Stabilize stack-protector (try 2)

bootstrap.example.toml

@@ -783,7 +783,7 @@
 #rust.frame-pointers = false
 
 # Indicates whether stack protectors should be used
-# via the unstable option `-Zstack-protector`.
+# via `-Cstack-protector`.
 #
 # Valid options are : `none`(default), `strong`, or `all`.
 #rust.stack-protector = "none"

compiler/rustc_interface/src/tests.rs

@@ -664,6 +664,7 @@ fn test_codegen_options_tracking_hash() {
     tracked!(relocation_model, Some(RelocModel::Pic));
     tracked!(relro_level, Some(RelroLevel::Full));
     tracked!(split_debuginfo, Some(SplitDebuginfo::Packed));
+    tracked!(stack_protector, Some(StackProtector::All));
     tracked!(symbol_mangling_version, Some(SymbolManglingVersion::V0));
     tracked!(target_cpu, Some(String::from("abc")));
     tracked!(target_feature, String::from("all the features, all of them"));
@@ -901,7 +902,7 @@ fn test_unstable_options_tracking_hash() {
     tracked!(small_data_threshold, Some(16));
     tracked!(split_lto_unit, Some(true));
     tracked!(src_hash_algorithm, Some(SourceFileHashAlgorithm::Sha1));
-    tracked!(stack_protector, StackProtector::All);
+    tracked!(stack_protector, Some(StackProtector::All));
     tracked!(staticlib_hide_internal_symbols, true);
     tracked!(staticlib_rename_internal_symbols, true);
     tracked!(teach, true);

compiler/rustc_metadata/src/creader.rs

@@ -561,9 +561,12 @@ impl CStore {
                         mitigation_level: my_mitigation.level.level_str().to_string(),
                         extern_crate: data.name(),
                     };
-                    if my_mitigation.kind == DeniedPartialMitigationKind::StackProtector {
-                        // make stack-protector only a forward-compat warning since it was
-                        // pretty widely used
+                    // Make stack-protector with -Z stack-protector only a forward-compat warning since it was
+                    // pretty widely used. When using -C stack-protector, it should still be a hard error since
+                    // -C stack-protector has no pre-existing users
+                    if my_mitigation.kind == DeniedPartialMitigationKind::StackProtector
+                        && !tcx.sess.using_stable_stack_protector()
+                    {
                         tcx.sess.psess.buffer_crate_lint(PARTIAL_STACK_PROTECTOR, diagnostic);
                     } else {
                         tcx.dcx().emit_err(diagnostic);

compiler/rustc_session/src/diagnostics.rs

@@ -386,9 +386,7 @@ pub(crate) struct EmbedSourceInsufficientDwarfVersion {
 pub(crate) struct EmbedSourceRequiresDebugInfo;
 
 #[derive(Diagnostic)]
-#[diag(
-    "`-Z stack-protector={$stack_protector}` is not supported for target {$target_triple} and will be ignored"
-)]
+#[diag("`-C stack-protector={$stack_protector}` is not supported for target {$target_triple}")]
 pub(crate) struct StackProtectorNotSupportedForTarget<'a> {
     pub(crate) stack_protector: StackProtector,
     pub(crate) target_triple: &'a TargetTuple,

