Commit the vtable verification feature.

Commit the vtable verification feature.  This feature is designed to
detect, at run time, if/when the vtable pointer in a C++ object has
been corrupted, before allowing virtual calls through that pointer. 
If pointer corruption is detected, execution of the program is halted.

libstdc++-v3 ChangeLog:
2013-08-06  Caroline Tice  <cmtice@google.com>

        * fragment.am: Add XTEMPLATE_FLAGS.
        * configure.ac: Add definitions for --enable-vtable-verify.
        * acinclude.m4:  Add --enable-vtable-verify and
        --disable-vtable-verify; define --enable-vtable-verify; define
        VTV_CXXFLAGS, VTV_PCH_CXXFLAGS and VTV_CXXLINKFLAGS.
        * config/abi/pre/gnu.ver: Export symbols for vtable verification.
        * libsupc++/Makefile.am: Define vtv_sources and add it to
        libsupc___la_SOURCES and libsupc__convenience_la_SOURCES.
        * libsupc++/vtv_stubs.cc: New file.
        * include/Makefile.am: Add VTV_PCH_CXXFLAGS to PCHFLAGS.
        * src/Makefile.am: Add VTV_CXXFLAGS to AM_CXXFLAGS; add
        VTV_CXXLINKFLAGS to CXXLINK.
        * src/c++98/Makefile.am: Comment out XTEMPLATE_FLAGS; add VTV_CXXFLAGS
        to AM_CXXFLAGS; add VTV_CXXXLINKFLAGS to CXXLINK.
        * src/C++11/Makefile.am: Ditto.
        * doc/xml/manual/configure.xml: Add entry for --enable-vtable-verify.
        * scripts/testsuite_flags.in: Add cxxvtvflags to Usage; cause
        cxxvtvflags to use VTV_CXXFLAGS and VTV_CXXLINKFLAGS.
        * testsuite/lib/libstdc++.exp: Add cxxvtvflags; add code to locate
        libvtv if --enable-vtable-verify was used; set cxxvtvflags; add
        cxxvtvflags to cxx_final.
        * testsuite/18_support/bad_exception/23591_thread-1.c: Add
        -fvtable-verify=none to compiler flags.
        * testsuite/17_intro/freestanding.cc: Add -fvtable-verify=none
        to compiler flags.
        * configure: Regenerated.
        * Makefile.in: Regenerated.
        * python/Makefile.in: Regenerated.
        * include/Makefile.in: Regenerated.
        * libsupc++/Makefile.in: Regenerated.
        * config.h.in: Regenerated.
        * po/Makefile.in: Regenerated.
        * src/Makefile.in: Regenerated.
        * src/c++98/Makefile.in: Regenerated.
        * src/c++11/Makefile.in: Regenerated.
        * doc/Makefile.in: Regenerated.
        * testsuite/Makefile.in: Regenerated.

top level ChangeLog:
2013-08-06  Caroline Tice  <cmtice@google.com>

        * configure.ac: Add target-libvtv to target_libraries; disable libvtv
        on non-linux systems; add target-libvtv to noconfigdirs; add
        libsupc++/.libs to C++ library search paths.
        * configure: Regenerated.
        * Makefile.def: Add libvtv to target_modules; make libvtv depend on
        libstdc++ and libgcc.
        * Makefile.in: Regenerated.

include/ChangeLog:
2013-08-06  Caroline Tice  <cmtice@google.com>

        * vtv-change-permission.h: New file.

contrib/ChangeLog:
2013-08-06  Caroline Tice4  <cmtice@google.com>

        * gcc_update: Add libvtv files.

libgcc/ChangeLog:
2013-08-06  Caroline Tice  <cmtice@google.com>

        config.host (extra_parts): Add vtv_start.o, vtv_end.o
        vtv_start_preinit.o and vtv_end_preinit.o.
        configure.ac: Add code to check/set enable_vtable_verify.
        Makefile.in: Add rules to build vtv_*.o, if enable_vtable_verify is
        true.
        vtv_start_preinit.c: New file.
        vtv_end_preinit.c: New file.
        vtv_start.c: New file.
        vtv_end.c: New file.
        configure: Regenerated.

