JP2009230479A - Microprocessor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a microprocessor for performing at a high speed buffer overflow detection for preventing stack smashing. <P>SOLUTION: A return address and a storage address of the return address are separately stored when the return address is stored by a procedure program called by a procedure calling operation, and a buffer overflow detection circuit is added , which compares the separately stored return address with a value to detect that buffer overflow occurs in being different when the return address is read by a return operation to a calling source. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a technique for detecting occurrence of a buffer overflow due to a stack smashing attack.

  In recent years, the existence of malicious programs that cause damage by causing a computer system to operate unintentionally has become a problem. As a method for executing a malicious program, there is a method using a buffer overflow, and among them, a method called stack smashing that uses a stack overflow is often used.

  A state of occurrence of stack smashing will be briefly described with reference to FIG. When the procedure X by the malicious program is called, the stack pointer register (SP) and the frame pointer register (FP) are updated so as to be performed in the normal procedure call procedure as shown in (a), and the procedure X is used. Stack area is secured. This stack area normally stores processor registers and data used in processing. Then, the return address (Return Addr.) To the caller of the procedure X is stored at the address of the stack pointer (SP) +20 so that a new procedure Y can be called from the procedure X.

  However, in the process of saving the input data in the data buffer of the procedure X processing program, for example, if data larger than the data buffer size secured in the stack area is input, the upper limit of the number of input data is not confirmed When a function or the like is used, writing is performed exceeding the data buffer size as shown in (b).

  In this way, the information of the return address (Return Addr.) To the procedure caller that was first saved in the procedure X process is overwritten with overflowing data, and the malicious program is rewritten at the end of the procedure X process. The instruction of the return address (Return Addr.) Can be executed.

  To solve this problem, a guard variable is stored between the return address (Return Addr.) Stored in the stack and a buffer area such as an array in the stack, and when returning to the procedure caller, There is a technique for preventing stack smashing by reading the return address after confirming the validity (see, for example, Patent Publication 1).

Further, the computer processor and the cache memory are modified, and when the return address (Return Addr.) Is written into the cache memory when the procedure X is called, a copy (replica) is simultaneously stored in the cache memory, and the caller There is a technique for preventing stack smashing by comparing a return address (Return Addr.) Read from a memory at the time of return to a replica data with a replica circuit and confirming that they match (for example, patents) (See Publication 2).
JP 2001-216161 A JP 2005-338946 A

  However, the method of detecting a buffer overflow by software using a guard variable can reduce the amount of correction of the source program by using an extended compiler or the like that can insert the program code of the detection procedure. When calling and returning to the caller, there is a problem that an overhead of execution time due to insertion of extra program code for checking a return address (Return Addr.) Occurs.

  Further, the method of detecting a buffer overflow by hardware by improving a part of the processor and the cache memory reduces the amount of program recompilation and reduces the overhead of program execution time. However, the procedure X is called repeatedly. In order to maintain 100% detection even when there is a large amount of data, a cache memory with a large number of ways that does not cause the replica data at the return address stored in the cache memory to be expelled is required, which increases the circuit scale. When a cache memory with a small number of ways is used in order to suppress an increase in circuit scale, there is a problem that a replica data storage area is insufficient and replica data is evicted and 100% cannot be detected.

  The present invention has been made to solve the above-described problem, and provides a processor that realizes 100% buffer overflow detection with a small additional circuit scale while enabling detection of buffer overflow by hardware with low execution time overhead. The purpose is to do.

  To achieve the above object, a microprocessor of the present invention is a microprocessor having a procedure call branch instruction and capable of storing a return address to a caller in a memory, wherein the return address to the caller is stored in the memory. A storage detection unit for detecting a storage operation to be stored in the storage unit, a storage unit different from the memory for storing a return address in the storage operation detected by the storage detection unit, and a storage address for storing the return address; Read detection means for detecting a read operation from the storage address of the memory, and when a read operation is detected by the read detection means, the return address read from the memory is compared with the return address read from the storage means. , Buffer overflow to detect that a buffer overflow has occurred when the comparison contents do not match And having a low detection means.

  According to the present invention, when returning to the caller procedure, the return address stored in the stack area in advance and the return address stored in the protected CAM memory are compared by hardware, so that the buffer overflow Detection is possible. This series of buffer overflow detection processing requires processing by a program for saving entries in the CAM memory to the external memory and restoring the entries in the external memory to the CAM memory. The number of entries in the CAM memory By optimizing, it is possible to minimize program support, and it is possible to detect a buffer overflow faster than a detection method using a software program such as a guard variable.

