From patchwork Thu Apr 9 14:19:50 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Szabolcs Nagy X-Patchwork-Id: 1268625 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=gcc.gnu.org (client-ip=8.43.85.97; helo=sourceware.org; envelope-from=gcc-patches-bounces@gcc.gnu.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=arm.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=armh.onmicrosoft.com header.i=@armh.onmicrosoft.com header.a=rsa-sha256 header.s=selector2-armh-onmicrosoft-com header.b=wHpVy78+; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.i=@armh.onmicrosoft.com header.a=rsa-sha256 header.s=selector2-armh-onmicrosoft-com header.b=wHpVy78+; dkim-atps=neutral Received: from sourceware.org (server2.sourceware.org [8.43.85.97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 48yjwS74bRz9sSv for ; Fri, 10 Apr 2020 00:20:22 +1000 (AEST) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id F3F7A385BF81; Thu, 9 Apr 2020 14:20:18 +0000 (GMT) X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from EUR05-VI1-obe.outbound.protection.outlook.com (mail-vi1eur05on2083.outbound.protection.outlook.com [40.107.21.83]) by sourceware.org (Postfix) with ESMTPS id 4C67D385B835 for ; Thu, 9 Apr 2020 14:20:02 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 4C67D385B835 Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=arm.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=Szabolcs.Nagy@arm.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DkHg9qjLt0cdj9/y83wBMk0icmF6oN/eDzga8m5iLqY=; b=wHpVy78+XOdHO0KmLJLfL3MdLDecGtLcSG+7P4Gz/KENwhQtfAAGhwMgiEbki25ZEd1CtF2SgnylazPPILHrBEV0/a7dvbKm65WrckqFI5eU65xYwvVfZK0kE5B1ZlDgGK1Vv9OymRmQmxMaMvnoqKMLQ5aZeCM3F1Z5+b4nMik= Received: from VI1P193CA0004.EURP193.PROD.OUTLOOK.COM (2603:10a6:800:bd::14) by DB7PR08MB3771.eurprd08.prod.outlook.com (2603:10a6:10:32::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2900.15; Thu, 9 Apr 2020 14:20:00 +0000 Received: from VE1EUR03FT037.eop-EUR03.prod.protection.outlook.com (2603:10a6:800:bd:cafe::ad) by VI1P193CA0004.outlook.office365.com (2603:10a6:800:bd::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2900.15 via Frontend Transport; Thu, 9 Apr 2020 14:20:00 +0000 Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; gcc.gnu.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com; gcc.gnu.org; dmarc=bestguesspass action=none header.from=arm.com; Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com; Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by VE1EUR03FT037.mail.protection.outlook.com (10.152.19.70) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2900.18 via Frontend Transport; Thu, 9 Apr 2020 14:20:00 +0000 Received: ("Tessian outbound e2c88df8bbbe:v50"); Thu, 09 Apr 2020 14:20:00 +0000 X-CheckRecipientChecked: true X-CR-MTA-CID: bfc2065c845b739d X-CR-MTA-TID: 64aa7808 Received: from f16f69ddae45.2 by 64aa7808-outbound-1.mta.getcheckrecipient.com id 16DF4B1B-1984-41CA-8F33-A3875A27678E.1; Thu, 09 Apr 2020 14:19:54 +0000 Received: from EUR04-VI1-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id f16f69ddae45.2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Thu, 09 Apr 2020 14:19:54 