aarch64, libgcc: Fix unwinding from pac-ret to normal frames [PR94514]

With -mbranch-protection=pac-ret the debug info toggles the
signedness state of the return address so the unwinder knows when
the return address needs pointer authentication.

The unwind context flags were not updated according to the dwarf
frame info.

This causes unwinding across frames that were built without pac-ret
to incorrectly authenticate the return address wich corrupts the
return address on a system where PAuth is enabled.

Note: This even affects systems where all code use pac-ret because
unwinding across a signal frame the return address is not signed.

gcc/testsuite/ChangeLog:

	Backport from mainline.
	2020-04-23  Szabolcs Nagy  <szabolcs.nagy@arm.com>

	PR target/94514
	* g++.target/aarch64/pr94514.C: Require lp64.
	* gcc.target/aarch64/pr94514.c: Likewise.

	Backport from mainline.
	2020-04-21  Szabolcs Nagy  <szabolcs.nagy@arm.com>

	PR target/94514
	* g++.target/aarch64/pr94514.C: New test.
	* gcc.target/aarch64/pr94514.c: New test.

libgcc/ChangeLog:

	Backport from mainline.
	2020-04-21  Szabolcs Nagy  <szabolcs.nagy@arm.com>

	PR target/94514
	* config/aarch64/aarch64-unwind.h (aarch64_frob_update_context):
	Update context->flags accroding to the frame state.

diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog
index a3dd9c9d090ebd83acf3622be5e460650de65033..847b998e8dab33d849087a6209a323660ba580df 100644 (file)
--- a/gcc/testsuite/ChangeLog
+++ b/gcc/testsuite/ChangeLog
@@ -1,3 +1,19 @@
+2020-05-14  Szabolcs Nagy  <szabolcs.nagy@arm.com>
+
+       Backport from mainline.
+       2020-04-23  Szabolcs Nagy  <szabolcs.nagy@arm.com>
+
+       PR target/94514
+       * g++.target/aarch64/pr94514.C: Require lp64.
+       * gcc.target/aarch64/pr94514.c: Likewise.
+
+       Backport from mainline.
+       2020-04-21  Szabolcs Nagy  <szabolcs.nagy@arm.com>
+
+       PR target/94514
+       * g++.target/aarch64/pr94514.C: New test.
+       * gcc.target/aarch64/pr94514.c: New test.
+
 2020-05-13  Mark Eggleston  <markeggleston@gcc.gnu.org>
 
        Backported from master

diff --git a/gcc/testsuite/g++.target/aarch64/pr94514.C b/gcc/testsuite/g++.target/aarch64/pr94514.C
new file mode 100644 (file)
index 0000000..ae925ca
--- /dev/null
+++ b/gcc/testsuite/g++.target/aarch64/pr94514.C
@@ -0,0 +1,27 @@
+/* PR target/94514. Unwind across mixed pac-ret and non-pac-ret frames.  */
+/* { dg-do run } */
+/* { dg-require-effective-target lp64 } */
+
+__attribute__((noinline, target("branch-protection=pac-ret")))
+static void do_throw (void)
+{
+  throw 42;
+  __builtin_abort ();
+}
+
+__attribute__((noinline, target("branch-protection=none")))
+static void no_pac_ret (void)
+{
+  do_throw ();
+  __builtin_abort ();
+}
+
+int main ()
+{
+  try {
+    no_pac_ret ();
+  } catch (...) {
+    return 0;
+  }
+  __builtin_abort ();
+}

