName, SourceFileHashAlgorithm};
2222
use rustc_target::spec::{FramePointer, LinkSelfContainedComponents, LinkerFeatures};
23-
use rustc_target::spec::{SplitDebuginfo, Target, TargetTriple};
23+
use rustc_target::spec::{SplitDebuginfo, StackProtector, Target, TargetTriple};
2424
use std::collections::btree_map::{
2525
Iter as BTreeMapIter, Keys as BTreeMapKeysIter, Values as BTreeMapValuesIter,
2626
};
@@ -2479,6 +2479,22 @@ pub fn build_session_options(early_dcx: &mut EarlyDiagCtxt, matches: &getopts::M
24792479
}
24802480
}
24812481

2482+
// Check for unstable values of `-C stack-protector`.
2483+
// This is what prevents them from being used on stable compilers.
2484+
match cg.stack_protector {
2485+
// Stable values:
2486+
StackProtector::All | StackProtector::None => {}
2487+
// Unstable values:
2488+
StackProtector::Basic | StackProtector::Strong => {
2489+
if !unstable_opts.unstable_options {
2490+
early_dcx.early_fatal(
2491+
"`-C stack-protector=basic` and `-C stack-protector=strong` \
2492+
require `-Z unstable-options`",
2493+
);
2494+
}
2495+
}
2496+
}
2497+
24822498
if cg.instrument_coverage != InstrumentCoverage::No {
24832499
if cg.profile_generate.enabled() || cg.profile_use.is_some() {
24842500
early_dcx.early_fatal(

‎compiler/rustc_session/src/options.rs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1573,6 +1573,9 @@ options! {
15731573
#[rustc_lint_opt_deny_field_access("use `Session::split_debuginfo` instead of this field")]
15741574
split_debuginfo: Option<SplitDebuginfo> = (None, parse_split_debuginfo, [TRACKED],
15751575
"how to handle split-debuginfo, a platform-specific option"),
1576+
#[rustc_lint_opt_deny_field_access("use `Session::stack_protector` instead of this field")]
1577+
stack_protector: StackProtector = (StackProtector::None, parse_stack_protector, [TRACKED],
1578+
"control stack smash protection strategy (`rustc --print stack-protector-strategies` for details)"),
15761579
strip: Strip = (Strip::None, parse_strip, [UNTRACKED],
15771580
"tell the linker which information to strip (`none` (default), `debuginfo` or `symbols`)"),
15781581
symbol_mangling_version: Option<SymbolManglingVersion> = (None,
@@ -1979,9 +1982,6 @@ written to standard error output)"),
19791982
"enable LTO unit splitting (default: no)"),
19801983
src_hash_algorithm: Option<SourceFileHashAlgorithm> = (None, parse_src_file_hash, [TRACKED],
19811984
"hash algorithm of source files in debug info (`md5`, `sha1`, or `sha256`)"),
1982-
#[rustc_lint_opt_deny_field_access("use `Session::stack_protector` instead of this field")]
1983-
stack_protector: StackProtector = (StackProtector::None, parse_stack_protector, [TRACKED],
1984-
"control stack smash protection strategy (`rustc --print stack-protector-strategies` for details)"),
19851985
staticlib_allow_rdylib_deps: bool = (false, parse_bool, [TRACKED],
19861986
"allow staticlibs to have rust dylib dependencies"),
19871987
staticlib_prefer_dynamic: bool = (false, parse_bool, [TRACKED],

‎compiler/rustc_session/src/session.rs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -789,7 +789,7 @@ impl Session {
789789

790790
pub fn stack_protector(&self) -> StackProtector {
791791
if self.target.options.supports_stack_protector {
792-
self.opts.unstable_opts.stack_protector
792+
self.opts.cg.stack_protector
793793
} else {
794794
StackProtector::None
795795
}
@@ -1276,10 +1276,10 @@ fn validate_commandline_args_with_session_available(sess: &Session) {
12761276
}
12771277
}
12781278

