|
| 1 | +use rustc_abi::ExternAbi; |
| 2 | +use rustc_hir::{self as hir, Expr, ExprKind}; |
| 3 | +use rustc_middle::ty::layout::{LayoutCx, TyAndLayout}; |
| 4 | +use rustc_middle::ty::{self, TyCtxt, TypeVisitableExt}; |
| 5 | +use rustc_session::{declare_lint, declare_lint_pass}; |
| 6 | + |
| 7 | +use crate::{LateContext, LateLintPass, LintContext, lints}; |
| 8 | + |
| 9 | +declare_lint! { |
| 10 | + /// The `cmse_uninitialized_leak` lint detects values that may be (partially) uninitialized that |
| 11 | + /// cross the secure boundary. |
| 12 | + /// |
| 13 | + /// ### Example |
| 14 | + /// |
| 15 | + /// ```rust,ignore (ABI is only supported on thumbv8) |
| 16 | + /// extern "cmse-nonsecure-entry" fn foo() -> MaybeUninit<u64> { |
| 17 | + /// MaybeUninit::uninit() |
| 18 | + /// } |
| 19 | + /// ``` |
| 20 | + /// |
| 21 | + /// {{produces}} |
| 22 | + /// |
| 23 | + /// ### Explanation |
| 24 | + /// |
| 25 | + /// The cmse calling conventions normally take care of clearing registers to make sure that |
| 26 | + /// stale secure information is not observable from non-secure code. Uninitialized memory may |
| 27 | + /// still contain secret information, so the programmer must be careful when (partially) |
| 28 | + /// uninitialized values cross the secure boundary. This lint fires when a partially |
| 29 | + /// uninitialized value (e.g. a `union` value or a type with a niche) crosses the secure |
| 30 | + /// boundary, i.e.: |
| 31 | + /// |
| 32 | + /// - when returned from a `cmse-nonsecure-entry` function |
| 33 | + /// - when passed as an argument to a `cmse-nonsecure-call` function |
| 34 | + /// |
| 35 | + /// This lint is a best effort: not all cases of (partially) uninitialized data crossing the |
| 36 | + /// secure boundary are caught. |
| 37 | + pub CMSE_UNINITIALIZED_LEAK, |
| 38 | + Warn, |
| 39 | + "(partially) uninitialized value may leak secure information" |
| 40 | +} |
| 41 | + |
| 42 | +declare_lint_pass!(CmseUninitializedLeak => [CMSE_UNINITIALIZED_LEAK]); |
| 43 | + |
| 44 | +impl<'tcx> LateLintPass<'tcx> for CmseUninitializedLeak { |
| 45 | + fn check_expr(&mut self, cx: &LateContext<'tcx>, expr: &'tcx Expr<'tcx>) { |
| 46 | + check_cmse_entry_return(cx, expr); |
| 47 | + check_cmse_call_call(cx, expr); |
| 48 | + } |
| 49 | +} |
| 50 | + |
| 51 | +fn check_cmse_call_call<'tcx>(cx: &LateContext<'tcx>, expr: &'tcx Expr<'tcx>) { |
| 52 | + let ExprKind::Call(callee, arguments) = expr.kind else { |
| 53 | + return; |
| 54 | + }; |
| 55 | + |
| 56 | + // Determine the callee ABI. |
| 57 | + let callee_ty = cx.typeck_results().expr_ty(callee); |
| 58 | + let sig = match callee_ty.kind() { |
| 59 | + ty::FnPtr(poly_sig, header) if header.abi == ExternAbi::CmseNonSecureCall => { |
| 60 | + poly_sig.skip_binder() |
| 61 | + } |
| 62 | + _ => return, |
| 63 | + }; |
| 64 | + |
| 65 | + let fn_sig = cx.tcx.erase_and_anonymize_regions(sig); |
| 66 | + let typing_env = ty::TypingEnv::fully_monomorphized(); |
| 67 | + |
| 68 | + for (arg, ty) in arguments.iter().zip(fn_sig.inputs()) { |
| 69 | + // `impl Trait` is not allowed in the argument types. |
| 70 | + if ty.has_opaque_types() { |
| 71 | + continue; |
| 72 | + } |
| 73 | + |
| 74 | + let Ok(layout) = cx.tcx.layout_of(typing_env.as_query_input(*ty)) else { |
| 75 | + continue; |
| 76 | + }; |
| 77 | + |
| 78 | + if layout_contains_union(cx.tcx, &layout) { |
| 79 | + cx.emit_span_lint( |
