aarch64: Fix .cfi_window_save with pac-ret [PR94515]
authorSzabolcs Nagy <szabolcs.nagy@arm.com>
Mon, 27 Apr 2020 08:07:15 +0000 (09:07 +0100)
committerSzabolcs Nagy <szabolcs.nagy@arm.com>
Mon, 27 Apr 2020 08:10:05 +0000 (09:10 +0100)
commitacdf733634745548c0167c40bad80e6140ac2eeb
tree198376008404a5ee3b02575568042ba5aad97020
parent9612a4833d761e3beda083a3e4dc92feba3b01bc
aarch64: Fix .cfi_window_save with pac-ret [PR94515]

On aarch64 -mbranch-protection=pac-ret reuses the dwarf
opcode for window_save to mean "toggle the return address
mangle state", but in the dwarf2cfi internal logic the
state was not updated when an opcode was emitted, the
currently present update logic is only valid for the
original sparc use of window_save so a separate bool is
used on aarch64 to track the state.

This bug can cause the unwinder not to authenticate return
addresses that were signed (or vice versa) which means a
runtime crash on a pauth enabled system.

Currently only aarch64 pac-ret uses REG_CFA_TOGGLE_RA_MANGLE.

This should be backported to gcc-9 and gcc-8 branches.

gcc/ChangeLog:

PR target/94515
* dwarf2cfi.c (struct GTY): Add ra_mangled.
(cfi_row_equal_p): Check ra_mangled.
(dwarf2out_frame_debug_cfa_window_save): Remove the argument,
this only handles the sparc logic now.
(dwarf2out_frame_debug_cfa_toggle_ra_mangle): New function for
the aarch64 specific logic.
(dwarf2out_frame_debug): Update to use the new subroutines.
(change_cfi_row): Check ra_mangled.

gcc/testsuite/ChangeLog:

PR target/94515
* g++.target/aarch64/pr94515-1.C: New test.
* g++.target/aarch64/pr94515-2.C: New test.
gcc/ChangeLog
gcc/dwarf2cfi.c
gcc/testsuite/ChangeLog
gcc/testsuite/g++.target/aarch64/pr94515-1.C [new file with mode: 0644]
gcc/testsuite/g++.target/aarch64/pr94515-2.C [new file with mode: 0644]