https://gcc.gnu.org/bugzilla/show_bug.cgi?id=128572
Bug ID: 128572
Summary: strub: callable and disabled functions reading strub
variables are accepted without a diagnostic
Product: gcc
Version: 16.2.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: ipa
Assignee: unassigned at gcc dot gnu.org
Reporter: 220245569 at seu dot edu.cn
CC: 220255623 at seu dot edu.cn, jianhao.xu at seu dot edu.cn
Target Milestone: ---
Target: x86_64-*-linux-gnu
Summary
-------
GCC 16.2.0 accepts reads of a strub variable from functions explicitly marked
strub("callable") and strub("disabled"), without either enabling stack
scrubbing or diagnosing the conflict.
The Common Type Attributes documentation says that reading a variable of
strub-qualified type implicitly enables strub on the enclosing function, and
that a function with explicitly disabled strub will get an error if its body
requires it.
https://gcc.gnu.org/onlinedocs/gcc/Common-Type-Attributes.html
Reproducer
----------
$ cat trigger.c
typedef int __attribute__((strub)) strub_int;
strub_int secret_var = 42;
int __attribute__((strub("callable")))
leak_callable(void) {
strub_int local_secret = secret_var;
return local_secret + 1;
}
int __attribute__((strub("disabled")))
leak_disabled(void) {
return secret_var;
}
Compile flag:
$ gcc -O2 -fstrub=relaxed -Wall -Wextra -S trigger.c -o trigger.s
Observed: exit status 0, no diagnostics.
$ cat trigger.s
# Relevant x86_64-linux-gnu assembly:
leak_callable:
movl secret_var(%rip), %eax
addl $1, %eax
ret
leak_disabled:
movl secret_var(%rip), %eax
ret
Expected behavior
-----------------
Diagnose the functions whose explicit mode conflicts with the strub requirement
introduced by the variable read. This report concerns the missing diagnostic;
the optimized assembly alone does not establish that a secret was spilled to
the stack.
Possible cause / Suggested Fix
-----------------------------
In gcc/ipa-strub.cc, compute_strub_mode deliberately examines bodies with
explicit non-scrubbing attributes and sets req_attr when strub_from_body_p
finds a strub requirement. However, the final diagnostic branch is guarded by
"else if (strub_enable && !strub_attr)". The non-null explicit attribute
suppresses the "requires strub, but no viable strub mode was found" diagnostic.
Please check the explicit callable/disabled cases in this branch and add
regression coverage for reads of strub-qualified globals from both modes.
