1b8ab2f089
Virtual function pointer entries in v-tables are signed with address
discrimination in addition to declaration-based discrimination, where an
integer discriminator the string hash (see
`ptrauth_string_discriminator`) of the mangled name of the overridden
method. This notably provides diversity based on the full signature of
the overridden method, including the method name and parameter types.
This patch introduces ItaniumVTableContext logic to find the original
declaration of the overridden method.
On AArch64, these pointers are signed using the `IA` key (the
process-independent code key.)
V-table pointers can be signed with either no discrimination, or a
similar scheme using address and decl-based discrimination. In this
case, the integer discriminator is the string hash of the mangled
v-table identifier of the class that originally introduced the vtable
pointer.
On AArch64, these pointers are signed using the `DA` key (the
process-independent data key.)
Not using discrimination allows attackers to simply copy valid v-table
pointers from one object to another. However, using a uniform
discriminator of 0 does have positive performance and code-size
implications on AArch64, and diversity for the most important v-table
access pattern (virtual dispatch) is already better assured by the
signing schemas used on the virtual functions. It is also known that
some code in practice copies objects containing v-tables with `memcpy`,
and while this is not permitted formally, it is something that may be
invasive to eliminate.
This is controlled by:
```
-fptrauth-vtable-pointer-type-discrimination
-fptrauth-vtable-pointer-address-discrimination
```
In addition, this provides fine-grained controls in the
ptrauth_vtable_pointer attribute, which allows overriding the default
ptrauth schema for vtable pointers on a given class hierarchy, e.g.:
```
[[clang::ptrauth_vtable_pointer(no_authentication, no_address_discrimination,
no_extra_discrimination)]]
[[clang::ptrauth_vtable_pointer(default_key, default_address_discrimination,
custom_discrimination, 0xf00d)]]
```
The override is then mangled as a parametrized vendor extension:
```
"__vtptrauth" I
<key>
<addressDiscriminated>
<extraDiscriminator>
E
```
To support this attribute, this patch adds a small extension to the
attribute-emitter tablegen backend.
Note that there are known areas where signing is either missing
altogether or can be strengthened. Some will be addressed in later
changes (e.g., member function pointers, some RTTI).
`dynamic_cast` in particular is handled by emitting an artificial
v-table pointer load (in a way that always authenticates it) before the
runtime call itself, as the runtime doesn't have enough information
today to properly authenticate it. Instead, the runtime is currently
expected to strip the v-table pointer.
---------
Co-authored-by: John McCall <rjmccall@apple.com>
Co-authored-by: Ahmed Bougacha <ahmed@bougacha.org>
43 lines
1.7 KiB
C++
43 lines
1.7 KiB
C++
// RUN: %clang_cc1 -triple arm64-apple-ios -fptrauth-calls -fapple-kext -emit-llvm -o - %s | FileCheck %s
|
|
|
|
// CHECK: @_ZTV5TemplIiE = internal unnamed_addr constant { [5 x ptr] } { [5 x ptr] [ptr null, ptr @_ZTI5TemplIiE, ptr ptrauth (ptr @_ZN5TemplIiE1fEv, i32 0, i64 22189, ptr getelementptr inbounds ({ [5 x ptr] }, ptr @_ZTV5TemplIiE, i32 0, i32 0, i32 2)), ptr ptrauth (ptr @_ZN5TemplIiE1gEv, i32 0, i64 9912, ptr getelementptr inbounds ({ [5 x ptr] }, ptr @_ZTV5TemplIiE, i32 0, i32 0, i32 3)), ptr null] }, align 8
|
|
|
|
struct Base {
|
|
virtual void abc(void) const;
|
|
};
|
|
|
|
void Base::abc(void) const {}
|
|
|
|
void FUNC(Base* p) {
|
|
p->Base::abc();
|
|
}
|
|
|
|
// CHECK: getelementptr inbounds (ptr, ptr @_ZTV4Base, i64 2)
|
|
// CHECK-NOT: call void @_ZNK4Base3abcEv
|
|
|
|
template<class T>
|
|
struct Templ {
|
|
virtual void f() {}
|
|
virtual void g() {}
|
|
};
|
|
template<class T>
|
|
struct SubTempl : public Templ<T> {
|
|
virtual void f() {} // override
|
|
virtual void g() {} // override
|
|
};
|
|
|
|
void f(SubTempl<int>* t) {
|
|
// Qualified calls go through the (qualified) vtable in apple-kext mode.
|
|
// Since t's this pointer points to SubTempl's vtable, the call needs
|
|
// to load Templ<int>'s vtable. Hence, Templ<int>::g needs to be
|
|
// instantiated in this TU, for it's referenced by the vtable.
|
|
// (This happens only in apple-kext mode; elsewhere virtual calls can always
|
|
// use the vtable pointer off this instead of having to load the vtable
|
|
// symbol.)
|
|
t->Templ::f();
|
|
}
|
|
|
|
// CHECK: getelementptr inbounds (ptr, ptr @_ZTV5TemplIiE, i64 2)
|
|
// CHECK: define internal void @_ZN5TemplIiE1fEv(ptr noundef nonnull align {{[0-9]+}} dereferenceable(8) %this)
|
|
// CHECK: define internal void @_ZN5TemplIiE1gEv(ptr noundef nonnull align {{[0-9]+}} dereferenceable(8) %this)
|