Skip to content

Commit 51d97e3

Browse files
davidtwcodavidtwco
committed
sess: stabilize -C stack-protector=all
Signed-off-by: David Wood <[email protected]>
1 parent 916e9ce commit 51d97e3

20 files changed

+105
-34
lines changed

‎compiler/rustc_interface/src/tests.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -636,6 +636,7 @@ fn test_codegen_options_tracking_hash() {
636636
tracked!(relro_level, Some(RelroLevel::Full));
637637
tracked!(soft_float, true);
638638
tracked!(split_debuginfo, Some(SplitDebuginfo::Packed));
639+
tracked!(stack_protector, StackProtector::All);
639640
tracked!(symbol_mangling_version, Some(SymbolManglingVersion::V0));
640641
tracked!(target_cpu, Some(String::from("abc")));
641642
tracked!(target_feature, String::from("all the features, all of them"));
@@ -853,7 +854,6 @@ fn test_unstable_options_tracking_hash() {
853854
tracked!(small_data_threshold, Some(16));
854855
tracked!(split_lto_unit, Some(true));
855856
tracked!(src_hash_algorithm, Some(SourceFileHashAlgorithm::Sha1));
856-
tracked!(stack_protector, StackProtector::All);
857857
tracked!(teach, true);
858858
tracked!(thinlto, Some(true));
859859
tracked!(tiny_const_eval_limit, true);

‎compiler/rustc_session/messages.ftl

+1-1
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ session_target_requires_unwind_tables = target requires unwind tables, they cann
125125
126126
session_target_small_data_threshold_not_supported = `-Z small-data-threshold` is not supported for target {$target_triple} and will be ignored
127127
128-
session_target_stack_protector_not_supported = `-Z stack-protector={$stack_protector}` is not supported for target {$target_triple} and will be ignored
128+
session_target_stack_protector_not_supported = `-C stack-protector={$stack_protector}` is not supported for target {$target_triple} and will be ignored
129129
130130
session_unleashed_feature_help_named = skipping check for `{$gate}` feature
131131
session_unleashed_feature_help_unnamed = skipping check that does not even have a feature gate

‎compiler/rustc_session/src/config.rs

+18-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,8 @@ use rustc_span::{
2626
FileName, FileNameDisplayPreference, RealFileName, SourceFileHashAlgorithm, Symbol, sym,
2727
};
2828
use rustc_target::spec::{
29-
FramePointer, LinkSelfContainedComponents, LinkerFeatures, SplitDebuginfo, Target, TargetTriple,
29+
FramePointer, LinkSelfContainedComponents, LinkerFeatures, SplitDebuginfo, StackProtector,
30+
Target, TargetTriple,
3031
};
3132
use tracing::debug;
3233

@@ -2523,6 +2524,22 @@ pub fn build_session_options(early_dcx: &mut EarlyDiagCtxt, matches: &getopts::M
25232524
}
25242525
}
25252526

2527+
// Check for unstable values of `-C stack-protector`.
2528+
// This is what prevents them from being used on stable compilers.
2529+
match cg.stack_protector {
2530+
// Stable values:
2531+
StackProtector::All | StackProtector::None => {}
2532+
// Unstable values:
2533+
StackProtector::Basic | StackProtector::Strong => {
2534+
if !unstable_opts.unstable_options {
2535+
early_dcx.early_fatal(
2536+
"`-C stack-protector=basic` and `-C stack-protector=strong` \
2537+
require `-Z unstable-options`",
2538+
);
2539+
}
2540+
}
2541+
}
2542+
25262543
if cg.instrument_coverage != InstrumentCoverage::No {
25272544
if cg.profile_generate.enabled() || cg.profile_use.is_some() {
25282545
early_dcx.early_fatal(