gcc/ChangeLog:
2013-08-06  Caroline Tice  <cmtice@google.com>

        * gcc.c (VTABLE_VERIFICATION_SPEC): New definition.
        (LINK_COMMAND_SPEC): Add VTABLE_VERIFICATION_SPEC.
        * tree-pass.h: Add pass_vtable_verify.
        * varasm.c (assemble_variable): Add code to properly set the comdat
        section and name for the .vtable_map_vars section.
        (assemble_vtyv_preinit_initializer): New function.
        (default_sectin_type_flags):  Make sure .vtable_map_vars section has
        LINK_ONCE flag.
        * output.h: Add function decl for assemble_vtv_preinit_initializer.
        * vtable-verify.c: New file.
        * vtable-verify.h: New file.
        * flag-types.h (enum vtv_priority): Defintions for flag_vtable_verify
        initialiation levels.
        * timevar.def (TV_VTABLE_VERIFICATION): New definition.
        * passes.def: Insert pass_vtable_verify.
        * aclocal.m4: Reorder includes.
        * doc/invoke.texi: Add documentation for the flags -fvtable-verify=,
	-fvtv-debug and -fvtv-counts.
        * config/gnu-user.h (GNU_USER_TARGET_STARTFILE_SPEC): Add vtv_start*.o,
as appropriate, if -fvtable-verify=... is used.
        (GNU_USER_TARGET_ENDFILE_SPEC): Add vtv_end*.o as appropriate, if
        -fvtable-verify=... is used.
        * Makefile.in (OBJS):  Add vtable-verify.o to list.
        (vtable-verify.o): Add new build rule.
        (GTFILES): Add vtable-verify.c to list.
        * common.opt (fvtable-verify=): New flag.
        (vtv_priority): Values for fvtable-verify= flag.
        (fvtv-counts): New flag.
(fvtv-debug): New flag.
        * tree.h (save_vtable_map_decl): New extern function decl.


gcc/cp/ChangeLog:
2013-08-06  Caroline Tice  <cmtice@google.com>

        * Make-lang.in (*CXX_AND_OBJCXX_OBJS):  Add vtable-class-hierarchy.o to
        list.
        (vtable-class-hierarchy.o): Add build rule.
        * cp-tree.h (vtv_start_verification_constructor_init_function): New
        extern function decl.
        (vtv_finish_verification_constructor_init_function): New extern
        function decl.
        (build_vtbl_address): New extern function decl.
        (get_mangled_vtable_map_var_name): New extern function decl.
        (vtv_compute_class_hierarchy_transitive_closure): New extern function
        decl.
        (vtv_generate_init_routine): New extern function decl.
        (vtv_save_class_info): New extern function decl.
        (vtv_recover_class_info): New extern function decl.
        (vtv_build_vtable_verify_fndecl): New extern function decl.
        * class.c (finish_struct_1): Add call to vtv_save_class_info if
        flag_vtable_verify is true.
        * config-lang.in: Add vtable-class-hierarchy.c to gtfiles list.
        * vtable-class-hierarchy.c: New file.
        * mangle.c (get_mangled_vtable_map_var_name):  New function.
        * decl2.c (start_objects): Update function comment.
        (cp_write_global_declarations): Call vtv_recover_class_info,
        vtv_compute_class_hierarchy_transitive_closure and
        vtv_build_vtable_verify_fndecl, before calling
        finalize_compilation_unit, and call vtv_generate_init_rount after, IFF
        flag_vtable_verify is true.
        (vtv_start_verification_constructor_init_function): New function.
        (vtv_finish_verification_constructor_init_function): New function.
        * init.c (build_vtbl_address): Remove static qualifier from function.