  In addition, since entries in the CAM memory can be saved and restored to a large-capacity external memory, all buffer overflows can be detected.

  Furthermore, since it is not necessary to change the program part related to the target stack operation, recompilation and redesign work can be reduced.

  Examples of the present invention will be described below.

  An embodiment of a microprocessor having a buffer overflow detection circuit according to the present invention will be described with reference to FIGS.

  FIG. 1 is a block diagram illustrating a main configuration of a computer system 1 in which a microprocessor 100 having a buffer overflow detection circuit according to an embodiment and an external memory 200 for storing programs and data are connected by an external bus 300. Although not shown, the computer system 1 can include an input / output device, a display device, a storage device, and the like that are provided in a standard computer system.

  The microprocessor 100 shown in FIG. 1 has a configuration in which a buffer overflow detection circuit 400 is added to the processor unit of the MIPS architecture. The processor unit includes a CPU control circuit 110, an instruction register 120, a register file 130, a bus interface unit 140, and the like. The bus interface unit 140 and the external memory 200 are connected to each other via the data bus 302 to transmit / receive data, and the address bus 301 transmits / receives an address. Since the connection diagram of the block diagram becomes complicated, the instruction code (data), part of the data and address signal lines and control lines are not shown.

  The buffer overflow detection circuit 400 controls the operation of the load / store / JAL instruction detection circuit 410 that detects the type of instruction stored and interpreted in the instruction register 120 and the buffer overflow detection circuit 400, and performs an interrupt operation to the processor unit. The control circuit 420 for notifying the occurrence of buffer overflow or starting the linking operation with the processor unit, and the register number for performing the branch operation with a JAL (Jump And Link) instruction and storing the return address to the branch source RR register 430 to save, save address register 440 to store the address to save the return address, return address register 450 to store the return address, and the return address paired with the save address as a tag and the save address as data CAM (Conte nt Addressable Memory) memory 500, and a comparison circuit 510 that compares the return address from the return address register 450 with the data at the return address read from the CAM 500.

  The CPU control circuit 110 decodes and executes an instruction read into the instruction register 120 from the external memory 200 via the interface unit 140 and the data bus 131 to control the internal operation of the microprocessor 100, and the instruction to be executed next. Control the read operation to control the program execution order. That is, if the decoded instruction is not a branch instruction, an address output from a program counter (not shown) built in the CPU control circuit 110 is output to the address bus 111, and the address is transferred to the external memory 200 via the bus interface unit 140. Output to. Then, the next instruction read from the corresponding address in the external memory 200 is read into the instruction register 120.

  Also, for example, when the SW instruction (Store Word: an instruction for storing data of one word length of the register in the memory) is read into the instruction register 120 and the instruction is decoded and executed, the SW instruction Data is read from the register (source register) of the designated register file 130 and output to the data bus 131. At the same time, the address generated from the address information included in the instruction being decoded in the CPU control circuit 110 and the data read from the register of the register file 130 specified by the SW instruction is output to the address bus 111. Then, the bus interface unit 140 connected to each of the buses 131 and 111 is controlled to write the data to the designated address of the external memory 200 connected to the external address bus 301 and the external data bus 302. . Note that an arithmetic circuit that performs data arithmetic operations, a control / status signal that connects each element of the CPU control circuit 110 and the processor unit, and the like are also not shown. Further, for convenience of explanation, the processor is a MIPS architecture processor, but a processor of another architecture may be used.

  Next, the operation of detecting the buffer overflow of the stack targeted by the buffer overflow detection circuit 400 of the present invention will be described.

  FIG. 2 is a flowchart illustrating a main control processing procedure of the buffer overflow detection circuit 400 according to the embodiment. FIG. 3 is a source program list showing an example of a source program including a procedure X calling process (Procedure call) described in C language. 4 and 5 are part of an assembly code list obtained by compiling the source program of FIG. 3 with a compiler (program). FIG. 6 is a table showing conventions for the purpose of use of registers of the MIPS architecture processor, and is referred to when the purpose of use of registers is normally assigned when a compiler or the like is not specified. FIG. 7 is a diagram showing a change in the usage state of the stack area during the procedure call and the return operation to the caller.

  Before describing the operation of the buffer overflow detection circuit 400 of the embodiment, how the stack area is used in the execution of the program of FIG. 3 will be described with reference to FIG. The program in FIG. 3 is an example of a simple C program for explaining the embodiment. When the procedure X called the keisan function is called from the main function and the processing of the keisan function is completed, the caller of the procedure X is returned by a return instruction. This is a program that returns processing to the main function.

