Skip to content

Commit 5cfa279

Browse files
davidtwcodavidtwco
committed
sess: stabilize -C stack-protector=all
Signed-off-by: David Wood <[email protected]>
1 parent 7a495cc commit 5cfa279

20 files changed

+104
-34
lines changed

‎compiler/rustc_interface/src/tests.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -626,6 +626,7 @@ fn test_codegen_options_tracking_hash() {
626626
tracked!(relocation_model, Some(RelocModel::Pic));
627627
tracked!(soft_float, true);
628628
tracked!(split_debuginfo, Some(SplitDebuginfo::Packed));
629+
tracked!(stack_protector, StackProtector::All);
629630
tracked!(symbol_mangling_version, Some(SymbolManglingVersion::V0));
630631
tracked!(target_cpu, Some(String::from("abc")));
631632
tracked!(target_feature, String::from("all the features, all of them"));
@@ -837,7 +838,6 @@ fn test_unstable_options_tracking_hash() {
837838
tracked!(simulate_remapped_rust_src_base, Some(PathBuf::from("/rustc/abc")));
838839
tracked!(split_lto_unit, Some(true));
839840
tracked!(src_hash_algorithm, Some(SourceFileHashAlgorithm::Sha1));
840-
tracked!(stack_protector, StackProtector::All);
841841
tracked!(teach, true);
842842
tracked!(thinlto, Some(true));
843843
tracked!(tiny_const_eval_limit, true);

‎compiler/rustc_session/messages.ftl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ session_split_lto_unit_requires_lto = `-Zsplit-lto-unit` requires `-Clto`, `-Clt
109109
110110
session_target_requires_unwind_tables = target requires unwind tables, they cannot be disabled with `-C force-unwind-tables=no`
111111
112-
session_target_stack_protector_not_supported = `-Z stack-protector={$stack_protector}` is not supported for target {$target_triple} and will be ignored
112+
session_target_stack_protector_not_supported = `-C stack-protector={$stack_protector}` is not supported for target {$target_triple} and will be ignored
113113
114114
session_unleashed_feature_help_named = skipping check for `{$gate}` feature
115115
session_unleashed_feature_help_unnamed = skipping check that does not even have a feature gate

‎compiler/rustc_session/src/config.rs

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ use rustc_span::edition::{Edition, DEFAULT_EDITION, EDITION_NAME_LIST, LATEST_ST
1919
use rustc_span::source_map::FilePathMapping;
2020
use rustc_span::{FileName, FileNameDisplayPreference, RealFileName, SourceFileHashAlgorithm};
2121
use rustc_target::spec::LinkSelfContainedComponents;
22-
use rustc_target::spec::{SplitDebuginfo, Target, TargetTriple};
22+
use rustc_target::spec::{SplitDebuginfo, StackProtector, Target, TargetTriple};
2323
use std::collections::btree_map::{
2424
Iter as BTreeMapIter, Keys as BTreeMapKeysIter, Values as BTreeMapValuesIter,
2525
};
@@ -2355,6 +2355,22 @@ pub fn build_session_options(early_dcx: &mut EarlyDiagCtxt, matches: &getopts::M
23552355
}
23562356
}
23572357

2358+
// Check for unstable values of `-C stack-protector`.
2359+
// This is what prevents them from being used on stable compilers.
2360+
match cg.stack_protector {
2361+
// Stable values:
2362+
StackProtector::All | StackProtector::None => {}
2363+
// Unstable values:
2364+
StackProtector::Basic | StackProtector::Strong => {
2365+
if !unstable_opts.unstable_options {
2366+
early_dcx.early_fatal(
2367+
"`-C stack-protector=basic` and `-C stack-protector=strong` \
2368+
require `-Z unstable-options`",
2369+
);
2370+
}
2371+
}
2372+
}
2373+
23582374
if cg.instrument_coverage != InstrumentCoverage::No {
23592375
if cg.profile_generate.enabled() || cg.profile_use.is_some() {
23602376
early_dcx.early_fatal(

