authorgravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2022-08-19 06:41:34-04:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2022-08-19 06:41:34-04:00
logbe2bd5848a880765f4bc7e2363ef201a0930a04b
tree868694d734e82cb93b52b6c0c155d932f5f65f8f
parent2ccaa5414b904edb2f4af293291f5401d106f277
parentfdb934a157230ae6d3f11dee8d0d62013d5b919e
signaturebadge-question-mark Signed by PGP key 4AEE18F83AFDEB23

Merge pull request #12472 from ziglang/stage2-stack-protector

stage2: implement stack protectors

15 files changed, 193 insertions(+), 61 deletions(-)

src/Compilation.zig+76-45
......@@ -173,6 +173,7 @@ astgen_wait_group: WaitGroup = .{},
173173/// TODO: Remove this when Stage2 becomes the default compiler as it will already have this information.
174174export_symbol_names: std.ArrayListUnmanaged([]const u8) = .{},
175175
176pub const default_stack_protector_buffer_size = 4;
176177pub const SemaError = Module.SemaError;
177178
178179pub const CRTFile = struct {
......@@ -837,6 +838,10 @@ pub const InitOptions = struct {
837838 want_pie: ?bool = null,
838839 want_sanitize_c: ?bool = null,
839840 want_stack_check: ?bool = null,
841 /// null means default.
842 /// 0 means no stack protector.
843 /// other number means stack protection with that buffer size.
844 want_stack_protector: ?u32 = null,
840845 want_red_zone: ?bool = null,
841846 omit_frame_pointer: ?bool = null,
842847 want_valgrind: ?bool = null,
......@@ -1014,6 +1019,15 @@ pub fn create(gpa: Allocator, options: InitOptions) !*Compilation {
10141019 return error.ExportTableAndImportTableConflict;
10151020 }
10161021
1022 // The `have_llvm` condition is here only because native backends cannot yet build compiler-rt.
1023 // Once they are capable this condition could be removed. When removing this condition,
1024 // also test the use case of `build-obj -fcompiler-rt` with the native backends
1025 // and make sure the compiler-rt symbols are emitted.
1026 const capable_of_building_compiler_rt = build_options.have_llvm;
1027
1028 const capable_of_building_zig_libc = build_options.have_llvm;
1029 const capable_of_building_ssp = build_options.have_llvm;
1030
10171031 const comp: *Compilation = comp: {
10181032 // For allocations that have the same lifetime as Compilation. This arena is used only during this
10191033 // initialization and then is freed in deinit().
......@@ -1289,11 +1303,36 @@ pub fn create(gpa: Allocator, options: InitOptions) !*Compilation {
12891303
12901304 const sanitize_c = options.want_sanitize_c orelse is_safe_mode;
12911305
1292 const stack_check: bool = b: {
1293 if (!target_util.supportsStackProbing(options.target))
1294 break :b false;
1295 break :b options.want_stack_check orelse is_safe_mode;
1306 const stack_check: bool = options.want_stack_check orelse b: {
1307 if (!target_util.supportsStackProbing(options.target)) break :b false;
1308 break :b is_safe_mode;
12961309 };
1310 if (stack_check and !target_util.supportsStackProbing(options.target))
1311 return error.StackCheckUnsupportedByTarget;
1312
1313 const stack_protector: u32 = options.want_stack_protector orelse b: {
1314 if (!target_util.supportsStackProtector(options.target)) break :b @as(u32, 0);
1315
1316 // This logic is checking for linking libc because otherwise our start code
1317 // which is trying to set up TLS (i.e. the fs/gs registers) but the stack
1318 // protection code depends on fs/gs registers being already set up.
1319 // If we were able to annotate start code, or perhaps the entire std lib,
1320 // as being exempt from stack protection checks, we could change this logic
1321 // to supporting stack protection even when not linking libc.
