https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94515
--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> --- The releases/gcc-8 branch has been updated by Szabolcs Nagy <n...@gcc.gnu.org>: https://gcc.gnu.org/g:62ab8b9114b0bdae508ed76fa9028e0040d35e6b commit r8-10253-g62ab8b9114b0bdae508ed76fa9028e0040d35e6b Author: Szabolcs Nagy <szabolcs.n...@arm.com> Date: Mon Apr 27 09:07:15 2020 +0100 aarch64: Fix .cfi_window_save with pac-ret [PR94515] On aarch64 -mbranch-protection=pac-ret reuses the dwarf opcode for window_save to mean "toggle the return address mangle state", but in the dwarf2cfi internal logic the state was not updated when an opcode was emitted, the currently present update logic is only valid for the original sparc use of window_save so a separate bool is used on aarch64 to track the state. This bug can cause the unwinder not to authenticate return addresses that were signed (or vice versa) which means a runtime crash on a pauth enabled system. Currently only aarch64 pac-ret uses REG_CFA_TOGGLE_RA_MANGLE. This should be backported to gcc-9 and gcc-8 branches. Changed branch-protection=pac-ret to sign-return-address=all etc in the tests for the backport and adjusted the dwarf2cfi.c changes because the sparc change was missing. gcc/ChangeLog: Backport from mainline. 2020-04-27 Szabolcs Nagy <szabolcs.n...@arm.com> PR target/94515 * dwarf2cfi.c (struct GTY): Add ra_mangled. (cfi_row_equal_p): Check ra_mangled. (dwarf2out_frame_debug_cfa_window_save): Remove the argument, this only handles the sparc logic now. (dwarf2out_frame_debug_cfa_toggle_ra_mangle): New function for the aarch64 specific logic. (dwarf2out_frame_debug): Update to use the new subroutines. (change_cfi_row): Check ra_mangled. gcc/testsuite/ChangeLog: Backport from mainline. 2020-04-27 Szabolcs Nagy <szabolcs.n...@arm.com> PR target/94515 * g++.target/aarch64/pr94515-1.C: New test. * g++.target/aarch64/pr94515-2.C: New test.