‎compiler/rustc_session/src/options.rs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1527,6 +1527,9 @@ options! {
15271527
#[rustc_lint_opt_deny_field_access("use `Session::split_debuginfo` instead of this field")]
15281528
split_debuginfo: Option<SplitDebuginfo> = (None, parse_split_debuginfo, [TRACKED],
15291529
"how to handle split-debuginfo, a platform-specific option"),
1530+
#[rustc_lint_opt_deny_field_access("use `Session::stack_protector` instead of this field")]
1531+
stack_protector: StackProtector = (StackProtector::None, parse_stack_protector, [TRACKED],
1532+
"control stack smash protection strategy (`rustc --print stack-protector-strategies` for details)"),
15301533
strip: Strip = (Strip::None, parse_strip, [UNTRACKED],
15311534
"tell the linker which information to strip (`none` (default), `debuginfo` or `symbols`)"),
15321535
symbol_mangling_version: Option<SymbolManglingVersion> = (None,
@@ -1931,9 +1934,6 @@ written to standard error output)"),
19311934
"enable LTO unit splitting (default: no)"),
19321935
src_hash_algorithm: Option<SourceFileHashAlgorithm> = (None, parse_src_file_hash, [TRACKED],
19331936
"hash algorithm of source files in debug info (`md5`, `sha1`, or `sha256`)"),
1934-
#[rustc_lint_opt_deny_field_access("use `Session::stack_protector` instead of this field")]
1935-
stack_protector: StackProtector = (StackProtector::None, parse_stack_protector, [TRACKED],
1936-
"control stack smash protection strategy (`rustc --print stack-protector-strategies` for details)"),
19371937
staticlib_allow_rdylib_deps: bool = (false, parse_bool, [TRACKED],
19381938
"allow staticlibs to have rust dylib dependencies"),
19391939
staticlib_prefer_dynamic: bool = (false, parse_bool, [TRACKED],

‎compiler/rustc_session/src/session.rs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -764,7 +764,7 @@ impl Session {
764764

765765
pub fn stack_protector(&self) -> StackProtector {
766766
if self.target.options.supports_stack_protector {
767-
self.opts.unstable_opts.stack_protector
767+
self.opts.cg.stack_protector
768768
} else {
769769
StackProtector::None
770770
}
@@ -1273,10 +1273,10 @@ fn validate_commandline_args_with_session_available(sess: &Session) {
12731273
}
12741274
}
12751275

1276-
if sess.opts.unstable_opts.stack_protector != StackProtector::None {
1276+
if sess.opts.cg.stack_protector != StackProtector::None {
12771277
if !sess.target.options.supports_stack_protector {
12781278
sess.dcx().emit_warn(errors::StackProtectorNotSupportedForTarget {
1279-
stack_protector: sess.opts.unstable_opts.stack_protector,
1279+
stack_protector: sess.opts.cg.stack_protector,
12801280
target_triple: &sess.opts.target_triple,
12811281
});
12821282
}

‎src/doc/rustc/src/codegen-options/index.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -541,6 +541,26 @@ Note that all three options are supported on Linux and Apple platforms,
541541
Attempting to use an unsupported option requires using the nightly channel
542542
with the `-Z unstable-options` flag.
543543

544+
## stack-protector
545+
546+
The option `-C stack-protector=val` controls stack smashing protection. See [Stack smashing
547+
protection][stack-smashing] for more details.
548+
549+
Supported values for this option are:
550+
551+
- `none` - no stack protectors
552+
- `all` - force use of stack protectors for all functions
553+
554+
Unstable options for this value are:
555+
556+
- `basic` - enable stack protectors for functions potentially vulnerable to stack smashing (basic
557+
heuristic)
558+
- `strong` - enable stack protectors for functions potentially vulnerable to stack smashing (strong
559+
heuristic)
560+
561+
`basic` and `strong` values for `-C stack-protector` require using the nightly channel with the
562+
`-Z unstable-options` flag.
563+
544564
## strip
545565

546566
The option `-C strip=val` controls stripping of debuginfo and similar auxiliary
@@ -642,3 +662,4 @@ effective only for x86 targets.
642662
[instrumentation-based code coverage]: ../instrument-coverage.md
643663
[profile-guided optimization]: ../profile-guided-optimization.md
644664
[option-g-debug]: ../command-line-arguments.md#option-g-debug
665+
[stack-smashing]: ../exploit-mitigations.md#stack-smashing-protection

‎src/doc/rustc/src/exploit-mitigations.md

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ equivalent.
6363
| Stack clashing protection | Yes | 1.20.0 (2017-08-31) |
6464
| Read-only relocations and immediate binding | Yes | 1.21.0 (2017-10-12) |
6565
| Heap corruption protection | Yes | 1.32.0 (2019-01-17) (via operating system default or specified allocator) |
66-
| Stack smashing protection | Yes | Nightly |
66+
| Stack smashing protection | Yes | 1.78.0 (2024-05-02) |
6767
| Forward-edge control flow protection | Yes | Nightly |
6868
| Backward-edge control flow protection (e.g., shadow and safe stack) | Yes | Nightly |
6969

