From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
 id 4CFB83984054; Tue, 17 Nov 2020 18:17:14 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 4CFB83984054
From: "cvs-commit at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug target/96191] aarch64 stack_protect_test canary leak
Date: Tue, 17 Nov 2020 18:17:14 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: target
X-Bugzilla-Version: 11.0
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: cvs-commit at gcc dot gnu.org
X-Bugzilla-Status: ASSIGNED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: rsandifo at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-96191-4-tgP9yDYJaP@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-96191-4@http.gcc.gnu.org/bugzilla/>
References: <bug-96191-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: gcc-bugs@gcc.gnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Gcc-bugs mailing list <gcc-bugs.gcc.gnu.org>
List-Unsubscribe: <https://gcc.gnu.org/mailman/options/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=unsubscribe>
List-Archive: <https://gcc.gnu.org/pipermail/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-request@gcc.gnu.org?subject=help>
List-Subscribe: <https://gcc.gnu.org/mailman/listinfo/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=subscribe>
X-List-Received-Date: Tue, 17 Nov 2020 18:17:14 -0000

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D96191

--- Comment #10 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-8 branch has been updated by Richard Sandiford
<rsandifo@gcc.gnu.org>:

https://gcc.gnu.org/g:3ee527923b1ce92c6b16c587d072720a6c813c95

commit r8-10627-g3ee527923b1ce92c6b16c587d072720a6c813c95
Author: Richard Sandiford <richard.sandiford@arm.com>
Date:   Tue Nov 17 18:16:45 2020 +0000

    aarch64: Clear canary value after stack_protect_test [PR96191]

    The stack_protect_test patterns were leaving the canary value in the
    temporary register, meaning that it was often still in registers on
    return from the function.  An attacker might therefore have been
    able to use it to defeat stack-smash protection for a later function.

    gcc/
            PR target/96191
            * config/aarch64/aarch64.md (stack_protect_test_<mode>): Set the
            CC register directly, instead of a GPR.  Replace the original G=
PR
            destination with an extra scratch register.  Zero out operand 3
            after use.
            (stack_protect_test): Update accordingly.

    gcc/testsuite/
            PR target/96191
            * gcc.target/aarch64/stack-protector-1.c: New test.
            * gcc.target/aarch64/stack-protector-2.c: Likewise.

    (cherry picked from commit fe1a26429038d7cd17abc53f96a6f3e2639b605f)=