| 80 | + CMSE_UNINITIALIZED_LEAK, |
| 81 | + arg.span, |
| 82 | + lints::CmseUnionMayLeakInformation, |
| 83 | + ); |
| 84 | + } |
| 85 | + } |
| 86 | +} |
| 87 | + |
| 88 | +fn check_cmse_entry_return<'tcx>(cx: &LateContext<'tcx>, expr: &'tcx Expr<'tcx>) { |
| 89 | + let owner = cx.tcx.hir_enclosing_body_owner(expr.hir_id); |
| 90 | + |
| 91 | + match cx.tcx.def_kind(owner) { |
| 92 | + hir::def::DefKind::Fn | hir::def::DefKind::AssocFn => {} |
| 93 | + _ => return, |
| 94 | + } |
| 95 | + |
| 96 | + // Only continue if the current expr is an (implicit) return. |
| 97 | + let body = cx.tcx.hir_body_owned_by(owner); |
| 98 | + let is_implicit_return = expr.hir_id == body.value.hir_id; |
| 99 | + if !(matches!(expr.kind, ExprKind::Ret(_)) || is_implicit_return) { |
| 100 | + return; |
| 101 | + } |
| 102 | + |
| 103 | + let sig = cx.tcx.fn_sig(owner).skip_binder(); |
| 104 | + if sig.abi() != ExternAbi::CmseNonSecureEntry { |
| 105 | + return; |
| 106 | + } |
| 107 | + |
| 108 | + let fn_sig = cx.tcx.instantiate_bound_regions_with_erased(sig); |
| 109 | + let fn_sig = cx.tcx.erase_and_anonymize_regions(fn_sig); |
| 110 | + let return_type = fn_sig.output(); |
| 111 | + |
| 112 | + // `impl Trait` is not allowed in the return type. |
| 113 | + if return_type.has_opaque_types() { |
| 114 | + return; |
| 115 | + } |
| 116 | + |
| 117 | + let typing_env = ty::TypingEnv::fully_monomorphized(); |
| 118 | + let Ok(ret_layout) = cx.tcx.layout_of(typing_env.as_query_input(return_type)) else { |
| 119 | + return; |
| 120 | + }; |
| 121 | + |
| 122 | + if layout_contains_union(cx.tcx, &ret_layout) { |
| 123 | + let return_expr_span = if is_implicit_return { |
| 124 | + match expr.kind { |
| 125 | + ExprKind::Block(block, _) => match block.expr { |
| 126 | + Some(tail) => tail.span, |
| 127 | + None => expr.span, |
| 128 | + }, |
| 129 | + _ => expr.span, |
| 130 | + } |
| 131 | + } else { |
| 132 | + expr.span |
| 133 | + }; |
| 134 | + |
| 135 | + cx.emit_span_lint( |
| 136 | + CMSE_UNINITIALIZED_LEAK, |
| 137 | + return_expr_span, |
| 138 | + lints::CmseUnionMayLeakInformation, |
| 139 | + ); |
| 140 | + } |
| 141 | +} |
| 142 | + |
| 143 | +/// Check whether any part of the layout is a union, which may contain secure data still. |
| 144 | +fn layout_contains_union<'tcx>(tcx: TyCtxt<'tcx>, layout: &TyAndLayout<'tcx>) -> bool { |
| 145 | + if layout.ty.is_union() { |
| 146 | + return true; |
| 147 | + } |
| 148 | + |
| 149 | + let typing_env = ty::TypingEnv::fully_monomorphized(); |
| 150 | + let cx = LayoutCx::new(tcx, typing_env); |
| 151 | + |
| 152 | + match &layout.variants { |
| 153 | + rustc_abi::Variants::Single { .. } => { |
| 154 | + for i in 0..layout.fields.count() { |
| 155 | + if layout_contains_union(tcx, &layout.field(&cx, i)) { |
| 156 | + return true; |
| 157 | + } |
| 158 | + } |
| 159 | + } |
| 160 | + |
| 161 | + rustc_abi::Variants::Multiple { variants, .. } => { |
| 162 | + for (variant_idx, _vdata) in variants.iter_enumerated() { |
| 163 | + let variant_layout = layout.for_variant(&cx, variant_idx); |
| 164 | + |
| 165 | + for i in 0..variant_layout.fields.count() { |
| 166 | + if layout_contains_union(tcx, &variant_layout.field(&cx, i)) { |
| 167 | + return true; |
| 168 | + } |
| 169 | + } |
| 170 | + } |
| 171 | + } |
| 172 | + |
| 173 | + rustc_abi::Variants::Empty => {} |
| 174 | + } |
| 175 | + |
| 176 | + false |
| 177 | +} |
0 commit comments