[Bug middle-end/125049] [loongarch] SSP fallback leaves __stack_chk_guard live in $r12 at `jr $r1`
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=125049 Xi Ruoyao changed: What|Removed |Added Target Milestone|--- |13.5 --- Comment #6 from Xi Ruoyao --- Fixed for trunk. Will backport to all active branches if no complains in a few days.
[Bug middle-end/125049] [loongarch] SSP fallback leaves __stack_chk_guard live in $r12 at `jr $r1`
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=125049
--- Comment #5 from GCC Commits ---
The master branch has been updated by Xi Ruoyao :
https://gcc.gnu.org/g:62fdbd084f7ab04cb7a97d6186ffe70acfc70f1b
commit r17-405-g62fdbd084f7ab04cb7a97d6186ffe70acfc70f1b
Author: Xi Ruoyao
Date: Tue Apr 28 20:32:38 2026 +0800
LoongArch: harden SSP canary set and test routines [PR 125049]
Add the stack_protect_combined_{set,test} expanders to expand the
routines as unsplitable insns which does not leave any sensitive data
(the canary value, the canary address, and all the intermediate values
used materializing the address) in a register. This prevents the
attacker from defeating SSP by probing the canary value from the
register context or overwriting the address spilled onto the stack.
PR target/125049
gcc/
* config/loongarch/predicates.md (ssp_operand): New
define_predicate.
(ssp_normal_operand): New define_predicate.
* config/loongarch/constraints.md (ZE): New define_constraint.
(ZF): New define_constraint.
* config/loongarch/loongarch.md (UNSPEC_SSP): New unspec.
(cbranch4): Add "@" to create gen_cbranch4(machine_mode, ...).
(@stack_protect_combined_set_normal_): New define_insn.
(@stack_protect_combined_set_extreme_): New define_insn.
(@stack_protect_combined_test_internal_): New define_insn.
(stack_protect_combined_set): New define_expand.
(stack_protect_combined_test): New define_expand.
* config/loongarch/loongarch-protos.h
(loongarch_output_asm_load_canary): Declare.
* config/loongarch/loongarch.cc (loongarch_print_operand): Allow
'v' to print d/w for DImode/SImode.
(loongarch_output_asm_load_canary): Implement.
gcc/testsuite/
* gcc.target/loongarch/pr125049.c: New test.
[Bug middle-end/125049] [loongarch] SSP fallback leaves __stack_chk_guard live in $r12 at `jr $r1`
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=125049 --- Comment #4 from Xi Ruoyao --- Patch: https://gcc.gnu.org/pipermail/gcc-patches/2026-April/715333.html
[Bug middle-end/125049] [loongarch] SSP fallback leaves __stack_chk_guard live in $r12 at `jr $r1`
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=125049
--- Comment #3 from JingYao Zhang <220245569 at seu dot edu.cn> ---
(In reply to Xi Ruoyao from comment #2)
> Per PR 85434 it seems more secure to add stack_protect_combined_{set,test}
> as apparently LoongArch backend will CSE stack canary address with the
> normal stack_protect_{set,test} as well.
Yeah (In reply to Xi Ruoyao from comment #2)
> Per PR 85434 it seems more secure to add stack_protect_combined_{set,test}
> as apparently LoongArch backend will CSE stack canary address with the
> normal stack_protect_{set,test} as well.
I agree, spilling also should be fixed.
[Bug middle-end/125049] [loongarch] SSP fallback leaves __stack_chk_guard live in $r12 at `jr $r1`
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=125049
--- Comment #2 from Xi Ruoyao ---
Per PR 85434 it seems more secure to add stack_protect_combined_{set,test} as
apparently LoongArch backend will CSE stack canary address with the normal
stack_protect_{set,test} as well.
[Bug middle-end/125049] [loongarch] SSP fallback leaves __stack_chk_guard live in $r12 at `jr $r1`
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=125049 Xi Ruoyao changed: What|Removed |Added Last reconfirmed||2026-04-28 CC||xry111 at gcc dot gnu.org Ever confirmed|0 |1 Status|UNCONFIRMED |ASSIGNED Assignee|unassigned at gcc dot gnu.org |xry111 at gcc dot gnu.org --- Comment #1 from Xi Ruoyao --- Mine.
