https://gcc.gnu.org/bugzilla/show_bug.cgi?id=128367
Bug ID: 128367
Summary: i386: split_stack_return emits bare ret without int3
barrier under -mharden-sls=return -fsplit-stack
Product: gcc
Version: 16.2.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: target
Assignee: unassigned at gcc dot gnu.org
Reporter: 220245569 at seu dot edu.cn
CC: 220255623 at seu dot edu.cn, jianhao.xu at seu dot edu.cn
Target Milestone: ---
Target: x86_64-*-* i?86-*-*
Reproducer
----------
$ cat trigger.c
extern void sink (int);
int
split_stack_probe (int n)
{
volatile char big[4096];
for (int i = 0; i < 4096; i++)
big[i] = (char) (n + i);
sink (big[n & 4095]);
return big[0] + big[4095];
}
Compile flag: x86_64-linux-gnu-gcc -O2 -fsplit-stack -mharden-sls=return
-fno-pic -S trigger.c
split_stack_probe:
...
addq $4104, %rsp
addl %edx, %eax
ret
int3 # normal return: hardened with int3
.L7:
movl $4104, %r10d
xorl %r11d, %r11d
call __morestack
ret # split_stack_return: bare ret, no int3
jmp .L4
Root cause
----------
ix86_output_function_return (gcc/config/i386/i386.cc:17713) and
output_indirect_thunk (i386.cc:6333) append int3 after ret when
ix86_harden_sls & harden_sls_return is active, but the split_stack_return
define_insn (gcc/config/i386/i386.md:21319-21328) returns literal "ret" or
"ret\t%0" without checking ix86_harden_sls.
Suggested Fix
-------------
In split_stack_return (gcc/config/i386/i386.md:21323-21328), append "\n\tint3"
when ix86_harden_sls & harden_sls_return is non-zero.