1279-
if sess.opts.unstable_opts.stack_protector != StackProtector::None {
1279+
if sess.opts.cg.stack_protector != StackProtector::None {
12801280
if !sess.target.options.supports_stack_protector {
12811281
sess.dcx().emit_warn(errors::StackProtectorNotSupportedForTarget {
1282-
stack_protector: sess.opts.unstable_opts.stack_protector,
1282+
stack_protector: sess.opts.cg.stack_protector,
12831283
target_triple: &sess.opts.target_triple,
12841284
});
12851285
}

‎src/doc/rustc/src/codegen-options/index.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -573,6 +573,26 @@ Note that all three options are supported on Linux and Apple platforms,
573573
Attempting to use an unsupported option requires using the nightly channel
574574
with the `-Z unstable-options` flag.
575575

576+
## stack-protector
577+
578+
The option `-C stack-protector=val` controls stack smashing protection. See [Stack smashing
579+
protection][stack-smashing] for more details.
580+
581+
Supported values for this option are:
582+
583+
- `none` - no stack protectors
584+
- `all` - force use of stack protectors for all functions
585+
586+
Unstable options for this value are:
587+
588+
- `basic` - enable stack protectors for functions potentially vulnerable to stack smashing (basic
589+
heuristic)
590+
- `strong` - enable stack protectors for functions potentially vulnerable to stack smashing (strong
591+
heuristic)
592+
593+
`basic` and `strong` values for `-C stack-protector` require using the nightly channel with the
594+
`-Z unstable-options` flag.
595+
576596
## strip
577597

578598
The option `-C strip=val` controls stripping of debuginfo and similar auxiliary
@@ -675,3 +695,4 @@ effective only for x86 targets.
675695
[instrumentation-based code coverage]: ../instrument-coverage.md
676696
[profile-guided optimization]: ../profile-guided-optimization.md
677697
[option-g-debug]: ../command-line-arguments.md#option-g-debug
698+
[stack-smashing]: ../exploit-mitigations.md#stack-smashing-protection

‎src/doc/rustc/src/exploit-mitigations.md

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ equivalent.
6363
| Stack clashing protection | Yes | 1.20.0 (2017-08-31) |
6464
| Read-only relocations and immediate binding | Yes | 1.21.0 (2017-10-12) |
6565
| Heap corruption protection | Yes | 1.32.0 (2019-01-17) (via operating system default or specified allocator) |
66-
| Stack smashing protection | Yes | Nightly |
66+
| Stack smashing protection | Yes | 1.78.0 (2024-05-02) |
6767
| Forward-edge control flow protection | Yes | Nightly |
6868
| Backward-edge control flow protection (e.g., shadow and safe stack) | Yes | Nightly |
6969

@@ -357,7 +357,8 @@ instruction pointer, and checking if this value has changed when returning from
357357
a function. This is also known as “Stack Protector” or “Stack Smashing
358358
Protector (SSP)”.
359359

360-
The Rust compiler supports stack smashing protection on nightly builds[40].
360+
The Rust compiler supports stack smashing protection with the `-C stack-protector=all`
361+
flag since version 1.78.0 (2024-05-02)[40], [47].
361362

362363
![Screenshot of IDA Pro listing cross references to __stack_chk_fail in hello-rust.](images/image3.png "Cross references to __stack_chk_fail in hello-rust.")
363364
Fig. 14. IDA Pro listing cross references to `__stack_chk_fail` in hello-rust.
@@ -627,3 +628,6 @@ to `READ_IMPLIES_EXEC`).
627628

628629
46. “SafeStack.” The Rust Unstable Book.
629630
[https://doc.rust-lang/org/unstable-book/compiler-flags/sanitizer.html#safestack](../unstable-book/compiler-flags/sanitizer.html#safestack).
631+
632+
47. D. Wood. “sess: stabilize stack-protector=all #121742” GitHub.
633+
<https://github.com/rust-lang/rust/pull/121742>

