libvtv/vtv_fail.cc

   1 /* Copyright (C) 2012-2020 Free Software Foundation, Inc.
   2
   3  This file is part of GCC.
   4
   5  GCC is free software; you can redistribute it and/or modify
   6  it under the terms of the GNU General Public License as published by
   7  the Free Software Foundation; either version 3, or (at your option)
   8  any later version.
   9
  10  GCC is distributed in the hope that it will be useful,
  11  but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  GNU General Public License for more details.
  14
  15  Under Section 7 of GPL version 3, you are granted additional
  16  permissions described in the GCC Runtime Library Exception, version
  17  3.1, as published by the Free Software Foundation.
  18
  19  You should have received a copy of the GNU General Public License and
  20  a copy of the GCC Runtime Library Exception along with this program;
  21  see the files COPYING3 and COPYING.RUNTIME respectively.  If not, see
  22  <http://www.gnu.org/licenses/>.  */
  23
  24 /* This file is part of the vtable security feature implementation.
  25    The vtable security feature is designed to detect when a virtual
  26    call is about to be made through an invalid vtable pointer
  27    (possibly due to data corruption or malicious attacks).
  28
  29    This file also contains the failure functions that get called when
  30    a vtable pointer is not found in the data set.  Two particularly
  31    important functions are __vtv_verify_fail and __vtv_really_fail.
  32    They are both externally visible.  __vtv_verify_fail is defined in
  33    such a way that it can be replaced by a programmer, if desired.  It
  34    is the function that __VLTVerifyVtablePointer calls if it can't
  35    find the pointer in the data set.  Allowing the programmer to
  36    overwrite this function means that he/she can do some alternate
  37    verification, including NOT failing in certain specific cases, if
  38    desired.  This may be the case if the programmer has to deal wtih
  39    unverified third party software, for example.  __vtv_really_fail is
  40    available for the programmer to call from his version of
  41    __vtv_verify_fail, if he decides the failure is real.
  42
  43 */
  44
  45 #include <stdlib.h>
  46 #include <stdio.h>
  47 #include <string.h>
  48
  49 #if !defined (__CYGWIN__) && !defined (__MINGW32__)
  50 #include <execinfo.h>
  51 #endif
  52
  53 #include <unistd.h>
  54
  55 #include "vtv_utils.h"
  56 #include "vtv_fail.h"
  57
  58 /* This is used to disable aborts for debugging purposes.  */
  59 bool vtv_no_abort = false;
  60
  61
  62 extern "C" {
  63
  64   /* __fortify_fail is a function in glibc that calls __libc_message,
  65      causing it to print out a program termination error message
  66      (including the name of the binary being terminated), a stack
  67      trace where the error occurred, and a memory map dump.  Ideally
  68      we would have called __libc_message directly, but that function
  69      does not appear to be accessible to functions outside glibc,
  70      whereas __fortify_fail is.  We call __fortify_fail from
  71      __vtv_really_fail.  We looked at calling __libc_fatal, which is
  72      externally accessible, but it does not do the back trace and
  73      memory dump.  */
  74
  75   extern void __fortify_fail (const char *) __attribute__((noreturn));
  76
  77 } /* extern "C" */
  78
  79 const unsigned long SET_HANDLE_HANDLE_BIT = 0x2;
  80
  81 /* Instantiate the template classes (in vtv_set.h) for our particular
  82    hash table needs.  */
  83 typedef void * vtv_set_handle;
  84 typedef vtv_set_handle * vtv_set_handle_handle;
  85
  86 static int vtv_failures_log_fd = -1;
  87
  88 /* Open error logging file, if not already open, and write vtable
  89    verification failure messages (LOG_MSG) to the log file.  Also
  90    generate a backtrace in the log file, if GENERATE_BACKTRACE is
  91    set.  */
  92
  93 static void
  94 log_error_message (const char *log_msg, bool generate_backtrace)
  95 {
  96   if (vtv_failures_log_fd == -1)
  97     vtv_failures_log_fd = vtv_open_log ("vtable_verification_failures.log");
  98
  99   if (vtv_failures_log_fd == -1)
 100     return;
 101
 102   vtv_add_to_log (vtv_failures_log_fd, "%s", log_msg);
 103
 104   if (generate_backtrace)
 105     {
 106 #define STACK_DEPTH 20
 107       void *callers[STACK_DEPTH];
 108 #if !defined (__CYGWIN__) && !defined (__MINGW32__)
 109       int actual_depth = backtrace (callers, STACK_DEPTH);
 110       backtrace_symbols_fd (callers, actual_depth, vtv_failures_log_fd);
 111 #endif
 112     }
 113 }
 114
 115 /* In the case where a vtable map variable is the only instance of the
 116    variable we have seen, it points directly to the set of valid
 117    vtable pointers.  All subsequent instances of the 'same' vtable map