compiler/rustc_session/src/options.rs

@@ -2050,9 +2050,12 @@ pub mod parse {
         true
     }
 
-    pub(crate) fn parse_stack_protector(slot: &mut StackProtector, v: Option<&str>) -> bool {
+    pub(crate) fn parse_stack_protector(
+        slot: &mut Option<StackProtector>,
+        v: Option<&str>,
+    ) -> bool {
         match v.and_then(|s| StackProtector::from_str(s).ok()) {
-            Some(ssp) => *slot = ssp,
+            Some(ssp) => *slot = Some(ssp),
             _ => return false,
         }
         true
@@ -2376,6 +2379,9 @@ options! {
     #[rustc_lint_opt_deny_field_access("use `Session::split_debuginfo` instead of this field")]
     split_debuginfo: Option<SplitDebuginfo> = (None, parse_split_debuginfo, [TRACKED],
         "how to handle split-debuginfo, a platform-specific option"),
+    #[rustc_lint_opt_deny_field_access("use `Session::stack_protector` instead of this field")]
+    stack_protector: Option<StackProtector> = (None, parse_stack_protector, [TRACKED] { MITIGATION: StackProtector },
+        "control stack smashing protection strategy (`rustc --print stack-protector-strategies` for details)"),
     strip: Strip = (Strip::None, parse_strip, [UNTRACKED],
         "tell the linker which information to strip (`none` (default), `debuginfo` or `symbols`)"),
     symbol_mangling_version: Option<SymbolManglingVersion> = (None,
@@ -2946,8 +2952,8 @@ written to standard error output)"),
     src_hash_algorithm: Option<SourceFileHashAlgorithm> = (None, parse_src_file_hash, [TRACKED],
         "hash algorithm of source files in debug info (`md5`, `sha1`, or `sha256`)"),
     #[rustc_lint_opt_deny_field_access("use `Session::stack_protector` instead of this field")]
-    stack_protector: StackProtector = (StackProtector::None, parse_stack_protector, [TRACKED] { MITIGATION: StackProtector },
-        "control stack smash protection strategy (`rustc --print stack-protector-strategies` for details)"),
+    stack_protector: Option<StackProtector> = (None, parse_stack_protector, [TRACKED] { MITIGATION: StackProtector },
+        "control stack smashing protection strategy (`rustc --print stack-protector-strategies` for details)"),
     staticlib_allow_rdylib_deps: bool = (false, parse_bool, [TRACKED],
         "allow staticlibs to have rust dylib dependencies"),
     staticlib_hide_internal_symbols: bool = (false, parse_bool, [TRACKED],

compiler/rustc_session/src/options/mitigation_coverage.rs

@@ -200,7 +200,6 @@ denied_partial_mitigations! {
         // The mitigation name should match the option name in rustc_session::options,
         // to allow for resetting the mitigation
 
-        // stack-protector is an unstable option, so it can be denied-partial
         (StackProtector, "stack-protector", Edition2015, self.stack_protector()),
         (ControlFlowGuard, "control-flow-guard", EditionFuture, self.opts.cg.control_flow_guard == CFGuard::Checks)
     }

compiler/rustc_session/src/session.rs

@@ -1120,11 +1120,16 @@ impl Session {
     }
 
     pub fn stack_protector(&self) -> StackProtector {
-        if self.target.options.supports_stack_protector {
-            self.opts.unstable_opts.stack_protector
-        } else {
-            StackProtector::None
-        }
+        // -C stack-protector overwrites -Z stack-protector, default to StackProtector::None
+        self.opts
+            .cg
+            .stack_protector
+            .or(self.opts.unstable_opts.stack_protector)
+            .unwrap_or(StackProtector::None)
+    }
+
+    pub fn using_stable_stack_protector(&self) -> bool {
+        self.opts.cg.stack_protector.is_some()
     }
 
     /// Returns the `-Zbranch-protection` info. Note that it is adjusted to the current target, e.g.
@@ -1738,10 +1743,10 @@ fn validate_commandline_args_with_session_available(sess: &Session) {
         }
     }
 
-    if sess.opts.unstable_opts.stack_protector != StackProtector::None {
+    if sess.stack_protector() != StackProtector::None {
         if !sess.target.options.supports_stack_protector {
-            sess.dcx().emit_warn(diagnostics::StackProtectorNotSupportedForTarget {
-                stack_protector: sess.opts.unstable_opts.stack_protector,
+            sess.dcx().emit_err(diagnostics::StackProtectorNotSupportedForTarget {
+                stack_protector: sess.stack_protector(),
                 target_triple: &sess.opts.target_triple,
             });
         }

src/bootstrap/src/core/builder/cargo.rs

@@ -1095,6 +1095,8 @@ impl Builder<'_> {
         cargo.env(profile_var("STRIP"), self.config.rust_strip.to_string());
 
         if let Some(stack_protector) = &self.config.rust_stack_protector {
+            // Use -Zstack-protector here instead of -Cstack-protector
+            // to avoid bootstrap problems using the 1.100 stage0 compiler.
             rustflags.arg(&format!("-Zstack-protector={stack_protector}"));
         }
 

src/doc/rustc/src/codegen-options/index.md

@@ -688,6 +688,29 @@ Note that all three options are supported on Linux and Apple platforms,
 Attempting to use an unsupported option requires using the nightly channel
 with the `-Z unstable-options` flag.
 