1322 // TODO file issue about this
1323 if (!link_libc) break :b 0;
1324 if (!capable_of_building_ssp) break :b 0;
1325 if (is_safe_mode) break :b default_stack_protector_buffer_size;
1326 break :b 0;
1327 };
1328 if (stack_protector != 0) {
1329 if (!target_util.supportsStackProtector(options.target))
1330 return error.StackProtectorUnsupportedByTarget;
1331 if (!capable_of_building_ssp)
1332 return error.StackProtectorUnsupportedByBackend;
1333 if (!link_libc)
1334 return error.StackProtectorUnavailableWithoutLibC;
1335 }
12971336
12981337 const valgrind: bool = b: {
12991338 if (!target_util.hasValgrindSupport(options.target))
......@@ -1378,6 +1417,7 @@ pub fn create(gpa: Allocator, options: InitOptions) !*Compilation {
13781417 cache.hash.add(unwind_tables);
13791418 cache.hash.add(tsan);
13801419 cache.hash.add(stack_check);
1420 cache.hash.add(stack_protector);
13811421 cache.hash.add(red_zone);
13821422 cache.hash.add(omit_frame_pointer);
13831423 cache.hash.add(link_mode);
......@@ -1741,6 +1781,7 @@ pub fn create(gpa: Allocator, options: InitOptions) !*Compilation {
17411781 .valgrind = valgrind,
17421782 .tsan = tsan,
17431783 .stack_check = stack_check,
1784 .stack_protector = stack_protector,
17441785 .red_zone = red_zone,
17451786 .omit_frame_pointer = omit_frame_pointer,
17461787 .single_threaded = single_threaded,
......@@ -1822,6 +1863,8 @@ pub fn create(gpa: Allocator, options: InitOptions) !*Compilation {
18221863 };
18231864 errdefer comp.destroy();
18241865
1866 const target = comp.getTarget();
1867
18251868 // Add a `CObject` for each `c_source_files`.
18261869 try comp.c_object_table.ensureTotalCapacity(gpa, options.c_source_files.len);
18271870 for (options.c_source_files) |c_source_file| {
......@@ -1837,11 +1880,9 @@ pub fn create(gpa: Allocator, options: InitOptions) !*Compilation {
18371880
18381881 const have_bin_emit = comp.bin_file.options.emit != null or comp.whole_bin_sub_path != null;
18391882
1840 if (have_bin_emit and !comp.bin_file.options.skip_linker_dependencies and
1841 options.target.ofmt != .c)
1842 {
1843 if (comp.getTarget().isDarwin()) {
1844 switch (comp.getTarget().abi) {
1883 if (have_bin_emit and !comp.bin_file.options.skip_linker_dependencies and target.ofmt != .c) {
1884 if (target.isDarwin()) {
1885 switch (target.abi) {
18451886 .none,
18461887 .simulator,
18471888 .macabi,
......@@ -1852,9 +1893,9 @@ pub fn create(gpa: Allocator, options: InitOptions) !*Compilation {
18521893 // If we need to build glibc for the target, add work items for it.
18531894 // We go through the work queue so that building can be done in parallel.
18541895 if (comp.wantBuildGLibCFromSource()) {
1855 if (!target_util.canBuildLibC(comp.getTarget())) return error.LibCUnavailable;
1896 if (!target_util.canBuildLibC(target)) return error.LibCUnavailable;
18561897
1857 if (glibc.needsCrtiCrtn(comp.getTarget())) {
1898 if (glibc.needsCrtiCrtn(target)) {
18581899 try comp.work_queue.write(&[_]Job{
18591900 .{ .glibc_crt_file = .crti_o },
18601901 .{ .glibc_crt_file = .crtn_o },
......@@ -1867,10 +1908,10 @@ pub fn create(gpa: Allocator, options: InitOptions) !*Compilation {
18671908 });
18681909 }
18691910 if (comp.wantBuildMuslFromSource()) {
1870 if (!target_util.canBuildLibC(comp.getTarget())) return error.LibCUnavailable;
1911 if (!target_util.canBuildLibC(target)) return error.LibCUnavailable;
18711912
18721913 try comp.work_queue.ensureUnusedCapacity(6);
1873 if (musl.needsCrtiCrtn(comp.getTarget())) {
1914 if (musl.needsCrtiCrtn(target)) {
18741915 comp.work_queue.writeAssumeCapacity(&[_]Job{
18751916 .{ .musl_crt_file = .crti_o },
18761917 .{ .musl_crt_file = .crtn_o },
......@@ -1887,7 +1928,7 @@ pub fn create(gpa: Allocator, options: InitOptions) !*Compilation {
18871928 });
18881929 }
18891930 if (comp.wantBuildWasiLibcFromSource()) {
1890 if (!target_util.canBuildLibC(comp.getTarget())) return error.LibCUnavailable;
1931 if (!target_util.canBuildLibC(target)) return error.LibCUnavailable;
18911932
18921933 const wasi_emulated_libs = comp.bin_file.options.wasi_emulated_libs;
18931934 try comp.work_queue.ensureUnusedCapacity(wasi_emulated_libs.len + 2); // worst-case we need all components
......@@ -1902,7 +1943,7 @@ pub fn create(gpa: Allocator, options: InitOptions) !*Compilation {
19021943 });
19031944 }
19041945 if (comp.wantBuildMinGWFromSource()) {
1905 if (!target_util.canBuildLibC(comp.getTarget())) return error.LibCUnavailable;
1946 if (!target_util.canBuildLibC(target)) return error.LibCUnavailable;
19061947
19071948 const static_lib_jobs = [_]Job{
19081949 .{ .mingw_crt_file = .mingw32_lib },
......@@ -1921,7 +1962,7 @@ pub fn create(gpa: Allocator, options: InitOptions) !*Compilation {
19211962 }
19221963 }
19231964 // Generate Windows import libs.