  When the procedure X is called, a necessary stack area is secured first, and then the return address (return address) to the caller is saved in the stack area (the contents of the register are written and saved in the external memory by a store instruction). After the called procedure is processed, the return address saved in the stack area is loaded (read from the external memory into the specified register), the stack area is released, and the jump to the loaded return address (branch) ) To return to the function that called the procedure X.

  Hereinafter, when the shell program (the interpreter program between the computer system kernel program and the user) is operated and accessed, the user starts the main function program and performs the above-described series of operations. This will be explained in the actual program flow.

  First, the main function shown in FIG. 5 is called from the shell program. At this time, a stack area necessary for the main function is secured, and a return address to the calling shell program is stored in the stack area. The usage status of the stack area is as shown in FIG. Thereafter, the call of procedure X to the keisan function is executed by the JAL instruction of the main function (line 5A in FIG. 5). As shown in FIG. 6, in the processor of the MIPS architecture, the purpose of use of 32 registers is customarily determined. In the execution of this JAL instruction, the register number “31” is assigned to the register unless otherwise specified by the instruction. When the return address is stored, the process jumps to the keisan function of FIG.

  In the first part of this keisan function, first, a stack area for the keisan function is secured (line 4A in FIG. 4), and the return address to the caller main function is stored in the stack area (FIG. 4). 4B line). The usage status of the stack area is as shown in FIG. In the process of the keisan function shown in FIG. 4, the return address stored in the stack area is loaded into the register of register number “31” (line 4C in FIG. 4), and secured at the beginning of the keisan function (in FIG. 4). After releasing the stack area (line 4A) (line 4D in FIG. 4), the jump function (line 4E in FIG. 4) is executed to return to the caller main function. The usage status of the stack area at this time is as shown in FIG.

  Similarly, in the processing of the main function in FIG. 5, after saving the stack area and loading the return address to the caller shell script into the register of register number “31”, the stack area is released and a jump instruction is issued. To return to the calling shell program.

  The operation of the buffer overflow detection circuit 400 of the processor 100 according to the embodiment will be described in consideration of the processing at the time of calling the procedure X and returning to the caller.

  As shown in the flowchart of FIG. 2, first, it is monitored using the load / store / JAL instruction detection circuit 410 whether the instruction read from the external memory 200 into the instruction register 120 is a JAL instruction (step S100). In the case of an instruction other than the JAL instruction, step S100 is repeatedly executed for the next instruction read from the external memory 200 into the instruction register 120.

  When the load / store / JAL instruction detection circuit 410 detects that the instruction is a JAL instruction, the rd number (rd is the return address) of the JAL instruction notified to the control circuit 420 via the signal line 411. The register number which is the identification information of the register to be stored.The JAL instruction of FIGS.4 and 5 is not specified by the operand, so the register number is "31" in accordance with the conventional usage purpose of the register) via the signal line 421 The data is stored in the RR register 430 (step S110).

  Next, the load / store / JAL instruction detection circuit 410 monitors whether the next instruction read into the instruction register 120 is a JAL instruction or a store instruction (step S120). In the case of an instruction other than a JAL instruction (which stores the branch operation and the return address to the branch source in a register) or a store instruction (which stores the register contents in memory), the next instruction read into the instruction register 120 On the other hand, step S120 is repeatedly executed. If a JAL instruction is detected, the process returns to step S110.

  On the other hand, when a store instruction is detected, the register number stored in the RR register 430 is input to the load / store / JAL instruction detection circuit 410 via the signal line 431. It is checked whether or not the register numbers stored in the RR register 430 match (step S130). If they do not match, the process returns to step S120, and the next instruction to be read is monitored.

  If the register numbers match, the store address specified by the store instruction output from the CPU control circuit 110 to the address bus 111 is input to the control circuit 420. The control circuit 420 stores the received store address in the storage address register 440 via the signal line 422. Further, the data (return address) of the source register specified by the store instruction and output to the data bus 131 is input to the control circuit 420. The control circuit 420 stores the received return address in the return address register 450 via the signal line 423 (step S140).

  Next, an entry having the storage address stored in the storage address register 440 as a tag and the return address stored in the return address register 450 as data is written to the CAM memory 500 via the signal line 441 and the signal line 451, respectively. (Step S150). In the entry writing step S150 in the CAM memory 500, when there is no room for writing in the CAM memory 500, the CAM memory 500 notifies the control circuit 420 that it is in the entry FULL state (F) through the signal line 502.