@@ -357,7 +357,8 @@ instruction pointer, and checking if this value has changed when returning from
357357
a function. This is also known as “Stack Protector” or “Stack Smashing
358358
Protector (SSP)”.
359359

360-
The Rust compiler supports stack smashing protection on nightly builds[40].
360+
The Rust compiler supports stack smashing protection with the `-C stack-protector=all`
361+
flag since version 1.78.0 (2024-05-02)[40], [47].
361362

362363
![Screenshot of IDA Pro listing cross references to __stack_chk_fail in hello-rust.](images/image3.png "Cross references to __stack_chk_fail in hello-rust.")
363364
Fig. 14. IDA Pro listing cross references to `__stack_chk_fail` in hello-rust.
@@ -627,3 +628,6 @@ to `READ_IMPLIES_EXEC`).
627628

628629
46. “SafeStack.” The Rust Unstable Book.
629630
[https://doc.rust-lang/org/unstable-book/compiler-flags/sanitizer.html#safestack](../unstable-book/compiler-flags/sanitizer.html#safestack).
631+
632+
47. D. Wood. “sess: stabilize stack-protector=all #121742” GitHub.
633+
<https://github.com/rust-lang/rust/pull/121742>

‎tests/assembly/stack-protector/stack-protector-heuristics-effect-windows-32bit.rs

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,10 @@
33
//@ only-windows
44
//@ only-msvc
55
//@ ignore-64bit 64-bit table based SEH has slightly different behaviors than classic SEH
6-
//@ [all] compile-flags: -Z stack-protector=all
7-
//@ [strong] compile-flags: -Z stack-protector=strong
8-
//@ [basic] compile-flags: -Z stack-protector=basic
9-
//@ [none] compile-flags: -Z stack-protector=none
6+
//@ [all] compile-flags: -C stack-protector=all
7+
//@ [strong] compile-flags: -C stack-protector=strong -Z unstable-options
8+
//@ [basic] compile-flags: -C stack-protector=basic -Z unstable-options
9+
//@ [none] compile-flags: -C stack-protector=none
1010
//@ compile-flags: -C opt-level=2 -Z merge-functions=disabled
1111

1212
#![crate_type = "lib"]

‎tests/assembly/stack-protector/stack-protector-heuristics-effect-windows-64bit.rs

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,10 @@
33
//@ only-windows
44
//@ only-msvc
55
//@ ignore-32bit 64-bit table based SEH has slightly different behaviors than classic SEH
6-
//@ [all] compile-flags: -Z stack-protector=all
7-
//@ [strong] compile-flags: -Z stack-protector=strong
8-
//@ [basic] compile-flags: -Z stack-protector=basic
9-
//@ [none] compile-flags: -Z stack-protector=none
6+
//@ [all] compile-flags: -C stack-protector=all
7+
//@ [strong] compile-flags: -C stack-protector=strong -Z unstable-options
8+
//@ [basic] compile-flags: -C stack-protector=basic -Z unstable-options
9+
//@ [none] compile-flags: -C stack-protector=none
1010
//@ compile-flags: -C opt-level=2 -Z merge-functions=disabled
1111

1212
#![crate_type = "lib"]

‎tests/assembly/stack-protector/stack-protector-heuristics-effect.rs

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@
44
//@ ignore-msvc stack check code uses different function names
55
//@ ignore-nvptx64 stack protector is not supported
66
//@ ignore-wasm32-bare
7-
//@ [all] compile-flags: -Z stack-protector=all
8-
//@ [strong] compile-flags: -Z stack-protector=strong
9-
//@ [basic] compile-flags: -Z stack-protector=basic
10-
//@ [none] compile-flags: -Z stack-protector=none
7+
//@ [all] compile-flags: -C stack-protector=all
8+
//@ [strong] compile-flags: -C stack-protector=strong -Z unstable-options
9+
//@ [basic] compile-flags: -C stack-protector=basic -Z unstable-options
10+
//@ [none] compile-flags: -C stack-protector=none
1111
//@ compile-flags: -C opt-level=2 -Z merge-functions=disabled
1212
//@ min-llvm-version: 17.0.2
1313

‎tests/assembly/stack-protector/stack-protector-target-support.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -175,7 +175,7 @@
175175
//@ [r84] needs-llvm-components: x86
176176
//@ [r85] compile-flags: --target x86_64-unknown-redox
177177
//@ [r85] needs-llvm-components: x86
178-
//@ compile-flags: -Z stack-protector=all
178+
//@ compile-flags: -C stack-protector=all
179179
//@ compile-flags: -C opt-level=2
180180