‎compiler/rustc_session/src/options.rs

+3-3
Original file line numberDiff line numberDiff line change
@@ -1646,6 +1646,9 @@ options! {
16461646
#[rustc_lint_opt_deny_field_access("use `Session::split_debuginfo` instead of this field")]
16471647
split_debuginfo: Option<SplitDebuginfo> = (None, parse_split_debuginfo, [TRACKED],
16481648
"how to handle split-debuginfo, a platform-specific option"),
1649+
#[rustc_lint_opt_deny_field_access("use `Session::stack_protector` instead of this field")]
1650+
stack_protector: StackProtector = (StackProtector::None, parse_stack_protector, [TRACKED],
1651+
"control stack smash protection strategy (`rustc --print stack-protector-strategies` for details)"),
16491652
strip: Strip = (Strip::None, parse_strip, [UNTRACKED],
16501653
"tell the linker which information to strip (`none` (default), `debuginfo` or `symbols`)"),
16511654
symbol_mangling_version: Option<SymbolManglingVersion> = (None,
@@ -2077,9 +2080,6 @@ written to standard error output)"),
20772080
"enable LTO unit splitting (default: no)"),
20782081
src_hash_algorithm: Option<SourceFileHashAlgorithm> = (None, parse_src_file_hash, [TRACKED],
20792082
"hash algorithm of source files in debug info (`md5`, `sha1`, or `sha256`)"),
2080-
#[rustc_lint_opt_deny_field_access("use `Session::stack_protector` instead of this field")]
2081-
stack_protector: StackProtector = (StackProtector::None, parse_stack_protector, [TRACKED],
2082-
"control stack smash protection strategy (`rustc --print stack-protector-strategies` for details)"),
20832083
staticlib_allow_rdylib_deps: bool = (false, parse_bool, [TRACKED],
20842084
"allow staticlibs to have rust dylib dependencies"),
20852085
staticlib_prefer_dynamic: bool = (false, parse_bool, [TRACKED],

‎compiler/rustc_session/src/session.rs

+3-3
Original file line numberDiff line numberDiff line change
@@ -780,7 +780,7 @@ impl Session {
780780

781781
pub fn stack_protector(&self) -> StackProtector {
782782
if self.target.options.supports_stack_protector {
783-
self.opts.unstable_opts.stack_protector
783+
self.opts.cg.stack_protector
784784
} else {
785785
StackProtector::None
786786
}
@@ -1273,10 +1273,10 @@ fn validate_commandline_args_with_session_available(sess: &Session) {
12731273
}
12741274
}
12751275

1276-
if sess.opts.unstable_opts.stack_protector != StackProtector::None {
1276+
if sess.opts.cg.stack_protector != StackProtector::None {
12771277
if !sess.target.options.supports_stack_protector {
12781278
sess.dcx().emit_warn(errors::StackProtectorNotSupportedForTarget {
1279-
stack_protector: sess.opts.unstable_opts.stack_protector,
1279+
stack_protector: sess.opts.cg.stack_protector,
12801280
target_triple: &sess.opts.target_triple,
12811281
});
12821282
}

‎src/doc/rustc/src/codegen-options/index.md

+21
Original file line numberDiff line numberDiff line change
@@ -565,6 +565,26 @@ Note that all three options are supported on Linux and Apple platforms,
565565
Attempting to use an unsupported option requires using the nightly channel
566566
with the `-Z unstable-options` flag.
567567

568+
## stack-protector
569+
570+
The option `-C stack-protector=val` controls stack smashing protection. See [Stack smashing
571+
protection][stack-smashing] for more details.
572+
573+
Supported values for this option are:
574+
575+
- `none` - no stack protectors
576+
- `all` - force use of stack protectors for all functions
577+
578+
Unstable options for this value are:
579+
580+
- `basic` - enable stack protectors for functions potentially vulnerable to stack smashing (basic
581+
heuristic)
582+
- `strong` - enable stack protectors for functions potentially vulnerable to stack smashing (strong
583+
heuristic)
584+
585+
`basic` and `strong` values for `-C stack-protector` require using the nightly channel with the
586+
`-Z unstable-options` flag.
587+
568588
## strip
569589

570590
The option `-C strip=val` controls stripping of debuginfo and similar auxiliary
@@ -667,3 +687,4 @@ effective only for x86 targets.
667687
[instrumentation-based code coverage]: ../instrument-coverage.md
668688
[profile-guided optimization]: ../profile-guided-optimization.md
669689
[option-g-debug]: ../command-line-arguments.md#option-g-debug
690+
[stack-smashing]: ../exploit-mitigations.md#stack-smashing-protection

‎src/doc/rustc/src/exploit-mitigations.md

+6-2
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ equivalent.
6363
| Stack clashing protection | Yes | 1.20.0 (2017-08-31) |
6464
| Read-only relocations and immediate binding | Yes | 1.21.0 (2017-10-12) |
6565
| Heap corruption protection | Yes | 1.32.0 (2019-01-17) (via operating system default or specified allocator) |
66-
| Stack smashing protection | Yes | Nightly |
66+
| Stack smashing protection | Yes | 1.78.0 (2024-05-02) |
6767
| Forward-edge control flow protection | Yes | Nightly |
6868
| Backward-edge control flow protection (e.g., shadow and safe stack) | Yes | Nightly |
6969