1924 if (comp.getTarget().os.tag == .windows) {
1965 if (target.os.tag == .windows) {
19251966 const count = comp.bin_file.options.system_libs.count();
19261967 try comp.work_queue.ensureUnusedCapacity(count);
19271968 var i: usize = 0;
......@@ -1940,15 +1981,6 @@ pub fn create(gpa: Allocator, options: InitOptions) !*Compilation {
19401981 try comp.work_queue.writeItem(.libtsan);
19411982 }
19421983
1943 // The `have_llvm` condition is here only because native backends cannot yet build compiler-rt.
1944 // Once they are capable this condition could be removed. When removing this condition,
1945 // also test the use case of `build-obj -fcompiler-rt` with the native backends
1946 // and make sure the compiler-rt symbols are emitted.
1947 const capable_of_building_compiler_rt = build_options.have_llvm;
1948
1949 const capable_of_building_zig_libc = build_options.have_llvm;
1950 const capable_of_building_ssp = comp.bin_file.options.use_stage1;
1951
19521984 if (comp.bin_file.options.include_compiler_rt and capable_of_building_compiler_rt) {
19531985 if (is_exe_or_dyn_lib) {
19541986 log.debug("queuing a job to build compiler_rt_lib", .{});
......@@ -1962,8 +1994,11 @@ pub fn create(gpa: Allocator, options: InitOptions) !*Compilation {
19621994 }
19631995 }
19641996 if (needs_c_symbols) {
1965 // MinGW provides no libssp, use our own implementation.
1966 if (comp.getTarget().isMinGW() and capable_of_building_ssp) {
1997 // Related: https://github.com/ziglang/zig/issues/7265.
1998 if (comp.bin_file.options.stack_protector != 0 and
1999 (!comp.bin_file.options.link_libc or
2000 !target_util.libcProvidesStackProtector(target)))
2001 {
19672002 try comp.work_queue.writeItem(.{ .libssp = {} });
19682003 }
19692004
......@@ -4123,6 +4158,17 @@ pub fn addCCArgs(
41234158 try argv.append("-fno-omit-frame-pointer");
41244159 }
41254160
4161 const ssp_buf_size = comp.bin_file.options.stack_protector;
4162 if (ssp_buf_size != 0) {
4163 try argv.appendSlice(&[_][]const u8{
4164 "-fstack-protector-strong",
4165 "--param",
4166 try std.fmt.allocPrint(arena, "ssp-buffer-size={d}", .{ssp_buf_size}),
4167 });
4168 } else {
4169 try argv.append("-fno-stack-protector");
4170 }
4171
41264172 switch (comp.bin_file.options.optimize_mode) {
41274173 .Debug => {
41284174 // windows c runtime requires -D_DEBUG if using debug libraries
......@@ -4131,27 +4177,12 @@ pub fn addCCArgs(
41314177 // to -O1. Besides potentially impairing debugging, -O1/-Og significantly
41324178 // increases compile times.
41334179 try argv.append("-O0");
4134
4135 if (comp.bin_file.options.link_libc and target.os.tag != .wasi) {
4136 try argv.append("-fstack-protector-strong");
4137 try argv.append("--param");
4138 try argv.append("ssp-buffer-size=4");
4139 } else {
4140 try argv.append("-fno-stack-protector");
4141 }
41424180 },
41434181 .ReleaseSafe => {
41444182 // See the comment in the BuildModeFastRelease case for why we pass -O2 rather
41454183 // than -O3 here.