+## stack-protector
+
+The option `-C stack-protector` controls the generation of
+stack-protector canaries which offer stack smashing protection.
+
+The exact presence, location and behavior of the stack-protector canaries depend
+on rustc's codegen backend, the target architecture, and codegen details, and are
+unstable and subject to change.
+
+Supported values for this option are:
+- `none` (default): Disable stack canary generation
+- `strong`: Generate stack canaries in any function that could be the source
+  of a stack buffer overflow (even in the presence of undefined behavior).
+  This provides similar security guarantees to Clang (or GCC's)
+  `-fstack-protector-strong`.
+- `all`: Generate stack canaries in all functions
+
+There is no mode equivalent to Clang's (or GCC's) plain `-fstack-protector`
+because its heuristic is tuned for C and does not offer protection for Rust programs.
+
+Stack protectors are not supported on some targets such as GPU targets; use
+of stack protectors on these targets is an error.
+
 ## strip
 
 The option `-C strip=val` controls stripping of debuginfo and similar auxiliary

src/doc/rustc/src/exploit-mitigations.md

@@ -62,7 +62,7 @@ equivalent.
 | Stack clashing protection | Yes | Yes | 1.20.0 (2017-08-31) |
 | Read-only relocations and immediate binding | Yes | Yes | 1.21.0 (2017-10-12) |
 | Heap corruption protection | Yes | Yes | 1.32.0 (2019-01-17) (via operating system default or specified allocator) |
-| Stack smashing protection | Yes | No, `-Z stack-protector` | Nightly |
+| Stack smashing protection | Yes | No, `-C stack-protector` | 1.101.0 (2026-12-24) |
 | Forward-edge control flow protection | Yes | No, `-Z sanitizer=cfi` | Nightly |
 | Backward-edge control flow protection (e.g., shadow and safe stack) | Yes | No, `-Z sanitizer=shadow-call-stack,safestack` | Nightly |
 

tests/assembly-gcc/stack-protector/stack-protector-heuristics-effect.rs

@@ -4,9 +4,9 @@
 //@ ignore-msvc stack check code uses different function names
 //@ ignore-nvptx64 stack protector is not supported
 //@ ignore-wasm32-unknown-unknown
-//@ [all] compile-flags: -Z stack-protector=all
-//@ [strong] compile-flags: -Z stack-protector=strong
-//@ [none] compile-flags: -Z stack-protector=none
+//@ [all] compile-flags: -C stack-protector=all
+//@ [strong] compile-flags: -C stack-protector=strong
+//@ [none] compile-flags: -C stack-protector=none
 //@ compile-flags: -C opt-level=2 -Z merge-functions=disabled -Z allow-partial-mitigations=stack-protector
 
 #![crate_type = "lib"]

tests/assembly-llvm/stack-protector/stack-protector-heuristics-effect-windows-32bit-2.rs

@@ -3,9 +3,9 @@
 //@ only-windows
 //@ only-msvc
 //@ ignore-64bit 64-bit table based SEH has slightly different behaviors than classic SEH
-//@ [all] compile-flags: -Z stack-protector=all
-//@ [strong] compile-flags: -Z stack-protector=strong
-//@ [none] compile-flags: -Z stack-protector=none
+//@ [all] compile-flags: -C stack-protector=all
+//@ [strong] compile-flags: -C stack-protector=strong
+//@ [none] compile-flags: -C stack-protector=none
 //@ compile-flags: -Z allow-partial-mitigations=stack-protector -C opt-level=2 -Z merge-functions=disabled
 
 #![crate_type = "lib"]

tests/assembly-llvm/stack-protector/stack-protector-heuristics-effect-windows-32bit.rs

@@ -3,9 +3,9 @@
 //@ only-windows
 //@ only-msvc
 //@ ignore-64bit 64-bit table based SEH has slightly different behaviors than classic SEH
-//@ [all] compile-flags: -Z stack-protector=all
-//@ [strong] compile-flags: -Z stack-protector=strong
-//@ [none] compile-flags: -Z stack-protector=none
+//@ [all] compile-flags: -C stack-protector=all
+//@ [strong] compile-flags: -C stack-protector=strong
+//@ [none] compile-flags: -C stack-protector=none
 //@ compile-flags: -Z allow-partial-mitigations=stack-protector -C opt-level=2 -Z merge-functions=disabled -Cpanic=abort -Cdebuginfo=1
 