‎tests/assembly/stack-protector/stack-protector-heuristics-effect-windows-32bit.rs

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,10 @@
33
//@ only-windows
44
//@ only-msvc
55
//@ ignore-64bit 64-bit table based SEH has slightly different behaviors than classic SEH
6-
//@ [all] compile-flags: -Z stack-protector=all
7-
//@ [strong] compile-flags: -Z stack-protector=strong
8-
//@ [basic] compile-flags: -Z stack-protector=basic
9-
//@ [none] compile-flags: -Z stack-protector=none
6+
//@ [all] compile-flags: -C stack-protector=all
7+
//@ [strong] compile-flags: -C stack-protector=strong -Z unstable-options
8+
//@ [basic] compile-flags: -C stack-protector=basic -Z unstable-options
9+
//@ [none] compile-flags: -C stack-protector=none
1010
//@ compile-flags: -C opt-level=2 -Z merge-functions=disabled
1111

1212
#![crate_type = "lib"]

‎tests/assembly/stack-protector/stack-protector-heuristics-effect-windows-64bit.rs

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,10 @@
33
//@ only-windows
44
//@ only-msvc
55
//@ ignore-32bit 64-bit table based SEH has slightly different behaviors than classic SEH
6-
//@ [all] compile-flags: -Z stack-protector=all
7-
//@ [strong] compile-flags: -Z stack-protector=strong
8-
//@ [basic] compile-flags: -Z stack-protector=basic
9-
//@ [none] compile-flags: -Z stack-protector=none
6+
//@ [all] compile-flags: -C stack-protector=all
7+
//@ [strong] compile-flags: -C stack-protector=strong -Z unstable-options
8+
//@ [basic] compile-flags: -C stack-protector=basic -Z unstable-options
9+
//@ [none] compile-flags: -C stack-protector=none
1010
//@ compile-flags: -C opt-level=2 -Z merge-functions=disabled
1111

1212
#![crate_type = "lib"]

‎tests/assembly/stack-protector/stack-protector-heuristics-effect.rs

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@
44
//@ ignore-msvc stack check code uses different function names
55
//@ ignore-nvptx64 stack protector is not supported
66
//@ ignore-wasm32-bare
7-
//@ [all] compile-flags: -Z stack-protector=all
8-
//@ [strong] compile-flags: -Z stack-protector=strong
9-
//@ [basic] compile-flags: -Z stack-protector=basic
10-
//@ [none] compile-flags: -Z stack-protector=none
7+
//@ [all] compile-flags: -C stack-protector=all
8+
//@ [strong] compile-flags: -C stack-protector=strong -Z unstable-options
9+
//@ [basic] compile-flags: -C stack-protector=basic -Z unstable-options
10+
//@ [none] compile-flags: -C stack-protector=none
1111
//@ compile-flags: -C opt-level=2 -Z merge-functions=disabled
1212
//@ min-llvm-version: 17.0.2
1313

‎tests/assembly/stack-protector/stack-protector-target-support.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -175,7 +175,7 @@
175175
//@ [r84] needs-llvm-components: x86
176176
//@ [r85] compile-flags: --target x86_64-unknown-redox
177177
//@ [r85] needs-llvm-components: x86
178-
//@ compile-flags: -Z stack-protector=all
178+
//@ compile-flags: -C stack-protector=all
179179
//@ compile-flags: -C opt-level=2
180180

181181
#![crate_type = "lib"]

‎tests/codegen/stack-protector.rs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
//@ revisions: all strong basic none
22
//@ ignore-nvptx64 stack protector not supported
3-
//@ [all] compile-flags: -Z stack-protector=all
4-
//@ [strong] compile-flags: -Z stack-protector=strong
5-
//@ [basic] compile-flags: -Z stack-protector=basic
3+
//@ [all] compile-flags: -C stack-protector=all
4+
//@ [strong] compile-flags: -C stack-protector=strong -Z unstable-options
5+
//@ [basic] compile-flags: -C stack-protector=basic -Z unstable-options
66