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=e7PaHOw0g/cDtsdD8VzHRdGEHX1c1aEeM9yUf7dJMigniqu1SXte7jFVmL5907TywQXLNT0bGVBYIr3cC4ZQ/tsBbwdbDHmV8mmPDJ8jmoWRVBiczcIjOQ+8uMpzI0c6CHehE8snIDOA0KvRImdOp6FPfHfZFKJKjUj0FbAZX/Ka4l/SbOaJLFTmVSW0i2/3o0YC/3bJf8TRRn0FstjQvM0opvCjpVin3us4oZ7TsRFB2oxWbZfiOxlyr+KnyoItYaD4JnruKjYLyTGnCxjCIyvrTj/YnErYQWmcFzrZRRnedCBpg0Xl5Fj45VoR2kWcYum+E6Omw/vpUXd2TPflVA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DkHg9qjLt0cdj9/y83wBMk0icmF6oN/eDzga8m5iLqY=; b=SY+B3niQVvwe9/amQkOSuiRVWU9pfCo2JCftgW9jK3UTjFt7sXFjucgr9St+EVoL4EDgD35ifKhXVFer7UYzzhcEX4qLEb7koPRszE+SLiGsRe1ZQg5zmzpVbuJQqJRGvf7qOQU/5+DgFO78TA2nk/GLMTT6TMWI/EcawbC0ewBP8Yrl1osGJzgxr8rzateeLUPyUcvjMfHYrUegqkroJghoF9mNPAFcw+HxrXTiurxUR+adIIpF1+KuxY9eyvDiVmRVj+jTvlqqx/JYNQSyX81xnyXF/TQvKz/6Yl++rWyk1h+p8td7Gz13A0D80uoJPrsgQNC1Dm5NRdKXTdyI6g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DkHg9qjLt0cdj9/y83wBMk0icmF6oN/eDzga8m5iLqY=; b=wHpVy78+XOdHO0KmLJLfL3MdLDecGtLcSG+7P4Gz/KENwhQtfAAGhwMgiEbki25ZEd1CtF2SgnylazPPILHrBEV0/a7dvbKm65WrckqFI5eU65xYwvVfZK0kE5B1ZlDgGK1Vv9OymRmQmxMaMvnoqKMLQ5aZeCM3F1Z5+b4nMik= Authentication-Results-Original: spf=none (sender IP is ) smtp.mailfrom=Szabolcs.Nagy@arm.com; Received: from AM6PR08MB3047.eurprd08.prod.outlook.com (2603:10a6:209:4c::23) by AM6PR08MB4279.eurprd08.prod.outlook.com (2603:10a6:20b:bb::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2878.16; Thu, 9 Apr 2020 14:19:51 +0000 Received: from AM6PR08MB3047.eurprd08.prod.outlook.com ([fe80::49fd:6ded:4da7:8862]) by AM6PR08MB3047.eurprd08.prod.outlook.com ([fe80::49fd:6ded:4da7:8862%7]) with mapi id 15.20.2900.015; Thu, 9 Apr 2020 14:19:51 +0000 Date: Thu, 9 Apr 2020 15:19:50 +0100 From: Szabolcs Nagy To: gcc-patches@gcc.gnu.org Subject: [PATCH] aarch64, libgcc: Fix unwinding from pac-ret to normal frames [PR94514] Message-ID: <20200409141948.GF987@arm.com> Content-Disposition: inline User-Agent: Mutt/1.9.4 (2018-02-28) X-ClientProxiedBy: LNXP265CA0036.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:5c::24) To AM6PR08MB3047.eurprd08.prod.outlook.com (2603:10a6:209:4c::23) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from arm.com (217.140.106.55) by LNXP265CA0036.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:5c::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2900.17 via Frontend Transport; Thu, 9 Apr 2020 14:19:51 +0000 X-Originating-IP: [217.140.106.55] X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: 38ef417b-910f-4014-c447-08d7dc911699 X-MS-TrafficTypeDiagnostic: AM6PR08MB4279:|AM6PR08MB4279:|DB7PR08MB3771: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true NoDisclaimer: true X-MS-Oob-TLC-OOBClassifiers: OLM:454;OLM:454; X-Forefront-PRVS: 0368E78B5B X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM6PR08MB3047.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(10009020)(4636009)(39860400002)(136003)(396003)(366004)(346002)(376002)(5660300002)(44832011)(54906003)(36756003)(1076003)(2616005)(478600001)(316002)(86362001)(33656002)(81166007)(4326008)(66946007)(2906002)(6916009)(8676002)(52116002)(26005)(8886007)(55016002)(186003)(16526019)(66556008)(956004)(8936002)(81156014)(66476007)(7696005); DIR:OUT; SFP:1101; Received-SPF: None (protection.outlook.com: arm.com does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Untrusted: BCL:0; X-Microsoft-Antispam-Message-Info-Original: