Bug 94514 - aarch64: unwinding across mixed pac-ret and non-pac-ret frames is broken
Summary: aarch64: unwinding across mixed pac-ret and non-pac-ret frames is broken
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: target (show other bugs)
Version: 10.0
: P3 normal
Target Milestone: ---
Assignee: nsz
URL:
Keywords: EH
Depends on:
Blocks: 94515
  Show dependency treegraph
 
Reported: 2020-04-07 11:28 UTC by nsz
Modified: 2020-05-14 15:51 UTC (History)
1 user (show)

See Also:
Host:
Target: aarch64*
Build:
Known to work:
Known to fail:
Last reconfirmed:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description nsz 2020-04-07 11:28:36 UTC
libgcc unwinder on aarch64 fails to keep track of pauth state and may try to authenticate return addresses that were not signed causing a runtime crash.

example c++ code that segfaults in the unwinder on a pauth enabled system:

__attribute__((noinline, target("branch-protection=pac-ret")))
static void do_throw (void)
{
  throw 42;
  __builtin_abort ();
}

__attribute__((noinline, target("branch-protection=none")))
static void no_pac_ret (void)
{
  do_throw ();
  __builtin_abort ();
}

int main ()
{
  try {
    no_pac_ret ();
  } catch (...) {
    return 0;
  }
  __builtin_abort ();
}
Comment 1 CVS Commits 2020-04-21 16:50:11 UTC
The master branch has been updated by Szabolcs Nagy <nsz@gcc.gnu.org>:

https://gcc.gnu.org/g:fb22faf48f6eb518932f24005f8606e5f19a7304

commit r10-7853-gfb22faf48f6eb518932f24005f8606e5f19a7304
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Fri Apr 3 09:35:41 2020 +0000

    aarch64, libgcc: Fix unwinding from pac-ret to normal frames [PR94514]
    
    With -mbranch-protection=pac-ret the debug info toggles the
    signedness state of the return address so the unwinder knows when
    the return address needs pointer authentication.
    
    The unwind context flags were not updated according to the dwarf
    frame info.
    
    This causes unwinding across frames that were built without pac-ret
    to incorrectly authenticate the return address wich corrupts the
    return address on a system where PAuth is enabled.
    
    Note: This even affects systems where all code use pac-ret because
    unwinding across a signal frame the return address is not signed.
    
    gcc/testsuite/ChangeLog:
    
            PR target/94514
            * g++.target/aarch64/pr94514.C: New test.
            * gcc.target/aarch64/pr94514.c: New test.
    
    libgcc/ChangeLog:
    
            PR target/94514
            * config/aarch64/aarch64-unwind.h (aarch64_frob_update_context):
            Update context->flags accroding to the frame state.
Comment 2 CVS Commits 2020-04-23 13:18:47 UTC
The master branch has been updated by Szabolcs Nagy <nsz@gcc.gnu.org>:

https://gcc.gnu.org/g:744b3e4478df83f54543964b8eb7250eb9bb6d40

commit r10-7911-g744b3e4478df83f54543964b8eb7250eb9bb6d40
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Thu Apr 23 11:26:10 2020 +0100

    aarch64: disable tests on ilp32 [PR94514]
    
    branch-protection=pac-ret is only supported with lp64 abi.
    
    gcc/testsuite/ChangeLog:
    
            PR target/94514
            * g++.target/aarch64/pr94514.C: Require lp64.
            * gcc.target/aarch64/pr94514.c: Likewise.
Comment 3 CVS Commits 2020-05-14 15:17:46 UTC
The releases/gcc-9 branch has been updated by Szabolcs Nagy <nsz@gcc.gnu.org>:

https://gcc.gnu.org/g:6173489dbfe5828b2c4082d7a450a766779f87c7

commit r9-8592-g6173489dbfe5828b2c4082d7a450a766779f87c7
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Fri Apr 3 09:35:41 2020 +0000

    aarch64, libgcc: Fix unwinding from pac-ret to normal frames [PR94514]
    
    With -mbranch-protection=pac-ret the debug info toggles the
    signedness state of the return address so the unwinder knows when
    the return address needs pointer authentication.
    
    The unwind context flags were not updated according to the dwarf
    frame info.
    
    This causes unwinding across frames that were built without pac-ret
    to incorrectly authenticate the return address wich corrupts the
    return address on a system where PAuth is enabled.
    
    Note: This even affects systems where all code use pac-ret because
    unwinding across a signal frame the return address is not signed.
    
    gcc/testsuite/ChangeLog:
    
            Backport from mainline.
            2020-04-23  Szabolcs Nagy  <szabolcs.nagy@arm.com>
    
            PR target/94514
            * g++.target/aarch64/pr94514.C: Require lp64.
            * gcc.target/aarch64/pr94514.c: Likewise.
    
            Backport from mainline.
            2020-04-21  Szabolcs Nagy  <szabolcs.nagy@arm.com>
    
            PR target/94514
            * g++.target/aarch64/pr94514.C: New test.
            * gcc.target/aarch64/pr94514.c: New test.
    
    libgcc/ChangeLog:
    
            Backport from mainline.
            2020-04-21  Szabolcs Nagy  <szabolcs.nagy@arm.com>
    
            PR target/94514
            * config/aarch64/aarch64-unwind.h (aarch64_frob_update_context):
            Update context->flags accroding to the frame state.
Comment 4 CVS Commits 2020-05-14 15:48:05 UTC
The releases/gcc-8 branch has been updated by Szabolcs Nagy <nsz@gcc.gnu.org>:

https://gcc.gnu.org/g:d523cd5109bc5ab42edf85385f6a1085e0d6028c

commit r8-10252-gd523cd5109bc5ab42edf85385f6a1085e0d6028c
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Fri Apr 3 09:35:41 2020 +0000

    aarch64, libgcc: Fix unwinding from pac-ret to normal frames [PR94514]
    
    With -mbranch-protection=pac-ret the debug info toggles the
    signedness state of the return address so the unwinder knows when
    the return address needs pointer authentication.
    
    The unwind context flags were not updated according to the dwarf
    frame info.
    
    This causes unwinding across frames that were built without pac-ret
    to incorrectly authenticate the return address wich corrupts the
    return address on a system where PAuth is enabled.
    
    Note: This even affects systems where all code use pac-ret because
    unwinding across a signal frame the return address is not signed.
    
    Changed branch-protection=pac-ret to sign-return-address=all etc
    in the tests for the backport.
    
    gcc/testsuite/ChangeLog:
    
            Backport from mainline.
            2020-04-23  Szabolcs Nagy  <szabolcs.nagy@arm.com>
    
            PR target/94514
            * g++.target/aarch64/pr94514.C: Require lp64.
            * gcc.target/aarch64/pr94514.c: Likewise.
    
            Backport from mainline.
            2020-04-21  Szabolcs Nagy  <szabolcs.nagy@arm.com>
    
            PR target/94514
            * g++.target/aarch64/pr94514.C: New test.
            * gcc.target/aarch64/pr94514.c: New test.
    
    libgcc/ChangeLog:
    
            Backport from mainline.
            2020-04-21  Szabolcs Nagy  <szabolcs.nagy@arm.com>
    
            PR target/94514
            * config/aarch64/aarch64-unwind.h (aarch64_frob_update_context):
            Update context->flags accroding to the frame state.
Comment 5 nsz 2020-05-14 15:51:08 UTC
fixed for gcc-10.1 and on gcc-9 and gcc-8 branches.