  In response to this, the control circuit 420 stops the writing operation to the CAM memory 500 and notifies the CPU control circuit 110 of the entry FULL interrupt via the signal line 424. Upon receiving the interrupt notification, the CPU control circuit 110 starts the entry FULL interrupt processing program and executes the CAM entry Read instruction, thereby reading the oldest CAM entry in the CAM memory 500 into a tag and data register (not shown). After that, it is saved in the external memory 200.

  In the case of the MIPS architecture, a CoProcessor Move instruction (mfc2) or the like is used as a dedicated instruction for accessing the tag and data register and reading / writing from / to the register of the register file 130 of the processor unit. After the interrupt process, the processor unit resumes the interrupted program process, and the control circuit 420 writes an entry to the CAM memory 500. Incidentally, some commercially available microprocessors use CAM memory technology for a built-in MMU (Memory Management Unit), and can access a built-in CAM memory using a dedicated instruction or the like.

  Next, the load / store / JAL instruction detection circuit 410 monitors whether the next instruction read into the instruction register 120 is a JAL instruction or a load instruction (step S160). If the instruction is not a JAL instruction or a load instruction, step S160 is repeatedly executed for the next instruction read into the instruction register 120.

  If a JAL instruction is detected, the process returns to step S110.

  When the load instruction is detected by the load / store / JAL instruction detection circuit 410, the access address specified by the load instruction output to the signal line 111 by the CPU control circuit 110 is input to the control circuit 420. Then, the control circuit 420 stores the address in the storage address register 440 via the signal line 422. The access address specified by the load instruction is output from the CPU control circuit 110 and input to the bus interface unit 140 via the address bus 111. Further, read access is performed from the bus interface unit 140 to the external memory 200 via the memory address bus 301. The return address read from the external memory 200 is input to the bus interface unit 140 via the memory data bus 302, and is input from the bus interface unit 140 to the control circuit 420 via the data bus 131. Then, the control circuit 420 stores the return address in the return address register 450 via the signal line 423. Then, the CAM memory 500 is accessed using the access address stored in the storage address register 440 as a tag (step S170).

  If the entry with the access address stored in the storage address register 440 as a tag does not exist (does not hit) in the CAM memory 500, the process returns to step S160.

  If an entry with the access address stored in the storage address register 440 as a tag is present (hit) in the CAM memory 500, the control circuit 420 is notified via the signal line 502 that the CAM memory 500 has been hit. . The control circuit 420 inputs the return address of the return address register 450 and the return address read from the CAM memory 500 to the comparison circuit 510 via the signal line 452 and the signal line 501, respectively, and compares them by the comparison circuit 510. (Step S180).

  When the comparison results of the comparison circuit 510 match, it can be determined that the return address to the caller of the procedure X stored in the stack area is not rewritten, and the call processing of the procedure X is normally completed. Then, the control circuit 420 that inputs the comparison result 511 output from the comparison circuit 510 performs a process of invalidating the entry with the access address stored in the storage address register 440 as a tag, and matches with the CAM memory 500. The entry is deleted (step S190). In the entry deletion step S190 in the CAM memory 500, when there are no more entries in the CAM memory 500, the CAM memory 500 notifies the control circuit 420 that it is in the entry EMPTY state (E) through the signal line 502.

  The control circuit 420 notifies the interrupt of the entry EMPTY to the CPU control circuit 110 via the signal line 424. When receiving the interrupt notification, the CPU control circuit 110 activates the interrupt program of the entry EMPTY and checks whether there is an entry saved in the external memory 200. If there is no entry, the interrupt is terminated. If there is an entry, the entry is read from the external memory 200, the entry is written in the CAM memory 500, the interrupt program is terminated, and the processor unit is interrupted. Restart the process.

  Next, it is checked whether the number of valid entries stored in the CAM memory 500 is “0” (step S200). When the number of entries is not “0”, the process returns to step S160, and when the number of entries is “0”, the process returns to step S100.

  In step S180, if the comparison result in the comparison circuit 510 does not match, the control circuit 420 that receives the comparison result 511 output from the comparison circuit 510 indicates that the return address stored in the stack area has been rewritten. Performs a buffer overflow detection interrupt to the CPU control circuit 110 via the signal line 424 (step S210).

  As described above, the buffer overflow detection circuit 400 operates, and when the return address to the caller is stored in the stack area by the called procedure program, the return address is written and stored in the CAM memory 500 as well.