181181
#![crate_type = "lib"]

‎tests/codegen/stack-protector.rs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
//@ revisions: all strong basic none
22
//@ ignore-nvptx64 stack protector not supported
3-
//@ [all] compile-flags: -Z stack-protector=all
4-
//@ [strong] compile-flags: -Z stack-protector=strong
5-
//@ [basic] compile-flags: -Z stack-protector=basic
3+
//@ [all] compile-flags: -C stack-protector=all
4+
//@ [strong] compile-flags: -C stack-protector=strong -Z unstable-options
5+
//@ [basic] compile-flags: -C stack-protector=basic -Z unstable-options
66

77
#![crate_type = "lib"]
88

‎tests/ui/abi/stack-protector.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
//@ run-pass
22
//@ only-x86_64-unknown-linux-gnu
33
//@ revisions: ssp no-ssp
4-
//@ [ssp] compile-flags: -Z stack-protector=all
4+
//@ [ssp] compile-flags: -C stack-protector=all
55
//@ compile-flags: -C opt-level=2
66
//@ compile-flags: -g
77

‎tests/ui/stack-protector/stack-protector-unstable.basic.stderr

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
error: `-C stack-protector=basic` and `-C stack-protector=strong` require `-Z unstable-options`
2+

‎tests/ui/stack-protector/stack-protector-unstable.rs

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
//@ revisions: all strong strong-ok basic basic-ok
2+
//@ compile-flags: --target x86_64-unknown-linux-gnu
3+
//@ needs-llvm-components: x86
4+
//@ [all] check-pass
5+
//@ [all] compile-flags: -C stack-protector=all
6+
//@ [strong] check-fail
7+
//@ [strong] compile-flags: -C stack-protector=strong
8+
//@ [strong-ok] check-pass
9+
//@ [strong-ok] compile-flags: -C stack-protector=strong -Z unstable-options
10+
//@ [basic] check-fail
11+
//@ [basic] compile-flags: -C stack-protector=basic
12+
//@ [basic-ok] check-pass
13+
//@ [basic-ok] compile-flags: -C stack-protector=basic -Z unstable-options
14+
15+
#![crate_type = "lib"]
16+
#![feature(no_core, lang_items)]
17+
#![no_std]
18+
#![no_core]
19+
20+
#[lang = "sized"]
21+
trait Sized {}
22+
#[lang = "copy"]
23+
trait Copy {}
24+
25+
pub fn main(){}

‎tests/ui/stack-protector/stack-protector-unstable.strong.stderr

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
error: `-C stack-protector=basic` and `-C stack-protector=strong` require `-Z unstable-options`
2+

‎tests/ui/stack-protector/warn-stack-protector-unsupported.all.stderr

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
warning: `-Z stack-protector=all` is not supported for target nvptx64-nvidia-cuda and will be ignored
1+
warning: `-C stack-protector=all` is not supported for target nvptx64-nvidia-cuda and will be ignored
22

33
warning: 1 warning emitted
44

‎tests/ui/stack-protector/warn-stack-protector-unsupported.basic.stderr

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
warning: `-Z stack-protector=basic` is not supported for target nvptx64-nvidia-cuda and will be ignored
1+
warning: `-C stack-protector=basic` is not supported for target nvptx64-nvidia-cuda and will be ignored
22

33
warning: 1 warning emitted
44

‎tests/ui/stack-protector/warn-stack-protector-unsupported.rs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
//@ revisions: all strong basic
33
//@ compile-flags: --target nvptx64-nvidia-cuda
44
//@ needs-llvm-components: nvptx
5-
//@ [all] compile-flags: -Z stack-protector=all
6-
//@ [strong] compile-flags: -Z stack-protector=strong
7-
//@ [basic] compile-flags: -Z stack-protector=basic
5+
//@ [all] compile-flags: -C stack-protector=all
6+
//@ [strong] compile-flags: -C stack-protector=strong -Z unstable-options
7+
//@ [basic] compile-flags: -C stack-protector=basic -Z unstable-options
88

99
#![crate_type = "lib"]
1010
#![feature(no_core, lang_items)]

‎tests/ui/stack-protector/warn-stack-protector-unsupported.strong.stderr

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
warning: `-Z stack-protector=strong` is not supported for target nvptx64-nvidia-cuda and will be ignored
1+
warning: `-C stack-protector=strong` is not supported for target nvptx64-nvidia-cuda and will be ignored
22

33
warning: 1 warning emitted
44

0 commit comments

Comments
 (0)