77
#![crate_type = "lib"]
88

‎tests/ui/abi/stack-protector.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
//@ run-pass
22
//@ only-x86_64-unknown-linux-gnu
33
//@ revisions: ssp no-ssp
4-
//@ [ssp] compile-flags: -Z stack-protector=all
4+
//@ [ssp] compile-flags: -C stack-protector=all
55
//@ compile-flags: -C opt-level=2
66
//@ compile-flags: -g
77

‎tests/ui/stack-protector/stack-protector-unstable.basic.stderr

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
error: `-C stack-protector=basic` and `-C stack-protector=strong` require `-Z unstable-options`
2+

‎tests/ui/stack-protector/stack-protector-unstable.rs

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
//@ revisions: all strong strong-ok basic basic-ok
2+
//@ compile-flags: --target x86_64-unknown-linux-gnu
3+
//@ needs-llvm-components: x86
4+
//@ [all] check-pass
5+
//@ [all] compile-flags: -C stack-protector=all
6+
//@ [strong] check-fail
7+
//@ [strong] compile-flags: -C stack-protector=strong
8+
//@ [strong-ok] check-pass
9+
//@ [strong-ok] compile-flags: -C stack-protector=strong -Z unstable-options
10+
//@ [basic] check-fail
11+
//@ [basic] compile-flags: -C stack-protector=basic
12+
//@ [basic-ok] check-pass
13+
//@ [basic-ok] compile-flags: -C stack-protector=basic -Z unstable-options
14+
15+
#![crate_type = "lib"]
16+
#![feature(no_core, lang_items)]
17+
#![no_std]
18+
#![no_core]
19+
20+
#[lang = "sized"]
21+
trait Sized {}
22+
#[lang = "copy"]
23+
trait Copy {}
24+
25+
pub fn main(){}

‎tests/ui/stack-protector/stack-protector-unstable.strong.stderr

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
error: `-C stack-protector=basic` and `-C stack-protector=strong` require `-Z unstable-options`
2+

‎tests/ui/stack-protector/warn-stack-protector-unsupported.all.stderr

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
warning: `-Z stack-protector=all` is not supported for target nvptx64-nvidia-cuda and will be ignored
1+
warning: `-C stack-protector=all` is not supported for target nvptx64-nvidia-cuda and will be ignored
22

33
warning: 1 warning emitted
44

‎tests/ui/stack-protector/warn-stack-protector-unsupported.basic.stderr

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
warning: `-Z stack-protector=basic` is not supported for target nvptx64-nvidia-cuda and will be ignored
1+
warning: `-C stack-protector=basic` is not supported for target nvptx64-nvidia-cuda and will be ignored
22

33
warning: 1 warning emitted
44

‎tests/ui/stack-protector/warn-stack-protector-unsupported.rs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
//@ revisions: all strong basic
33
//@ compile-flags: --target nvptx64-nvidia-cuda
44
//@ needs-llvm-components: nvptx
5-
//@ [all] compile-flags: -Z stack-protector=all
6-
//@ [strong] compile-flags: -Z stack-protector=strong
7-
//@ [basic] compile-flags: -Z stack-protector=basic
5+
//@ [all] compile-flags: -C stack-protector=all
6+
//@ [strong] compile-flags: -C stack-protector=strong -Z unstable-options
7+
//@ [basic] compile-flags: -C stack-protector=basic -Z unstable-options
88

99
#![crate_type = "lib"]
1010
#![feature(no_core, lang_items)]

‎tests/ui/stack-protector/warn-stack-protector-unsupported.strong.stderr

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
warning: `-Z stack-protector=strong` is not supported for target nvptx64-nvidia-cuda and will be ignored
1+
warning: `-C stack-protector=strong` is not supported for target nvptx64-nvidia-cuda and will be ignored
22

33
warning: 1 warning emitted
44

0 commit comments

Comments
 (0)