NxnVkYjMnps7mgOYwDF0XH7Yvpif4quASPi8lsVXjklYs0q/T0Njmw36JTeZ/nX4URo4xrzpnpBHdXfTwfi+OTTTiGSkEYhIQzKijVKHQ+OQ8VQvpFMxAZdMMzDWC9sQVte8PqmHVOh+3s5Q/aAEGAG4T9DYjjMQkgfsyHvWTq8w1o1hDD18vAI5CvnFpmYeln2uM+DqRLF2z9MyFU94jN4apj1mgTy7dzur2iL08y++NU44o9tQIGdzQBRtdCmcaHopFU8kdeTKmO7OHuT0jYVgPMsyQqCzZMnxgOVJvXuyur/ixRcFp3RutXiMh0fVqMK+g9HceuDqHjV1vbEoHAlsSlucnPE4AvPGMxhxRgFvrGbYNRr3VfHDnA3Eh+p4NfVKTjOiloSXzgP5L9JzMu9IuMdaAsajp4FmJm4miX3qHmuTLnaFm2ThXt12NVHQ X-MS-Exchange-AntiSpam-MessageData: mJfDAR00yekhTJz6LQPi/ZLmqFMbgD43biEMJkKC+37mNZyODHbf0aMP5HbdRQ7UnsgX1/+W2MAOlw+L/PgGDJW0h2zoBMgxmOH3sI5seEl3DdY8mPnVjO8XV/aCHR0jqqV6h919oJ835L4UsslJuA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6PR08MB4279 Original-Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Szabolcs.Nagy@arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: VE1EUR03FT037.eop-EUR03.prod.protection.outlook.com X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFTY:; SFS:(10009020)(4636009)(39860400002)(376002)(346002)(396003)(136003)(46966005)(336012)(55016002)(956004)(16526019)(8676002)(70586007)(8936002)(26005)(70206006)(186003)(81156014)(4326008)(82740400003)(7696005)(2616005)(47076004)(5660300002)(86362001)(478600001)(26826003)(8886007)(6916009)(44832011)(36906005)(316002)(54906003)(2906002)(1076003)(36756003)(356004)(33656002)(81166007); DIR:OUT; SFP:1101; X-MS-Office365-Filtering-Correlation-Id-Prvs: 3d5fc690-ed69-4907-f38e-08d7dc91116c X-Forefront-PRVS: 0368E78B5B X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: hNBrAIrZ7RS+v9eh6r75epitA1vxnMDRQtqNPBrOhpjAzU/SqEaC//vMXU+t1KJm6JNfqq/iOFxfGJ5KJcrV4vvbRPdfUCFsobDGtjQsOXN5QrWzJ5kk+0ABwvqcFLTU4IbfArQ/e1fVlwUWROVk1bEB3jcXpOJz3CG1j3u2u5g6vhoGwLjPPz0qYjvE40iyEvlJu7n3nIlmuS8IXv/20jm0NpEfVnQ6Y0L8hRaWx/AHIh1HMXLYcEEKA4gt/661I33tXV4Hjt1w82Qz9npZj039Dr3ilfGsOO0qA1+ISmt2iH6VXdqy+yXVLZpM7UjnuLbyWalD5TM93bUUZRTH8KuzVTexMElqD63az7p8Wi6wh2MJHmBzUq75O5y3t/o7eH2mAAV9M+dVmYzMzD9mjjRYhRYvtVqXMEdI/brSoAKMOC5y2ClXAziuAES+hGhNzEVtNml+KcwtQhHEgmKKMwNPGeR50bOdpnAnsNrHqCOMrdm8MBdADFkN0dvV+8PYcaIOGpN8nJMXY32ZoKMrKg== X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Apr 2020 14:20:00.2678 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 38ef417b-910f-4014-c447-08d7dc911699 X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB7PR08MB3771 X-Spam-Status: No, score=-27.6 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, MSGID_FROM_MTA_HEADER, RCVD_IN_DNSWL_NONE, SPF_HELO_PASS, SPF_PASS, TXREP, UNPARSEABLE_RELAY autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Richard Earnshaw Errors-To: gcc-patches-bounces@gcc.gnu.org Sender: "Gcc-patches" With -mbranch-protection=pac-ret the debug info toggles the signedness state of the return address so the unwinder knows when the return address needs pointer authentication. The unwind context flags were not updated according to the dwarf frame info. This causes unwinding across frames that were built without pac-ret to incorrectly authenticate the return address wich corrupts the return address on a system where PAuth is enabled. Note: This even affects systems where all code use pac-ret because unwinding across a signal frame the return address is not signed. gcc/testsuite/ChangeLog: 2020-04-XX Szabolcs Nagy PR target/94514 * g++.target/aarch64/pr94514.C: New test. * gcc.target/aarch64/pr94514.c: New test. libgcc/ChangeLog: 2020-04-XX Szabolcs Nagy PR target/94514 * config/aarch64/aarch64-unwind.h (aarch64_frob_update_context): Update context->flags accroding to the frame state. --- gcc/testsuite/g++.target/aarch64/pr94514.C | 26 ++++++++ gcc/testsuite/gcc.target/aarch64/pr94514.c | 76 ++++++++++++++++++++++ libgcc/config/aarch64/aarch64-unwind.h | 2 + 3 files changed, 104 insertions(+) create mode 100644 gcc/testsuite/g++.target/aarch64/pr94514.C create mode 100644 gcc/testsuite/gcc.target/aarch64/pr94514.c diff --git a/gcc/testsuite/g++.target/aarch64/pr94514.C b/gcc/testsuite/g++.target/aarch64/pr94514.C new file mode 100644 index 00000000000..2a8c949ba30 --- /dev/null +++ b/gcc/testsuite/g++.target/aarch64/pr94514.C @@ -0,0 +1,26 @@ +/* PR target/94514. Unwind across mixed pac-ret and non-pac-ret frames. */ +/* { dg-do run } */ + +__attribute__((noinline, target("branch-protection=pac-ret"))) +static void do_throw (void) +{ + throw 42; + __builtin_abort (); +} + +__attribute__((noinline, target("branch-protection=none"))) +static void no_pac_ret (void) +{ + do_throw (); + __builtin_abort (); +} + +int main () +{ + try { + no_pac_ret (); + } catch (...) { + return 0; + } + __builtin_abort (); +} diff --git a/gcc/testsuite/gcc.target/aarch64/pr94514.c b/gcc/testsuite/gcc.target/aarch64/pr94514.c new file mode 100644 index 00000000000..bbbf5a6b0b3 --- /dev/null +++ b/gcc/testsuite/gcc.target/aarch64/pr94514.c @@ -0,0 +1,76 @@ +/* PR target/94514. Unwind across mixed pac-ret and non-pac-ret frames. */ +/* { dg-do run } */ +/* { dg-options "-fexceptions -O2" } */ + +#include +#include +#include + +#define die() \ + do { \ + printf ("%s:%d: reached unexpectedly.\n", __FILE__, __LINE__); \ + fflush (stdout); \ + abort (); \ + } while (0) + +static struct _Unwind_Exception exc; + +static _Unwind_Reason_Code +force_unwind_stop (int version, _Unwind_Action actions, + _Unwind_Exception_Class exc_class, + struct _Unwind_Exception *exc_obj, + struct _Unwind_Context *context, + void *stop_parameter) +{ + printf ("%s: CFA: %p PC: %p actions: %d\n", + __func__, + (void *)_Unwind_GetCFA (context), + (void *)_Unwind_GetIP (context), + (int)actions); + if (actions & _UA_END_OF_STACK) + die (); + return _URC_NO_REASON; +} + +static void force_unwind (void) +{ +#ifndef __USING_SJLJ_EXCEPTIONS__ + _Unwind_ForcedUnwind (&exc, force_unwind_stop, 0); +#else + _Unwind_SjLj_ForcedUnwind (&exc, force_unwind_stop, 0); +#endif +} + +__attribute__((noinline, target("branch-protection=pac-ret"))) +static void f2_pac_ret (void) +{ + force_unwind (); + die (); +} + +__attribute__((noinline, target("branch-protection=none"))) +static void f1_no_pac_ret (void) +{ + f2_pac_ret (); + die (); +} + +__attribute__((noinline, target("branch-protection=pac-ret"))) +static void f0_pac_ret (void) +{ + f1_no_pac_ret (); + die (); +} + +static void cleanup_handler (void *p) +{ + printf ("%s: Success.\n", __func__); + exit (0); +} + +int main () +{ + char dummy __attribute__((cleanup (cleanup_handler))); + f0_pac_ret (); + die (); +} diff --git a/libgcc/config/aarch64/aarch64-unwind.h b/libgcc/config/aarch64/aarch64-unwind.h index 4c8790bae67..ed84a96db41 100644 --- a/libgcc/config/aarch64/aarch64-unwind.h +++ b/libgcc/config/aarch64/aarch64-unwind.h @@ -104,6 +104,8 @@ aarch64_frob_update_context (struct _Unwind_Context *context, if (fs->regs.reg[DWARF_REGNUM_AARCH64_RA_STATE].loc.offset & 0x1) /* The flag is used for re-authenticating EH handler's address. */ context->flags |= RA_SIGNED_BIT; + else + context->flags &= ~RA_SIGNED_BIT; return; }