@@ -357,7 +357,8 @@ instruction pointer, and checking if this value has changed when returning from
357357
a function. This is also known as “Stack Protector” or “Stack Smashing
358358
Protector (SSP)”.
359359

360-
The Rust compiler supports stack smashing protection on nightly builds[40].
360+
The Rust compiler supports stack smashing protection with the `-C stack-protector=all`
361+
flag since version 1.78.0 (2024-05-02)[40], [47].
361362

362363
![Screenshot of IDA Pro listing cross references to __stack_chk_fail in hello-rust.](images/image3.png "Cross references to __stack_chk_fail in hello-rust.")
363364
Fig. 14. IDA Pro listing cross references to `__stack_chk_fail` in hello-rust.
@@ -627,3 +628,6 @@ to `READ_IMPLIES_EXEC`).
627628

628629
46. “SafeStack.” The Rust Unstable Book.
629630
[https://doc.rust-lang/org/unstable-book/compiler-flags/sanitizer.html#safestack](../unstable-book/compiler-flags/sanitizer.html#safestack).
631+
632+
47. D. Wood. “sess: stabilize stack-protector=all #121742” GitHub.
633+
<https://github.com/rust-lang/rust/pull/121742>

‎tests/assembly/stack-protector/stack-protector-heuristics-effect-windows-32bit.rs

+4-4
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,10 @@
33
//@ only-windows
44
//@ only-msvc
55
//@ ignore-64bit 64-bit table based SEH has slightly different behaviors than classic SEH
6-
//@ [all] compile-flags: -Z stack-protector=all
7-
//@ [strong] compile-flags: -Z stack-protector=strong
8-
//@ [basic] compile-flags: -Z stack-protector=basic
9-
//@ [none] compile-flags: -Z stack-protector=none
6+
//@ [all] compile-flags: -C stack-protector=all
7+
//@ [strong] compile-flags: -C stack-protector=strong -Z unstable-options
8+
//@ [basic] compile-flags: -C stack-protector=basic -Z unstable-options
9+
//@ [none] compile-flags: -C stack-protector=none
1010
//@ compile-flags: -C opt-level=2 -Z merge-functions=disabled
1111

1212
#![crate_type = "lib"]

‎tests/assembly/stack-protector/stack-protector-heuristics-effect-windows-64bit.rs

+4-4
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,10 @@
33
//@ only-windows
44
//@ only-msvc
55
//@ ignore-32bit 64-bit table based SEH has slightly different behaviors than classic SEH
6-
//@ [all] compile-flags: -Z stack-protector=all
7-
//@ [strong] compile-flags: -Z stack-protector=strong
8-
//@ [basic] compile-flags: -Z stack-protector=basic
9-
//@ [none] compile-flags: -Z stack-protector=none
6+
//@ [all] compile-flags: -C stack-protector=all
7+
//@ [strong] compile-flags: -C stack-protector=strong -Z unstable-options
8+
//@ [basic] compile-flags: -C stack-protector=basic -Z unstable-options
9+
//@ [none] compile-flags: -C stack-protector=none
1010
//@ compile-flags: -C opt-level=2 -Z merge-functions=disabled
1111

1212
#![crate_type = "lib"]

‎tests/assembly/stack-protector/stack-protector-heuristics-effect.rs

+4-4
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@
44
//@ ignore-msvc stack check code uses different function names
55
//@ ignore-nvptx64 stack protector is not supported
66
//@ ignore-wasm32-bare
7-
//@ [all] compile-flags: -Z stack-protector=all
8-
//@ [strong] compile-flags: -Z stack-protector=strong
9-
//@ [basic] compile-flags: -Z stack-protector=basic
10-
//@ [none] compile-flags: -Z stack-protector=none
7+
//@ [all] compile-flags: -C stack-protector=all
8+
//@ [strong] compile-flags: -C stack-protector=strong -Z unstable-options
9+
//@ [basic] compile-flags: -C stack-protector=basic -Z unstable-options
10+
//@ [none] compile-flags: -C stack-protector=none
1111
//@ compile-flags: -C opt-level=2 -Z merge-functions=disabled
1212

1313
// NOTE: the heuristics for stack smash protection inappropriately rely on types in LLVM IR,

‎tests/assembly/stack-protector/stack-protector-target-support.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -175,7 +175,7 @@
175175
//@ [r84] needs-llvm-components: x86
176176
//@ [r85] compile-flags: --target x86_64-unknown-redox
177177
//@ [r85] needs-llvm-components: x86
178-
//@ compile-flags: -Z stack-protector=all
178+
//@ compile-flags: -C stack-protector=all
179179
//@ compile-flags: -C opt-level=2
180180