 #![crate_type = "lib"]
@@ -124,7 +124,7 @@ pub fn local_var_addr_used_indirectly(f: fn(bool)) {
 
     // This function takes the address of a local variable taken. Although this
     // address is never used as a way to refer to stack memory, the `strong`
-    // heuristic adds stack smash protection. This is also the case in C++:
+    // heuristic adds stack smashing protection. This is also the case in C++:
     // ```
     // cat << EOF | clang++ -O2 -fstack-protector-strong -S -x c++ - -o - | grep stack_chk
     // #include <cstdint>
@@ -180,7 +180,7 @@ pub fn local_var_addr_taken_used_locally_only(factory: fn() -> i32, sink: fn(i32
 
     // Even though the local variable conceptually has its address taken, as
     // it's passed by reference to the trait function, the use of the reference
-    // is easily inlined. There is therefore no stack smash protection even with
+    // is easily inlined. There is therefore no stack smashing protection even with
     // the `strong` heuristic.
 
     // all: __security_check_cookie

tests/assembly-llvm/stack-protector/stack-protector-heuristics-effect-windows-64bit.rs

@@ -3,9 +3,9 @@
 //@ only-windows
 //@ only-msvc
 //@ ignore-32bit 64-bit table based SEH has slightly different behaviors than classic SEH
-//@ [all] compile-flags: -Z stack-protector=all
-//@ [strong] compile-flags: -Z stack-protector=strong
-//@ [none] compile-flags: -Z stack-protector=none
+//@ [all] compile-flags: -C stack-protector=all
+//@ [strong] compile-flags: -C stack-protector=strong
+//@ [none] compile-flags: -C stack-protector=none
 //@ compile-flags: -Z allow-partial-mitigations=stack-protector -C opt-level=2 -Z merge-functions=disabled -Cpanic=abort
 
 #![crate_type = "lib"]
@@ -129,7 +129,7 @@ pub fn local_var_addr_used_indirectly(f: fn(bool)) {
 
     // This function takes the address of a local variable taken. Although this
     // address is never used as a way to refer to stack memory, the `strong`
-    // heuristic adds stack smash protection. This is also the case C++:
+    // heuristic adds stack smashing protection. This is also the case in C++:
     // ```
     // cat << EOF | clang++ -O2 -fstack-protector-strong -S -x c++ - -o - | grep stack_chk
     // #include <cstdint>
@@ -186,7 +186,7 @@ pub fn local_var_addr_taken_used_locally_only(factory: fn() -> i32, sink: fn(i32
 
     // Even though the local variable conceptually has its address taken, as
     // it's passed by reference to the trait function, the use of the reference
-    // is easily inlined. There is therefore no stack smash protectionen with
+    // is easily inlined. There is therefore no stack smashing protection even with
     // the `strong` heuristic.
 
     // all: __security_check_cookie

tests/assembly-llvm/stack-protector/stack-protector-heuristics-effect.rs

@@ -4,12 +4,12 @@
 //@ ignore-msvc stack check code uses different function names
 //@ ignore-nvptx64 stack protector is not supported
 //@ ignore-wasm32-unknown-unknown
-//@ [all] compile-flags: -Z stack-protector=all
-//@ [strong] compile-flags: -Z stack-protector=strong
-//@ [none] compile-flags: -Z stack-protector=none
+//@ [all] compile-flags: -C stack-protector=all
+//@ [strong] compile-flags: -C stack-protector=strong
+//@ [none] compile-flags: -C stack-protector=none
 //@ compile-flags: -C opt-level=2 -Z merge-functions=disabled -Z allow-partial-mitigations=stack-protector
 