libvtv/ChangeLog:
2013-08-06  Caroline Tice  <cmtice@google.com>

        Initial check-in of new vtable verification feature.
        * configure.ac : New file.
        * acinclude.m4 : New file.
        * Makefile.am : New file.
        * aclocal.m4 : New file.
        * configure.tgt : New file.
        * configure: New file (generated).
        * Makefile.in: New file (generated).
        * vtv_set.h : New file.
        * vtv_utils.cc : New file.
        * vtv_utils.h : New file.
        * vtv_malloc.cc : New file.
        * vtv_rts.cc : New file.
        * vtv_malloc.h : New file.
        * vtv_rts.h : New file.
        * vtv_fail.cc : New file.
        * vtv_fail.h : New file.
        * vtv_map.h : New file.
        * scripts/run-testsuite.sh : New file.
        * scripts/sum-vtv-counts.c : New file.
        * testsuite/parts-test-main.h : New file.
        * testusite/dataentry.cc : New file.
        * testsuite/temp_deriv.cc : New file.
        * testsuite/register_pair.cc : New file.
        * testsuite/virtual_inheritance.cc : New file.
        * testsuite/field-test.cc : New file.
        * testsuite/nested_vcall_test.cc : New file.
        * testsuite/template-list-iostream.cc : New file.
        * testsuite/register_pair_inserts.cc : New file.
        * testsuite/register_pair_inserts_mt.cc : New file.
        * testsuite/event.list : New file.
        * testsuite/parts-test-extra-parts-views.cc : New file.
        * testsuite/parts-test-extra-parts-views.h : New file.
        * testsuite/environment-fail-32.s : New file.
        * testsuite/parts-test-extra-parts.h : New file.
        * testsuite/temp_deriv2.cc : New file.
        * testsuite/dlopen_mt.cc : New file.
        * testsuite/event.h : New file.
        * testsuite/template-list.cc : New file.
        * testsuite/replace-fail.cc : New file.
        * testsuite/Makefile.am : New file.
        * testsuite/Makefile.in: New file (generated).
        * testsuite/mempool_negative.c : New file.
        * testsuite/parts-test-main.cc : New file.
        * testsuite/event-private.cc : New file.
        * testsuite/thunk.cc : New file.
        * testsuite/event-defintiions.cc : New file.
        * testsuite/event-private.h : New file.
        * testsuite/parts-test.list : New file.
        * testusite/register_pair_mt.cc : New file.
        * testsuite/povray-derived.cc : New file.
        * testsuite/event-main.cc : New file.
        * testsuite/environment.cc : New file.
        * testsuite/template-list2.cc : New file.
        * testsuite/thunk_vtable_map_attack.cc : New file.
        * testsuite/parts-test-extra-parts.cc : New file.
        * testsuite/environment-fail-64.s : New file.
        * testsuite/dlopen.cc : New file.
        * testsuite/so.cc : New file.
        * testsuite/temp_deriv3.cc : New file.
        * testsuite/const_vtable.cc : New file.
        * testsuite/mempool_positive.c : New file.
        * testsuite/dup_name.cc : New file.

