[Bug target/94514] New: aarch64: unwinding across mixed pac-ret and non-pac-ret frames is broken

[Bug target/94514] New: aarch64: unwinding across mixed pac-ret and non-pac-ret frames is broken

[nsz at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94514

            Bug ID: 94514
           Summary: aarch64: unwinding across mixed pac-ret and
                    non-pac-ret frames is broken
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: nsz at gcc dot gnu.org
  Target Milestone: ---

libgcc unwinder on aarch64 fails to keep track of pauth state and may try to
authenticate return addresses that were not signed causing a runtime crash.

example c++ code that segfaults in the unwinder on a pauth enabled system:

__attribute__((noinline, target("branch-protection=pac-ret")))
static void do_throw (void)
{
  throw 42;
  __builtin_abort ();
}

__attribute__((noinline, target("branch-protection=none")))
static void no_pac_ret (void)
{
  do_throw ();
  __builtin_abort ();
}

int main ()
{
  try {
    no_pac_ret ();
  } catch (...) {
    return 0;
  }
  __builtin_abort ();
}

[Bug target/94514] aarch64: unwinding across mixed pac-ret and non-pac-ret frames is broken

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94514

--- Comment #1 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Szabolcs Nagy <nsz@gcc.gnu.org>:

https://gcc.gnu.org/g:fb22faf48f6eb518932f24005f8606e5f19a7304

commit r10-7853-gfb22faf48f6eb518932f24005f8606e5f19a7304
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Fri Apr 3 09:35:41 2020 +0000

    aarch64, libgcc: Fix unwinding from pac-ret to normal frames [PR94514]

    With -mbranch-protection=pac-ret the debug info toggles the
    signedness state of the return address so the unwinder knows when
    the return address needs pointer authentication.

    The unwind context flags were not updated according to the dwarf
    frame info.

    This causes unwinding across frames that were built without pac-ret
    to incorrectly authenticate the return address wich corrupts the
    return address on a system where PAuth is enabled.

    Note: This even affects systems where all code use pac-ret because
    unwinding across a signal frame the return address is not signed.

    gcc/testsuite/ChangeLog:

            PR target/94514
            * g++.target/aarch64/pr94514.C: New test.
            * gcc.target/aarch64/pr94514.c: New test.

    libgcc/ChangeLog:

            PR target/94514
            * config/aarch64/aarch64-unwind.h (aarch64_frob_update_context):
            Update context->flags accroding to the frame state.

[Bug target/94514] aarch64: unwinding across mixed pac-ret and non-pac-ret frames is broken

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94514

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Szabolcs Nagy <nsz@gcc.gnu.org>:

https://gcc.gnu.org/g:744b3e4478df83f54543964b8eb7250eb9bb6d40

commit r10-7911-g744b3e4478df83f54543964b8eb7250eb9bb6d40
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Thu Apr 23 11:26:10 2020 +0100

    aarch64: disable tests on ilp32 [PR94514]

    branch-protection=pac-ret is only supported with lp64 abi.

    gcc/testsuite/ChangeLog:

            PR target/94514
            * g++.target/aarch64/pr94514.C: Require lp64.
            * gcc.target/aarch64/pr94514.c: Likewise.

[Bug target/94514] aarch64: unwinding across mixed pac-ret and non-pac-ret frames is broken

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94514

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-9 branch has been updated by Szabolcs Nagy <nsz@gcc.gnu.org>:

https://gcc.gnu.org/g:6173489dbfe5828b2c4082d7a450a766779f87c7

commit r9-8592-g6173489dbfe5828b2c4082d7a450a766779f87c7
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Fri Apr 3 09:35:41 2020 +0000

    aarch64, libgcc: Fix unwinding from pac-ret to normal frames [PR94514]

    With -mbranch-protection=pac-ret the debug info toggles the
    signedness state of the return address so the unwinder knows when
    the return address needs pointer authentication.

    The unwind context flags were not updated according to the dwarf
    frame info.

    This causes unwinding across frames that were built without pac-ret
    to incorrectly authenticate the return address wich corrupts the
    return address on a system where PAuth is enabled.

    Note: This even affects systems where all code use pac-ret because
    unwinding across a signal frame the return address is not signed.

    gcc/testsuite/ChangeLog:

            Backport from mainline.
            2020-04-23  Szabolcs Nagy  <szabolcs.nagy@arm.com>

            PR target/94514
            * g++.target/aarch64/pr94514.C: Require lp64.
            * gcc.target/aarch64/pr94514.c: Likewise.

            Backport from mainline.
            2020-04-21  Szabolcs Nagy  <szabolcs.nagy@arm.com>

            PR target/94514
            * g++.target/aarch64/pr94514.C: New test.
            * gcc.target/aarch64/pr94514.c: New test.

    libgcc/ChangeLog:

            Backport from mainline.
            2020-04-21  Szabolcs Nagy  <szabolcs.nagy@arm.com>

            PR target/94514
            * config/aarch64/aarch64-unwind.h (aarch64_frob_update_context):
            Update context->flags accroding to the frame state.

[Bug target/94514] aarch64: unwinding across mixed pac-ret and non-pac-ret frames is broken

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94514

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-8 branch has been updated by Szabolcs Nagy <nsz@gcc.gnu.org>:

https://gcc.gnu.org/g:d523cd5109bc5ab42edf85385f6a1085e0d6028c

commit r8-10252-gd523cd5109bc5ab42edf85385f6a1085e0d6028c
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Fri Apr 3 09:35:41 2020 +0000

    aarch64, libgcc: Fix unwinding from pac-ret to normal frames [PR94514]

    With -mbranch-protection=pac-ret the debug info toggles the
    signedness state of the return address so the unwinder knows when
    the return address needs pointer authentication.

    The unwind context flags were not updated according to the dwarf
    frame info.

    This causes unwinding across frames that were built without pac-ret
    to incorrectly authenticate the return address wich corrupts the
    return address on a system where PAuth is enabled.

    Note: This even affects systems where all code use pac-ret because
    unwinding across a signal frame the return address is not signed.

    Changed branch-protection=pac-ret to sign-return-address=all etc
    in the tests for the backport.

    gcc/testsuite/ChangeLog:

            Backport from mainline.
            2020-04-23  Szabolcs Nagy  <szabolcs.nagy@arm.com>

            PR target/94514
            * g++.target/aarch64/pr94514.C: Require lp64.
            * gcc.target/aarch64/pr94514.c: Likewise.

            Backport from mainline.
            2020-04-21  Szabolcs Nagy  <szabolcs.nagy@arm.com>

            PR target/94514
            * g++.target/aarch64/pr94514.C: New test.
            * gcc.target/aarch64/pr94514.c: New test.

    libgcc/ChangeLog:

            Backport from mainline.
            2020-04-21  Szabolcs Nagy  <szabolcs.nagy@arm.com>

            PR target/94514
            * config/aarch64/aarch64-unwind.h (aarch64_frob_update_context):
            Update context->flags accroding to the frame state.

[Bug target/94514] aarch64: unwinding across mixed pac-ret and non-pac-ret frames is broken

[nsz at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94514

nsz at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #5 from nsz at gcc dot gnu.org ---
fixed for gcc-10.1 and on gcc-9 and gcc-8 branches.