41464184 try argv.append("-O2");
4147 if (comp.bin_file.options.link_libc and target.os.tag != .wasi) {
4148 try argv.append("-D_FORTIFY_SOURCE=2");
4149 try argv.append("-fstack-protector-strong");
4150 try argv.append("--param");
4151 try argv.append("ssp-buffer-size=4");
4152 } else {
4153 try argv.append("-fno-stack-protector");
4154 }
4185 try argv.append("-D_FORTIFY_SOURCE=2");
41554186 },
41564187 .ReleaseFast => {
41574188 try argv.append("-DNDEBUG");
......@@ -4161,12 +4192,10 @@ pub fn addCCArgs(
41614192 // Zig code than it is for C code. Also, C programmers are used to their code
41624193 // running in -O2 and thus the -O3 path has been tested less.
41634194 try argv.append("-O2");
4164 try argv.append("-fno-stack-protector");
41654195 },
41664196 .ReleaseSmall => {
41674197 try argv.append("-DNDEBUG");
41684198 try argv.append("-Os");
4169 try argv.append("-fno-stack-protector");
41704199 },
41714200 }
41724201
......@@ -5031,6 +5060,7 @@ fn buildOutputFromZig(
50315060 .use_stage1 = build_options.is_stage1 and comp.bin_file.options.use_stage1,
50325061 .want_sanitize_c = false,
50335062 .want_stack_check = false,
5063 .want_stack_protector = 0,
50345064 .want_red_zone = comp.bin_file.options.red_zone,
50355065 .omit_frame_pointer = comp.bin_file.options.omit_frame_pointer,
50365066 .want_valgrind = false,
......@@ -5311,6 +5341,7 @@ pub fn build_crt_file(
53115341 .optimize_mode = comp.compilerRtOptMode(),
53125342 .want_sanitize_c = false,
53135343 .want_stack_check = false,
5344 .want_stack_protector = 0,
53145345 .want_red_zone = comp.bin_file.options.red_zone,
53155346 .omit_frame_pointer = comp.bin_file.options.omit_frame_pointer,
53165347 .want_valgrind = false,
src/Sema.zig+8-7
......@@ -7567,10 +7567,11 @@ fn handleExternLibName(
75677567) CompileError![:0]u8 {
75687568 blk: {
75697569 const mod = sema.mod;
7570 const comp = mod.comp;
75707571 const target = mod.getTarget();
75717572 log.debug("extern fn symbol expected in lib '{s}'", .{lib_name});
75727573 if (target_util.is_libc_lib_name(target, lib_name)) {
7573 if (!mod.comp.bin_file.options.link_libc) {
7574 if (!comp.bin_file.options.link_libc and !comp.bin_file.options.parent_compilation_link_libc) {
75747575 return sema.fail(
75757576 block,
75767577 src_loc,
......@@ -7578,11 +7579,11 @@ fn handleExternLibName(
75787579 .{},
75797580 );
75807581 }
7581 mod.comp.bin_file.options.link_libc = true;
7582 comp.bin_file.options.link_libc = true;
75827583 break :blk;
75837584 }
75847585 if (target_util.is_libcpp_lib_name(target, lib_name)) {
7585 if (!mod.comp.bin_file.options.link_libcpp) {
7586 if (!comp.bin_file.options.link_libcpp) {
75867587 return sema.fail(
75877588 block,
75887589 src_loc,
......@@ -7590,14 +7591,14 @@ fn handleExternLibName(
75907591 .{},
75917592 );
75927593 }
7593 mod.comp.bin_file.options.link_libcpp = true;
7594 comp.bin_file.options.link_libcpp = true;
75947595 break :blk;
75957596 }
75967597 if (mem.eql(u8, lib_name, "unwind")) {
7597 mod.comp.bin_file.options.link_libunwind = true;
7598 comp.bin_file.options.link_libunwind = true;
75987599 break :blk;
75997600 }
7600 if (!target.isWasm() and !mod.comp.bin_file.options.pic) {
7601 if (!target.isWasm() and !comp.bin_file.options.pic) {
76017602 return sema.fail(
76027603 block,
76037604 src_loc,
......@@ -7605,7 +7606,7 @@ fn handleExternLibName(
76057606 .{ lib_name, lib_name },
76067607 );
76077608 }