From-SVN: r201555

1 files changed, 233 insertions, 0 deletions

diff --git a/libvtv/vtv_fail.cc b/libvtv/vtv_fail.cc
new file mode 100644
index 0000000..4f183d8
--- /dev/null
+++ b/libvtv/vtv_fail.cc
@@ -0,0 +1,233 @@
+/* Copyright (C) 2012-2013
+ Free Software Foundation
+
+ This file is part of GCC.
+
+ GCC is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3, or (at your option)
+ any later version.
+
+ GCC is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU General Public License for more details.
+
+ Under Section 7 of GPL version 3, you are granted additional
+ permissions described in the GCC Runtime Library Exception, version
+ 3.1, as published by the Free Software Foundation.
+
+ You should have received a copy of the GNU General Public License and
+ a copy of the GCC Runtime Library Exception along with this program;
+ see the files COPYING3 and COPYING.RUNTIME respectively.  If not, see
+ <http://www.gnu.org/licenses/>.  */
+
+/* This file is part of the vtable security feature implementation.
+   The vtable security feature is designed to detect when a virtual
+   call is about to be made through an invalid vtable pointer
+   (possibly due to data corruption or malicious attacks).
+
+   This file also contains the failure functions that get called when
+   a vtable pointer is not found in the data set.  Two particularly
+   important functions are __vtv_verify_fail and __vtv_really_fail.
+   They are both externally visible.  __vtv_verify_fail is defined in
+   such a way that it can be replaced by a programmer, if desired.  It
+   is the function that __VLTVerifyVtablePointer calls if it can't
+   find the pointer in the data set.  Allowing the programmer to
+   overwrite this function means that he/she can do some alternate
+   verification, including NOT failing in certain specific cases, if
+   desired.  This may be the case if the programmer has to deal wtih
+   unverified third party software, for example.  __vtv_really_fail is
+   available for the programmer to call from his version of
+   __vtv_verify_fail, if he decides the failure is real.
+
+*/
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <execinfo.h>
+#include <unistd.h>
+
+#include "vtv_utils.h"
+#include "vtv_fail.h"
+
+/* This is used to disable aborts for debugging purposes.  */
+bool vtv_no_abort = false;
+
+
+extern "C" {
+
+  /* __fortify_fail is a function in glibc that calls __libc_message,
+     causing it to print out a program termination error message
+     (including the name of the binary being terminated), a stack
+     trace where the error occurred, and a memory map dump.  Ideally
+     we would have called __libc_message directly, but that function
+     does not appear to be accessible to functions outside glibc,
+     whereas __fortify_fail is.  We call __fortify_fail from
+     __vtv_really_fail.  We looked at calling __libc_fatal, which is
+     externally accessible, but it does not do the back trace and
+     memory dump.  */
+
+  extern void __fortify_fail (const char *) __attribute__((noreturn));
+
+} /* extern "C" */
+
+const unsigned long SET_HANDLE_HANDLE_BIT = 0x2;
+
+/* Instantiate the template classes (in vtv_set.h) for our particular
+   hash table needs.  */
+typedef void * vtv_set_handle;
+typedef vtv_set_handle * vtv_set_handle_handle; 
+
+static int vtv_failures_log_fd = -1;
+
+/* Open error logging file, if not already open, and write vtable
+   verification failure messages (LOG_MSG) to the log file.  Also
+   generate a backtrace in the log file, if GENERATE_BACKTRACE is
+   set.  */
+
+static void
+log_error_message (const char *log_msg, bool generate_backtrace)
+{
+  if (vtv_failures_log_fd == -1)
+    vtv_failures_log_fd = vtv_open_log ("vtable_verification_failures.log");
+
+  if (vtv_failures_log_fd == -1)
+    return;
+
+  vtv_add_to_log (vtv_failures_log_fd, "%s", log_msg);
+
+  if (generate_backtrace)
+    {
+#define STACK_DEPTH 20
+      void *callers[STACK_DEPTH];
+      int actual_depth = backtrace (callers, STACK_DEPTH);
+      backtrace_symbols_fd (callers, actual_depth, vtv_failures_log_fd);
+    }
+}
+
+/* In the case where a vtable map variable is the only instance of the
+   variable we have seen, it points directly to the set of valid
+   vtable pointers.  All subsequent instances of the 'same' vtable map