diff --git a/gcc/testsuite/gcc.target/aarch64/pr94514.c b/gcc/testsuite/gcc.target/aarch64/pr94514.c
new file mode 100644 (file)
index 0000000..cbc9404
--- /dev/null
+++ b/gcc/testsuite/gcc.target/aarch64/pr94514.c
@@ -0,0 +1,77 @@
+/* PR target/94514. Unwind across mixed pac-ret and non-pac-ret frames.  */
+/* { dg-do run } */
+/* { dg-require-effective-target lp64 } */
+/* { dg-options "-fexceptions -O2" } */
+
+#include <unwind.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+#define die() \
+  do { \
+    printf ("%s:%d: reached unexpectedly.\n", __FILE__, __LINE__); \
+    fflush (stdout); \
+    abort (); \
+  } while (0)
+
+static struct _Unwind_Exception exc;
+
+static _Unwind_Reason_Code
+force_unwind_stop (int version, _Unwind_Action actions,
+                   _Unwind_Exception_Class exc_class,
+                   struct _Unwind_Exception *exc_obj,
+                   struct _Unwind_Context *context,
+                   void *stop_parameter)
+{
+  printf ("%s: CFA: %p PC: %p actions: %d\n",
+         __func__,
+         (void *)_Unwind_GetCFA (context),
+         (void *)_Unwind_GetIP (context),
+         (int)actions);
+  if (actions & _UA_END_OF_STACK)
+    die ();
+  return _URC_NO_REASON;
+}
+
+static void force_unwind (void)
+{
+#ifndef __USING_SJLJ_EXCEPTIONS__
+  _Unwind_ForcedUnwind (&exc, force_unwind_stop, 0);
+#else
+  _Unwind_SjLj_ForcedUnwind (&exc, force_unwind_stop, 0);
+#endif
+}
+
+__attribute__((noinline, target("branch-protection=pac-ret")))
+static void f2_pac_ret (void)
+{
+  force_unwind ();
+  die ();
+}
+
+__attribute__((noinline, target("branch-protection=none")))
+static void f1_no_pac_ret (void)
+{
+  f2_pac_ret ();
+  die ();
+}
+
+__attribute__((noinline, target("branch-protection=pac-ret")))
+static void f0_pac_ret (void)
+{
+  f1_no_pac_ret ();
+  die ();
+}
+
+static void cleanup_handler (void *p)
+{
+  printf ("%s: Success.\n", __func__);
+  exit (0);
+}
+
+int main ()
+{
+  char dummy __attribute__((cleanup (cleanup_handler)));
+  f0_pac_ret ();
+  die ();
+}

diff --git a/libgcc/ChangeLog b/libgcc/ChangeLog
index 74d3b8599c4e2302eecd5b28f6b56f18a7f48aa6..5554dca9c6050c2dd054147cc476848f8d2a39a1 100644 (file)
--- a/libgcc/ChangeLog
+++ b/libgcc/ChangeLog
@@ -1,3 +1,12 @@
+2020-05-14  Szabolcs Nagy  <szabolcs.nagy@arm.com>
+
+       Backport from mainline.
+       2020-04-21  Szabolcs Nagy  <szabolcs.nagy@arm.com>
+
+       PR target/94514
+       * config/aarch64/aarch64-unwind.h (aarch64_frob_update_context):
+       Update context->flags accroding to the frame state.
+
 2020-04-22  Andre Vieira  <andre.simoesdiasvieira@arm.com>
 
        Backport from mainline.

diff --git a/libgcc/config/aarch64/aarch64-unwind.h b/libgcc/config/aarch64/aarch64-unwind.h
index 223ac9157f1e33f711c93c54d8d9b7a4cce00206..c936befaeae4ea3df3e1ccad4063d209dbe729df 100644 (file)
--- a/libgcc/config/aarch64/aarch64-unwind.h
+++ b/libgcc/config/aarch64/aarch64-unwind.h
@@ -80,6 +80,8 @@ aarch64_frob_update_context (struct _Unwind_Context *context,
   if (fs->regs.reg[DWARF_REGNUM_AARCH64_RA_STATE].loc.offset & 0x1)
     /* The flag is used for re-authenticating EH handler's address.  */
     context->flags |= RA_A_SIGNED_BIT;
+  else
+    context->flags &= ~RA_A_SIGNED_BIT;
 
   return;
 }