7608 mod.comp.stage1AddLinkLib(lib_name) catch |err| {
7609 comp.stage1AddLinkLib(lib_name) catch |err| {
76097610 return sema.fail(block, src_loc, "unable to add link lib '{s}': {s}", .{
76107611 lib_name, @errorName(err),
76117612 });
src/clang_options_data.zig+40-5
......@@ -3290,7 +3290,14 @@ flagpd1("fno-stack-arrays"),
32903290 .psl = false,
32913291},
32923292flagpd1("fno-stack-clash-protection"),
3293flagpd1("fno-stack-protector"),
3293.{
3294 .name = "fno-stack-protector",
3295 .syntax = .flag,
3296 .zig_equivalent = .no_stack_protector,
3297 .pd1 = true,
3298 .pd2 = false,
3299 .psl = false,
3300},
32943301flagpd1("fno-stack-size-section"),
32953302flagpd1("fno-standalone-debug"),
32963303flagpd1("fno-strength-reduce"),
......@@ -3588,9 +3595,30 @@ flagpd1("fstack-arrays"),
35883595 .psl = false,
35893596},
35903597flagpd1("fstack-clash-protection"),
3591flagpd1("fstack-protector"),
3592flagpd1("fstack-protector-all"),
3593flagpd1("fstack-protector-strong"),
3598.{
3599 .name = "fstack-protector",
3600 .syntax = .flag,
3601 .zig_equivalent = .stack_protector,
3602 .pd1 = true,
3603 .pd2 = false,
3604 .psl = false,
3605},
3606.{
3607 .name = "fstack-protector-all",
3608 .syntax = .flag,
3609 .zig_equivalent = .stack_protector,
3610 .pd1 = true,
3611 .pd2 = false,
3612 .psl = false,
3613},
3614.{
3615 .name = "fstack-protector-strong",
3616 .syntax = .flag,
3617 .zig_equivalent = .stack_protector,
3618 .pd1 = true,
3619 .pd2 = false,
3620 .psl = false,
3621},
35943622flagpd1("fstack-size-section"),
35953623flagpd1("fstack-usage"),
35963624flagpd1("fstandalone-debug"),
......@@ -4809,7 +4837,14 @@ flagpd1("single_module"),
48094837},
48104838sepd1("split-dwarf-file"),
48114839sepd1("split-dwarf-output"),
4812sepd1("stack-protector"),
4840.{
4841 .name = "stack-protector",
4842 .syntax = .separate,
4843 .zig_equivalent = .stack_protector,
4844 .pd1 = true,
4845 .pd2 = false,
4846 .psl = false,
4847},
48134848sepd1("stack-protector-buffer-size"),
48144849sepd1("stack-usage-file"),
48154850.{
src/codegen/llvm.zig+8-3
......@@ -711,9 +711,14 @@ pub const Object = struct {
711711 DeclGen.removeFnAttr(llvm_func, "noinline");
712712 }
713713
714 // TODO: port these over from stage1
715 // addLLVMFnAttr(llvm_fn, "sspstrong");
716 // addLLVMFnAttrStr(llvm_fn, "stack-protector-buffer-size", "4");
714 // TODO: disable this if safety is off for the function scope
715 const ssp_buf_size = module.comp.bin_file.options.stack_protector;
716 if (ssp_buf_size != 0) {
717 var buf: [12]u8 = undefined;
718 const arg = std.fmt.bufPrintZ(&buf, "{d}", .{ssp_buf_size}) catch unreachable;
719 dg.addFnAttr(llvm_func, "sspstrong");
720 dg.addFnAttrString(llvm_func, "stack-protector-buffer-size", arg);
721 }
717722
718723 // TODO: disable this if safety is off for the function scope
719724 if (module.comp.bin_file.options.stack_check) {
src/glibc.zig+1
......@@ -1111,6 +1111,7 @@ fn buildSharedLib(
11111111 .optimize_mode = comp.compilerRtOptMode(),
11121112 .want_sanitize_c = false,
11131113 .want_stack_check = false,
1114 .want_stack_protector = 0,
11141115 .want_red_zone = comp.bin_file.options.red_zone,
11151116 .omit_frame_pointer = comp.bin_file.options.omit_frame_pointer,
11161117 .want_valgrind = false,
src/libcxx.zig+2
......@@ -206,6 +206,7 @@ pub fn buildLibCXX(comp: *Compilation) !void {
206206 .link_mode = link_mode,
207207 .want_sanitize_c = false,
208208 .want_stack_check = false,
209 .want_stack_protector = 0,