+   variable point to the first vtable map variable.  This function,
+   given a vtable map variable PTR, checks a bit to see whether it's
+   pointing directly to the data set or to the first vtable map
+   variable.  */
+
+static inline bool
+is_set_handle_handle (void * ptr)
+{
+  return ((unsigned long) ptr & SET_HANDLE_HANDLE_BIT)
+                                                      == SET_HANDLE_HANDLE_BIT;
+}
+
+/* Returns the actual pointer value of a vtable map variable, PTR (see
+   comments for is_set_handle_handle for more details).  */
+
+static inline vtv_set_handle * 
+ptr_from_set_handle_handle (void * ptr)
+{
+  return (vtv_set_handle *) ((unsigned long) ptr & ~SET_HANDLE_HANDLE_BIT);
+}
+
+/* Given a vtable map variable, PTR, this function sets the bit that
+   says this is the second (or later) instance of a vtable map
+   variable.  */
+
+static inline vtv_set_handle_handle
+set_handle_handle (vtv_set_handle * ptr)
+{
+  return (vtv_set_handle_handle) ((unsigned long) ptr | SET_HANDLE_HANDLE_BIT);
+}
+
+/* This function is called from __VLTVerifyVtablePointerDebug; it
+   sends as much debugging information as it can to the error log
+   file, then calls __vtv_verify_fail.  SET_HANDLE_PTR is the pointer
+   to the set of valid vtable pointers, VTBL_PTR is the pointer that
+   was not found in the set, and DEBUG_MSG is the message to be
+   written to the log file before failing. n */
+
+void
+__vtv_verify_fail_debug (void **set_handle_ptr, const void *vtbl_ptr, 
+                         const char *debug_msg)
+{
+  log_error_message (debug_msg, false);
+
+  /* Call the public interface in case it has been overwritten by
+     user.  */
+  __vtv_verify_fail (set_handle_ptr, vtbl_ptr);
+
+  log_error_message ("Returned from __vtv_verify_fail."
+                     " Secondary verification succeeded.\n", false);
+}
+
+/* This function calls __fortify_fail with a FAILURE_MSG and then
+   calls abort.  */
+
+void
+__vtv_really_fail (const char *failure_msg)
+{
+  __fortify_fail (failure_msg);
+
+  /* We should never get this far; __fortify_fail calls __libc_message
+     which prints out a back trace and a memory dump and then is
+     supposed to call abort, but let's play it safe anyway and call abort
+     ourselves.  */
+  abort ();
+}
+
+/* This function takes an error MSG, a vtable map variable
+   (DATA_SET_PTR) and a vtable pointer (VTBL_PTR).  It is called when
+   an attempt to verify VTBL_PTR with the set pointed to by
+   DATA_SET_PTR failed.  It outputs a failure message with the
+   addresses involved, and calls __vtv_really_fail.  */
+
+static void
+vtv_fail (const char *msg, void **data_set_ptr, const void *vtbl_ptr)
+{
+  char buffer[128];
+  int buf_len;
+  const char *format_str =
+                 "*** Unable to verify vtable pointer (%p) in set (%p) *** \n";
+
+  snprintf (buffer, sizeof (buffer), format_str, vtbl_ptr,
+            is_set_handle_handle(*data_set_ptr) ?
+              ptr_from_set_handle_handle (*data_set_ptr) :
+	      *data_set_ptr);
+  buf_len = strlen (buffer);
+  /*  Send this to to stderr.  */
+  write (2, buffer, buf_len);
+
+  if (!vtv_no_abort)
+    __vtv_really_fail (msg);
+}
+
+/* Send information about what we were trying to do when verification
+   failed to the error log, then call vtv_fail.  This function can be
+   overwritten/replaced by the user, to implement a secondary
+   verification function instead.  DATA_SET_PTR is the vtable map
+   variable used for the failed verification, and VTBL_PTR is the
+   vtable pointer that was not found in the set.  */
+
+void
+__vtv_verify_fail (void **data_set_ptr, const void *vtbl_ptr)
+{
+  char log_msg[256];
+  snprintf (log_msg, sizeof (log_msg), "Looking for vtable %p in set %p.\n",
+            vtbl_ptr,
+            is_set_handle_handle (*data_set_ptr) ?
+              ptr_from_set_handle_handle (*data_set_ptr) :
+              *data_set_ptr);
+  log_error_message (log_msg, false);
+
+  const char *format_str =
+            "*** Unable to verify vtable pointer (%p) in set (%p) *** \n";
+  snprintf (log_msg, sizeof (log_msg), format_str, vtbl_ptr, *data_set_ptr);
+  log_error_message (log_msg, false);
+  log_error_message ("  Backtrace: \n", true);
+
+  const char *fail_msg = "Potential vtable pointer corruption detected!!\n";
+  vtv_fail (fail_msg, data_set_ptr, vtbl_ptr);
+}
+