SecBSD's official ports repository

devel/clang-tools-extra/patches/patch-lib_CodeGen_TargetPassConfig_cpp

@@ -0,0 +1,30 @@
+Add RETGUARD to clang for amd64. This security mechanism uses per-function
+random cookies to protect access to function return instructions, with the
+effect that the integrity of the return address is protected, and function
+return instructions are harder to use in ROP gadgets.
+
+On function entry the return address is combined with a per-function random
+cookie and stored in the stack frame. The integrity of this value is verified
+before function return, and if this check fails, the program aborts. In this way
+RETGUARD is an improved stack protector, since the cookies are per-function. The
+verification routine is constructed such that the binary space immediately
+before each ret instruction is padded with int03 instructions, which makes these
+return instructions difficult to use in ROP gadgets. In the kernel, this has the
+effect of removing approximately 50% of total ROP gadgets, and 15% of unique
+ROP gadgets compared to the 6.3 release kernel. Function epilogues are
+essentially gadget free, leaving only the polymorphic gadgets that result from
+jumping into the instruction stream partway through other instructions. Work to
+remove these gadgets will continue through other mechanisms.
+
+Index: lib/CodeGen/TargetPassConfig.cpp
+--- lib/CodeGen/TargetPassConfig.cpp.orig
++++ lib/CodeGen/TargetPassConfig.cpp
+@@ -950,6 +950,8 @@ void TargetPassConfig::addISelPrepare() {
+   if (requiresCodeGenSCCOrder())
+     addPass(new DummyCGSCCPass);
+ 
++  addPass(createReturnProtectorPass());
++
+   // Add both the safe stack and the stack protection passes: each of them will
+   // only protect functions that have corresponding attributes.
+   addPass(createSafeStackPass());