209210 .want_red_zone = comp.bin_file.options.red_zone,
210211 .omit_frame_pointer = comp.bin_file.options.omit_frame_pointer,
211212 .want_valgrind = false,
......@@ -349,6 +350,7 @@ pub fn buildLibCXXABI(comp: *Compilation) !void {
349350 .link_mode = link_mode,
350351 .want_sanitize_c = false,
351352 .want_stack_check = false,
353 .want_stack_protector = 0,
352354 .want_red_zone = comp.bin_file.options.red_zone,
353355 .omit_frame_pointer = comp.bin_file.options.omit_frame_pointer,
354356 .want_valgrind = false,
src/libtsan.zig+1
......@@ -211,6 +211,7 @@ pub fn buildTsan(comp: *Compilation) !void {
211211 .link_mode = link_mode,
212212 .want_sanitize_c = false,
213213 .want_stack_check = false,
214 .want_stack_protector = 0,
214215 .want_valgrind = false,
215216 .want_tsan = false,
216217 .want_pic = true,
src/libunwind.zig+1
......@@ -113,6 +113,7 @@ pub fn buildStaticLib(comp: *Compilation) !void {
113113 .link_mode = link_mode,
114114 .want_sanitize_c = false,
115115 .want_stack_check = false,
116 .want_stack_protector = 0,
116117 .want_red_zone = comp.bin_file.options.red_zone,
117118 .omit_frame_pointer = comp.bin_file.options.omit_frame_pointer,
118119 .want_valgrind = false,
src/link.zig+3
......@@ -90,6 +90,9 @@ pub const Options = struct {
9090 entry: ?[]const u8,
9191 stack_size_override: ?u64,
9292 image_base_override: ?u64,
93 /// 0 means no stack protector
94 /// other value means stack protector with that buffer size.
95 stack_protector: u32,
9396 cache_mode: CacheMode,
9497 include_compiler_rt: bool,
9598 /// Set to `true` to omit debug info.
src/link/Elf.zig+6
......@@ -1673,6 +1673,12 @@ fn linkWithLLD(self: *Elf, comp: *Compilation, prog_node: *std.Progress.Node) !v
16731673 }
16741674 }
16751675
1676 // stack-protector.
1677 // Related: https://github.com/ziglang/zig/issues/7265
1678 if (comp.libssp_static_lib) |ssp| {
1679 try argv.append(ssp.full_object_path);
1680 }
1681
16761682 // compiler-rt
16771683 if (compiler_rt_path) |p| {
16781684 try argv.append(p);
src/main.zig+16
......@@ -378,6 +378,8 @@ const usage_build_generic =
378378 \\ -fno-lto Force-disable Link Time Optimization
379379 \\ -fstack-check Enable stack probing in unsafe builds
380380 \\ -fno-stack-check Disable stack probing in safe builds
381 \\ -fstack-protector Enable stack protection in unsafe builds
382 \\ -fno-stack-protector Disable stack protection in safe builds
381383 \\ -fsanitize-c Enable C undefined behavior detection in unsafe builds
382384 \\ -fno-sanitize-c Disable C undefined behavior detection in safe builds
383385 \\ -fvalgrind Include valgrind client requests in release builds
......@@ -668,6 +670,7 @@ fn buildOutputType(
668670 var want_unwind_tables: ?bool = null;
669671 var want_sanitize_c: ?bool = null;
670672 var want_stack_check: ?bool = null;
673 var want_stack_protector: ?u32 = null;
671674 var want_red_zone: ?bool = null;
672675 var omit_frame_pointer: ?bool = null;
673676 var want_valgrind: ?bool = null;
......@@ -1168,6 +1171,10 @@ fn buildOutputType(
11681171 want_stack_check = true;
11691172 } else if (mem.eql(u8, arg, "-fno-stack-check")) {
11701173 want_stack_check = false;
1174 } else if (mem.eql(u8, arg, "-fstack-protector")) {
1175 want_stack_protector = Compilation.default_stack_protector_buffer_size;
1176 } else if (mem.eql(u8, arg, "-fno-stack-protector")) {
1177 want_stack_protector = 0;
11711178 } else if (mem.eql(u8, arg, "-mred-zone")) {