 118    variable point to the first vtable map variable.  This function,
 119    given a vtable map variable PTR, checks a bit to see whether it's
 120    pointing directly to the data set or to the first vtable map
 121    variable.  */
 122
 123 static inline bool
 124 is_set_handle_handle (void * ptr)
 125 {
 126   return ((unsigned long) ptr & SET_HANDLE_HANDLE_BIT)
 127                                                       == SET_HANDLE_HANDLE_BIT;
 128 }
 129
 130 /* Returns the actual pointer value of a vtable map variable, PTR (see
 131    comments for is_set_handle_handle for more details).  */
 132
 133 static inline vtv_set_handle *
 134 ptr_from_set_handle_handle (void * ptr)
 135 {
 136   return (vtv_set_handle *) ((unsigned long) ptr & ~SET_HANDLE_HANDLE_BIT);
 137 }
 138
 139 /* Given a vtable map variable, PTR, this function sets the bit that
 140    says this is the second (or later) instance of a vtable map
 141    variable.  */
 142
 143 static inline vtv_set_handle_handle
 144 set_handle_handle (vtv_set_handle * ptr)
 145 {
 146   return (vtv_set_handle_handle) ((unsigned long) ptr | SET_HANDLE_HANDLE_BIT);
 147 }
 148
 149 /* This function is called from __VLTVerifyVtablePointerDebug; it
 150    sends as much debugging information as it can to the error log
 151    file, then calls __vtv_verify_fail.  SET_HANDLE_PTR is the pointer
 152    to the set of valid vtable pointers, VTBL_PTR is the pointer that
 153    was not found in the set, and DEBUG_MSG is the message to be
 154    written to the log file before failing. n */
 155
 156 void
 157 __vtv_verify_fail_debug (void **set_handle_ptr, const void *vtbl_ptr,
 158                          const char *debug_msg)
 159 {
 160   log_error_message (debug_msg, false);
 161
 162   /* Call the public interface in case it has been overwritten by
 163      user.  */
 164   __vtv_verify_fail (set_handle_ptr, vtbl_ptr);
 165
 166   log_error_message ("Returned from __vtv_verify_fail."
 167                      " Secondary verification succeeded.\n", false);
 168 }
 169
 170 /* This function calls __fortify_fail with a FAILURE_MSG and then
 171    calls abort.  */
 172
 173 void
 174 __vtv_really_fail (const char *failure_msg)
 175 {
 176   __fortify_fail (failure_msg);
 177
 178   /* We should never get this far; __fortify_fail calls __libc_message
 179      which prints out a back trace and a memory dump and then is
 180      supposed to call abort, but let's play it safe anyway and call abort
 181      ourselves.  */
 182   abort ();
 183 }
 184
 185 /* This function takes an error MSG, a vtable map variable
 186    (DATA_SET_PTR) and a vtable pointer (VTBL_PTR).  It is called when
 187    an attempt to verify VTBL_PTR with the set pointed to by
 188    DATA_SET_PTR failed.  It outputs a failure message with the
 189    addresses involved, and calls __vtv_really_fail.  */
 190
 191 static void
 192 vtv_fail (const char *msg, void **data_set_ptr, const void *vtbl_ptr)
 193 {
 194   char buffer[128];
 195   int buf_len;
 196   const char *format_str =
 197                  "*** Unable to verify vtable pointer (%p) in set (%p) *** \n";
 198
 199   snprintf (buffer, sizeof (buffer), format_str, vtbl_ptr,
 200             is_set_handle_handle(*data_set_ptr) ?
 201               ptr_from_set_handle_handle (*data_set_ptr) :
 202               *data_set_ptr);
 203   buf_len = strlen (buffer);
 204   /*  Send this to to stderr.  */
 205   write (2, buffer, buf_len);
 206
 207   if (!vtv_no_abort)
 208     __vtv_really_fail (msg);
 209 }
 210
 211 /* Send information about what we were trying to do when verification
 212    failed to the error log, then call vtv_fail.  This function can be
 213    overwritten/replaced by the user, to implement a secondary
 214    verification function instead.  DATA_SET_PTR is the vtable map
 215    variable used for the failed verification, and VTBL_PTR is the
 216    vtable pointer that was not found in the set.  */
 217
 218 void
 219 __vtv_verify_fail (void **data_set_ptr, const void *vtbl_ptr)
 220 {
 221   char log_msg[256];
 222   snprintf (log_msg, sizeof (log_msg), "Looking for vtable %p in set %p.\n",
 223             vtbl_ptr,
 224             is_set_handle_handle (*data_set_ptr) ?
 225               ptr_from_set_handle_handle (*data_set_ptr) :
 226               *data_set_ptr);
 227   log_error_message (log_msg, false);
 228
 229   const char *format_str =
 230             "*** Unable to verify vtable pointer (%p) in set (%p) *** \n";
 231   snprintf (log_msg, sizeof (log_msg), format_str, vtbl_ptr, *data_set_ptr);
 232   log_error_message (log_msg, false);
 233   log_error_message ("  Backtrace: \n", true);
 234
 235   const char *fail_msg = "Potential vtable pointer corruption detected!!\n";
 236   vtv_fail (fail_msg, data_set_ptr, vtbl_ptr);
 237 }
 238