  The access to the return address in the CAM memory 500 is performed in parallel with the access to the return address performed at the time of calling the procedure and returning to the caller as described above in accordance with the control procedure incorporated in the buffer overflow detection circuit 400. Therefore, the return address cannot be modified by a program that performs an operation such as a stack buffer overflow by a malicious program or the like. Since the return address in the CAM memory 500 is protected in this way, the return address stored in the stack area in advance is compared with the return address stored in the CAM memory 500 when returning to the calling procedure. Thus, buffer overflow can be detected.

  In this series of processing, software (program) processing executed by the processor only for saving the entries in the CAM memory 500 to the external memory 200 and restoring (returning) the entries in the external memory 200 to the CAM memory 500. However, by optimizing the number of entries in the CAM memory 500, software support can be minimized, and buffer overflow can be performed faster than detection methods using software programs such as guard variables. Can be detected.

  In addition, since entries in the CAM memory 500 can be saved and restored to an external memory having a large capacity, 100% buffer overflow detection can be realized. Furthermore, since it is not necessary to change the program part related to the target stack operation, recompilation and redesign work can be reduced.

  The present invention is not limited to the above-described embodiments, and it is needless to say that various modifications can be made without departing from the spirit of the invention.

  For example, a CAM memory that stores a pair (entry) of a storage address and a return address (return address) can be a LIFO memory that operates as a LIFO (Last-In First-Out), and a store instruction is detected and its source When the register number of the register matches the register number stored in the RR 430, a set of the storage address of the access address of the store instruction and the return address of the storage data is stored in the LIFO memory. Then, when the load instruction is detected and the access address matches the storage address stored in the LIFO memory, it is checked whether the data read by the load instruction matches the return address stored in the LIFO memory, When there is a mismatch, it can be detected that a buffer overflow has occurred. Although it is necessary to add a circuit for comparing the output from the storage address register 440 and the storage address storage unit of the LIFO memory, it is possible to use a LIFO memory having a simpler memory configuration than the CAM memory.

The block diagram which shows the structure of the Example of the microprocessor which concerns on this invention. The flowchart figure which shows the main control procedures of the buffer overflow detection circuit of a present Example. A list of source programs for the main and keisan functions. A list of assembly code for the keisan function. List of assembly code for the main function (continued). A table showing conventions for the intended use of registers in the MIPS architecture processor. The figure which shows the use condition of a stack area at the time of a procedure call and return operation | movement to a caller. The figure which shows the mode of generation | occurrence | production of stack smashing by buffer overflow operation.

Explanation of symbols

1 Computer System 100 Microprocessor 110 CPU Control Circuit 111 Address Bus 120 Instruction Register 130 Register File 131 Data Bus 140 Bus Interface Unit 200 External Memory 300 External Bus 301 External Address Bus 302 External Data Bus 400 Buffer Overflow Detection Circuit 410 Load Store Store JAL instruction detection circuit 420 Control circuit 430 RR register 440 Storage address register 450 Return address register 500 CAM memory 510 Comparison circuit

Claims (5)

A microprocessor that has a procedure call branch instruction and can store the return address to the caller in memory,
Storage detection means for detecting a storage operation for storing the return address to the caller in the memory;
A storage unit different from the memory for storing a return address in the storage operation detected by the storage detection unit and a storage address for storing the return address;
Read detection means for detecting a read operation from the storage address of the memory;
When a read operation is detected by the read detection means, the return address read from the memory is compared with the return address read from the storage means, and a buffer overflow occurs when the comparison contents do not match. A microprocessor having a buffer overflow detecting means for detecting.   2. The microprocessor according to claim 1, wherein the storage means is constituted by a CAM memory that stores, as an entry, a set in which the storage address is a tag and the return address is data.   The save detection means is a store instruction that saves the contents of a register in a memory after execution of a procedure call branch instruction, and the contents of a register that stores a return address to the caller in the procedure call branch instruction is saved in the memory. The microprocessor according to claim 1, wherein:   The read detection means detects that the read address of the load instruction for reading data from the memory to the register matches the save address stored in the storage means after the return address and the save address are stored in the storage means. The microprocessor according to claim 1. A microprocessor that has a procedure call branch instruction and can store the return address to the caller in memory,
Register identification information storage means for storing register identification information for storing a return address to the caller when a procedure call branch instruction is executed;
When the data stored in the register identified by the register identification information stored in the register identification information storage means is stored in the memory when the store instruction is executed after the procedure call branch instruction is executed Storage means different from the memory for simultaneously storing the storage address and the storage data;
After the store instruction is executed, when the load instruction is executed, the data read from the memory from the storage address of the storage means is compared with the stored data simultaneously stored in the storage means, And a buffer overflow detecting means for detecting that a buffer overflow has occurred when the comparison contents do not match.

Images