-// NOTE: the heuristics for stack smash protection inappropriately rely on types in LLVM IR,
+// NOTE: the heuristics for stack smashing protection inappropriately rely on types in LLVM IR,
 // despite those types having no semantic meaning. This means that the `basic` and `strong`
 // settings do not behave in a coherent way. This is a known issue in LLVM.
 // See comments on https://github.com/rust-lang/rust/issues/114903.
@@ -120,7 +120,7 @@ pub fn local_var_addr_used_indirectly(f: fn(bool)) {
 
     // This function takes the address of a local variable taken. Although this
     // address is never used as a way to refer to stack memory, the `strong`
-    // heuristic adds stack smash protection. This is also the case in C++:
+    // heuristic adds stack smashing protection. This is also the case in C++:
     // ```
     // cat << EOF | clang++ -O2 -fstack-protector-strong -S -x c++ - -o - | grep stack_chk
     // #include <cstdint>
@@ -171,7 +171,7 @@ pub fn local_var_addr_taken_used_locally_only(factory: fn() -> i32, sink: fn(i32
 
     // Even though the local variable conceptually has its address taken, as
     // it's passed by reference to the trait function, the use of the reference
-    // is easily inlined. There is therefore no stack smash protection even with
+    // is easily inlined. There is therefore no stack smashing protection even with
     // the `strong` heuristic.
 
     // all: __stack_chk_fail

tests/assembly-llvm/stack-protector/stack-protector-target-support.rs

@@ -1,10 +1,10 @@
-// Test that stack smash protection code is emitted for all tier1 and tier2
+// Test that stack smashing protection code is emitted for all tier1 and tier2
 // targets, with the exception of nvptx64-nvidia-cuda
 //
 //@ add-minicore
 //@ revisions: r1 r2 r3 r4 r5 r6 r7 r8 r9 r10 r11 r12 r13 r14 r15 r16 r17 r18 r19 r20 r21 r22 r23
 //@ revisions: r24 r25 r26 r27 r28 r29 r30 r31 r32 r33         r36 r37 r38 r39 r40 r41 r42 r43 r44
-//@ revisions: r45 r46 r47 r48 r49 r50 r51 r52 r53 r54 r55 r56 r57 r58 r59 r60 r61 r62 r63 r64 r65
+//@ revisions: r45 r46 r47 r48     r50 r51 r52 r53 r54 r55 r56 r57 r58 r59 r60 r61 r62 r63 r64 r65
 //@ revisions: r66 r67 r68 r69 r70 r71 r72 r73 r74 r75 r76 r77 r78 r79 r80 r81 r82 r83 r84 r85
 //@ assembly-output: emit-asm
 //@ [r1] compile-flags: --target aarch64-unknown-linux-gnu
@@ -99,8 +99,8 @@
 //@ [r47] needs-llvm-components: mips
 //@ [r48] compile-flags: --target mipsel-unknown-linux-musl
 //@ [r48] needs-llvm-components: mips
-//@ [r49] compile-flags: --target nvptx64-nvidia-cuda
-//@ [r49] needs-llvm-components: nvptx
+//-@ [r49] compile-flags: --target nvptx64-nvidia-cuda [stack protector not supported on CUDA
+//-  see the test fail-stack-protector-unsupported]
 //@ [r50] compile-flags: --target powerpc-unknown-linux-gnu
 //@ [r50] needs-llvm-components: powerpc
 //@ [r51] compile-flags: --target powerpc64-unknown-linux-gnu
@@ -173,7 +173,7 @@
 //@ [r84] needs-llvm-components: x86
 //@ [r85] compile-flags: --target x86_64-unknown-redox
 //@ [r85] needs-llvm-components: x86
-//@ compile-flags: -Z stack-protector=all -Z allow-partial-mitigations=stack-protector -Cpanic=abort
+//@ compile-flags: -C stack-protector=all -Z allow-partial-mitigations=stack-protector -Cpanic=abort
 //@ compile-flags: -C opt-level=2
 
 #![crate_type = "lib"]
@@ -193,10 +193,6 @@ pub fn foo() {
     // r7: callq __security_check_cookie
     // r13: bl __security_check_cookie
 
-    // cuda doesn't support stack-smash protection
-    // r49-NOT: __security_check_cookie
-    // r49-NOT: __stack_chk_fail
-
     // Other targets do stack checking within the function, and call a failure function on error
     // r1: __stack_chk_fail
     // r2: __stack_chk_fail