From fb22faf48f6eb518932f24005f8606e5f19a7304 Mon Sep 17 00:00:00 2001 From: Szabolcs Nagy Date: Fri, 3 Apr 2020 09:35:41 +0000 Subject: aarch64, libgcc: Fix unwinding from pac-ret to normal frames [PR94514] With -mbranch-protection=pac-ret the debug info toggles the signedness state of the return address so the unwinder knows when the return address needs pointer authentication. The unwind context flags were not updated according to the dwarf frame info. This causes unwinding across frames that were built without pac-ret to incorrectly authenticate the return address wich corrupts the return address on a system where PAuth is enabled. Note: This even affects systems where all code use pac-ret because unwinding across a signal frame the return address is not signed. gcc/testsuite/ChangeLog: PR target/94514 * g++.target/aarch64/pr94514.C: New test. * gcc.target/aarch64/pr94514.c: New test. libgcc/ChangeLog: PR target/94514 * config/aarch64/aarch64-unwind.h (aarch64_frob_update_context): Update context->flags accroding to the frame state. --- libgcc/ChangeLog | 6 ++++++ libgcc/config/aarch64/aarch64-unwind.h | 2 ++ 2 files changed, 8 insertions(+) (limited to 'libgcc') diff --git a/libgcc/ChangeLog b/libgcc/ChangeLog index d66f76f..da419ff 100644 --- a/libgcc/ChangeLog +++ b/libgcc/ChangeLog @@ -1,3 +1,9 @@ +2020-04-21 Szabolcs Nagy + + PR target/94514 + * config/aarch64/aarch64-unwind.h (aarch64_frob_update_context): + Update context->flags accroding to the frame state. + 2020-04-19 Uroš Bizjak * config/i386/sfp-exceptions.c (__sfp_handle_exceptions) [__SSE_MATH__]: diff --git a/libgcc/config/aarch64/aarch64-unwind.h b/libgcc/config/aarch64/aarch64-unwind.h index 4c8790b..ed84a96 100644 --- a/libgcc/config/aarch64/aarch64-unwind.h +++ b/libgcc/config/aarch64/aarch64-unwind.h @@ -104,6 +104,8 @@ aarch64_frob_update_context (struct _Unwind_Context *context, if (fs->regs.reg[DWARF_REGNUM_AARCH64_RA_STATE].loc.offset & 0x1) /* The flag is used for re-authenticating EH handler's address. */ context->flags |= RA_SIGNED_BIT; + else + context->flags &= ~RA_SIGNED_BIT; return; } -- cgit v1.1