CFI: Add diagnostic information to likely CFI violation stack traces.

base/debug/stack_trace_posix.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/debug/stack_trace.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <signal.h>
 #include <stdio.h>
@@ skipping 263 matching lines @@
       PrintToStderr(" <unknown> ");
   }
   if (signal == SIGBUS || signal == SIGFPE ||
       signal == SIGILL || signal == SIGSEGV) {
     internal::itoa_r(reinterpret_cast<intptr_t>(info->si_addr),
                      buf, sizeof(buf), 16, 12);
     PrintToStderr(buf);
   }
   PrintToStderr("\n");
 
+#if defined(CFI_ENFORCEMENT)
+  if (signal == SIGILL && info->si_code == ILL_ILLOPN) {
+    PrintToStderr(
+        "CFI: Most likely a control flow integrity violation; for more "
+        "information see:\n");
+    PrintToStderr(
+        "https://www.chromium.org/developers/testing/control-flow-integrity\n");
+  }
+#endif
+
   debug::StackTrace().Print();
 
 #if defined(OS_LINUX)
 #if ARCH_CPU_X86_FAMILY
   ucontext_t* context = reinterpret_cast<ucontext_t*>(void_context);
   const struct {
     const char* label;
     greg_t value;
   } registers[] = {
 #if ARCH_CPU_32_BITS
@@ skipping 94 matching lines @@
                "ip: %x, cs: %x, ds: %x, es: %x, fs: %x, gs: %x\n",
                context->uc_mcontext->__ss.__eip,
                context->uc_mcontext->__ss.__cs,
                context->uc_mcontext->__ss.__ds,
                context->uc_mcontext->__ss.__es,
                context->uc_mcontext->__ss.__fs,
                context->uc_mcontext->__ss.__gs));
   write(STDERR_FILENO, buf, std::min(len, sizeof(buf) - 1));
 #endif  // ARCH_CPU_32_BITS
 #endif  // defined(OS_MACOSX)
+
+#if defined(CFI_ENFORCEMENT)
+  if (signal == SIGILL && info->si_code == ILL_ILLOPN) {
+    PrintToStderr("CFI: Aborting\n");
+  }
+#endif

[Nico, 2015/08/05 20:59:07]

this block seems to not add anything useful

[pcc1, 2015/08/05 21:00:30]

It acts as an end marker for the problem report. ClusterFuzz folks in particular
have indicated that this would be useful for them.

+
   _exit(1);
 }
 
 class PrintBacktraceOutputHandler : public BacktraceOutputHandler {
  public:
   PrintBacktraceOutputHandler() {}
 
   void HandleOutput(const char* output) override {
     // NOTE: This code MUST be async-signal safe (it's used by in-process
     // stack dumping signal handler). NO malloc or stdio is allowed here.
@@ skipping 417 matching lines @@
     *ptr = *start;
     *start++ = ch;
   }
   return buf;
 }
 
 }  // namespace internal
 
 }  // namespace debug
 }  // namespace base