181181
#![crate_type = "lib"]

‎tests/codegen/stack-protector.rs

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
//@ revisions: all strong basic none
22
//@ ignore-nvptx64 stack protector not supported
3-
//@ [all] compile-flags: -Z stack-protector=all
4-
//@ [strong] compile-flags: -Z stack-protector=strong
5-
//@ [basic] compile-flags: -Z stack-protector=basic
3+
//@ [all] compile-flags: -C stack-protector=all
4+
//@ [strong] compile-flags: -C stack-protector=strong -Z unstable-options
5+
//@ [basic] compile-flags: -C stack-protector=basic -Z unstable-options
66

77
#![crate_type = "lib"]
88

‎tests/ui/abi/stack-protector.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
//@ run-pass
22
//@ only-x86_64-unknown-linux-gnu
33
//@ revisions: ssp no-ssp
4-
//@ [ssp] compile-flags: -Z stack-protector=all
4+
//@ [ssp] compile-flags: -C stack-protector=all
55
//@ compile-flags: -C opt-level=2
66
//@ compile-flags: -g
77

‎tests/ui/stack-protector/stack-protector-unstable.basic.stderr

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
error: `-C stack-protector=basic` and `-C stack-protector=strong` require `-Z unstable-options`
2+

‎tests/ui/stack-protector/stack-protector-unstable.rs

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
//@ revisions: all strong strong-ok basic basic-ok
2+
//@ compile-flags: --target x86_64-unknown-linux-gnu
3+
//@ needs-llvm-components: x86
4+
//@ [all] check-pass
5+
//@ [all] compile-flags: -C stack-protector=all
6+
//@ [strong] check-fail
7+
//@ [strong] compile-flags: -C stack-protector=strong
8+
//@ [strong-ok] check-pass
9+
//@ [strong-ok] compile-flags: -C stack-protector=strong -Z unstable-options
10+
//@ [basic] check-fail
11+
//@ [basic] compile-flags: -C stack-protector=basic
12+
//@ [basic-ok] check-pass
13+
//@ [basic-ok] compile-flags: -C stack-protector=basic -Z unstable-options
14+
15+
#![crate_type = "lib"]
16+
#![feature(no_core, lang_items)]
17+
#![no_std]
18+
#![no_core]
19+
20+
#[lang = "sized"]
21+
trait Sized {}
22+
#[lang = "copy"]
23+
trait Copy {}
24+
25+
pub fn main(){}

‎tests/ui/stack-protector/stack-protector-unstable.strong.stderr

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
error: `-C stack-protector=basic` and `-C stack-protector=strong` require `-Z unstable-options`
2+

‎tests/ui/stack-protector/warn-stack-protector-unsupported.all.stderr

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
warning: `-Z stack-protector=all` is not supported for target nvptx64-nvidia-cuda and will be ignored
1+
warning: `-C stack-protector=all` is not supported for target nvptx64-nvidia-cuda and will be ignored
22

33
warning: 1 warning emitted
44

‎tests/ui/stack-protector/warn-stack-protector-unsupported.basic.stderr

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
warning: `-Z stack-protector=basic` is not supported for target nvptx64-nvidia-cuda and will be ignored
1+
warning: `-C stack-protector=basic` is not supported for target nvptx64-nvidia-cuda and will be ignored
22

33
warning: 1 warning emitted
44

‎tests/ui/stack-protector/warn-stack-protector-unsupported.rs

+3-3
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
//@ revisions: all strong basic
33
//@ compile-flags: --target nvptx64-nvidia-cuda
44
//@ needs-llvm-components: nvptx
5-
//@ [all] compile-flags: -Z stack-protector=all
6-
//@ [strong] compile-flags: -Z stack-protector=strong
7-
//@ [basic] compile-flags: -Z stack-protector=basic
5+
//@ [all] compile-flags: -C stack-protector=all
6+
//@ [strong] compile-flags: -C stack-protector=strong -Z unstable-options
7+
//@ [basic] compile-flags: -C stack-protector=basic -Z unstable-options
88

99
#![crate_type = "lib"]
1010
#![feature(no_core, lang_items)]

‎tests/ui/stack-protector/warn-stack-protector-unsupported.strong.stderr

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
warning: `-Z stack-protector=strong` is not supported for target nvptx64-nvidia-cuda and will be ignored
1+
warning: `-C stack-protector=strong` is not supported for target nvptx64-nvidia-cuda and will be ignored
22

33
warning: 1 warning emitted
44

0 commit comments

Comments
 (0)