| Issue |
184883
|
| Summary |
[PAC][libunwind] Signing oracles in UnwindCursor::getInfoFromFdeCie
|
| Labels |
libunwind
|
| Assignees |
atrosinenko
|
| Reporter |
atrosinenko
|
Five signing oracles are reported for `getInfoFromFdeCie` function from
[`UnwindCursor.hpp`](https://github.com/llvm/llvm-project/blob/24ac5987b482edb33b73f0ebff509e0a520eca1c/libunwind/src/UnwindCursor.hpp#L1735).
They correspond to copying 5 non-signed variables into `__ptrauth`-qualified fields of `_info` struct of type [`unw_proc_info_t`](https://github.com/llvm/llvm-project/blob/24ac5987b482edb33b73f0ebff509e0a520eca1c/libunwind/include/libunwind.h#L193): `start_ip`, `end_ip`, `lsda`, `unwind_info` and `extra`.
Only one value being signed in this function corresponds to an already signed
value being re-signed (assigning `cieInfo.personality` to `_info.handler`).
```cpp
template <typename A, typename R>
bool UnwindCursor<A, R>::getInfoFromFdeCie(
const typename CFI_Parser<A>::FDE_Info &fdeInfo,
const typename CFI_Parser<A>::CIE_Info &cieInfo,
typename R::link_hardened_reg_arg_t pc, uintptr_t dso_base) {
typename CFI_Parser<A>::PrologInfo prolog;
if (CFI_Parser<A>::template parseFDEInstructions<R>(
_addressSpace, fdeInfo, cieInfo, pc, R::getArch(), &prolog)) {
// Save off parsed FDE info
_info.start_ip = fdeInfo.pcStart; // signing oracle
_info.end_ip = fdeInfo.pcEnd; // signing oracle
_info.lsda = fdeInfo.lsda; // signing oracle
_info.handler = cieInfo.personality; // safe re-signing
_info.gp = prolog.spExtraArgSize;
_info.flags = 0;
_info.format = dwarfEncoding();
_info.unwind_info = fdeInfo.fdeStart; // signing oracle
_info.unwind_info_size = static_cast<uint32_t>(fdeInfo.fdeLength);
_info.extra = static_cast<unw_word_t>(dso_base); // signing oracle
return true;
}
return false;
}
```
4 out of 5 fields of `unw_proc_info_t` are assigned from non-protected fields of `CFI_Parser::FDE_Info`. Adding `__ptrauth` qualifiers to these four fields shifts signing oracles from `getInfoFromFdeCie` to other functions (and seems to increase number of such oracles).
![]()
_______________________________________________
llvm-bugs mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-bugs