11721179 want_red_zone = true;
11731180 } else if (mem.eql(u8, arg, "-mno-red-zone")) {
......@@ -1521,6 +1528,12 @@ fn buildOutputType(
15211528 .no_color_diagnostics => color = .off,
15221529 .stack_check => want_stack_check = true,
15231530 .no_stack_check => want_stack_check = false,
1531 .stack_protector => {
1532 if (want_stack_protector == null) {
1533 want_stack_protector = Compilation.default_stack_protector_buffer_size;
1534 }
1535 },
1536 .no_stack_protector => want_stack_protector = 0,
15241537 .unwind_tables => want_unwind_tables = true,
15251538 .no_unwind_tables => want_unwind_tables = false,
15261539 .nostdlib => ensure_libc_on_non_freestanding = false,
......@@ -2859,6 +2872,7 @@ fn buildOutputType(
28592872 .want_unwind_tables = want_unwind_tables,
28602873 .want_sanitize_c = want_sanitize_c,
28612874 .want_stack_check = want_stack_check,
2875 .want_stack_protector = want_stack_protector,
28622876 .want_red_zone = want_red_zone,
28632877 .omit_frame_pointer = omit_frame_pointer,
28642878 .want_valgrind = want_valgrind,
......@@ -4663,6 +4677,8 @@ pub const ClangArgIterator = struct {
46634677 no_color_diagnostics,
46644678 stack_check,
46654679 no_stack_check,
4680 stack_protector,
4681 no_stack_protector,
46664682 strip,
46674683 exec_model,
46684684 emit_llvm,
src/musl.zig+1
......@@ -215,6 +215,7 @@ pub fn buildCRTFile(comp: *Compilation, crt_file: CRTFile) !void {
215215 .optimize_mode = comp.compilerRtOptMode(),
216216 .want_sanitize_c = false,
217217 .want_stack_check = false,
218 .want_stack_protector = 0,
218219 .want_red_zone = comp.bin_file.options.red_zone,
219220 .omit_frame_pointer = comp.bin_file.options.omit_frame_pointer,
220221 .want_valgrind = false,
src/stage1.zig+1-1
......@@ -416,7 +416,7 @@ export fn stage2_add_link_lib(
416416 const target = comp.getTarget();
417417 const is_libc = target_util.is_libc_lib_name(target, lib_name);
418418 if (is_libc) {
419 if (!comp.bin_file.options.link_libc) {
419 if (!comp.bin_file.options.link_libc and !comp.bin_file.options.parent_compilation_link_libc) {
420420 return "dependency on libc must be explicitly specified in the build command";
421421 }
422422 return null;
src/target.zig+9
......@@ -300,6 +300,15 @@ pub fn supportsStackProbing(target: std.Target) bool {
300300 (target.cpu.arch == .i386 or target.cpu.arch == .x86_64);
301301}
302302
303pub fn supportsStackProtector(target: std.Target) bool {
304 // TODO: investigate whether stack-protector works on wasm
305 return !target.isWasm();
306}
307
308pub fn libcProvidesStackProtector(target: std.Target) bool {
309 return !target.isMinGW() and target.os.tag != .wasi;
310}
311
303312pub fn supportsReturnAddress(target: std.Target) bool {
304313 return switch (target.cpu.arch) {
305314 .wasm32, .wasm64 => target.os.tag == .emscripten,
tools/update_clang_options.zig+20
......@@ -352,6 +352,26 @@ const known_options = [_]KnownOpt{
352352 .name = "fno-stack-check",
353353 .ident = "no_stack_check",
354354 },
355 .{
356 .name = "stack-protector",
357 .ident = "stack_protector",
358 },
359 .{
360 .name = "fstack-protector",
361 .ident = "stack_protector",
362 },
363 .{
364 .name = "fno-stack-protector",
365 .ident = "no_stack_protector",
366 },
367 .{
368 .name = "fstack-protector-strong",
369 .ident = "stack_protector",
370 },
371 .{
372 .name = "fstack-protector-all",
373 .ident = "stack_protector",
374 },
355375 .{
356376 .name = "MD",
357377 .ident = "dep_file",