[libunwind] [libunwind][PAC] Defang ptrauth's PC in valid CFI range abort (PR #184041)
Oliver Hunt via cfe-commits
cfe-commits at lists.llvm.org
Tue Mar 10 21:59:57 PDT 2026
https://github.com/ojhunt updated https://github.com/llvm/llvm-project/pull/184041
>From c04fbad27e815cba1d3c29c4fc186583f277bec0 Mon Sep 17 00:00:00 2001
From: Oliver Hunt <oliver at apple.com>
Date: Sun, 1 Mar 2026 13:28:10 -0800
Subject: [PATCH] [libunwind][PAC] Defang ptrauth's PC in valid CFI range abort
It turns out making the CFI check a release mode abort causes many,
if not the majority, of JITs to fail during unwinding as they do not
set up CFI sections for their generated code. As a result any JITs
that do nominally support unwinding (and catching) through their JIT
or assembly frames trip this abort.
rdar://170862047
---
libunwind/src/libunwind.cpp | 28 ++---
libunwind/test/cfi_violating_handler.pass.cpp | 101 ++++++++++++++++++
2 files changed, 112 insertions(+), 17 deletions(-)
create mode 100644 libunwind/test/cfi_violating_handler.pass.cpp
diff --git a/libunwind/src/libunwind.cpp b/libunwind/src/libunwind.cpp
index a795e68c57859..2128a60c3ac89 100644
--- a/libunwind/src/libunwind.cpp
+++ b/libunwind/src/libunwind.cpp
@@ -131,23 +131,17 @@ _LIBUNWIND_HIDDEN int __unw_set_reg(unw_cursor_t *cursor, unw_regnum_t regNum,
{
// It is only valid to set the IP within the current function. This is
// important for ptrauth, otherwise the IP cannot be correctly signed.
- // The current signature of `value` is via the schema:
- // __ptrauth(ptrauth_key_return_address, <<sp>>, 0)
- // For this to be generally usable we manually re-sign it to the
- // directly supported schema:
- // __ptrauth(ptrauth_key_return_address, 1, 0)
- unw_word_t
- __unwind_ptrauth_restricted_intptr(ptrauth_key_return_address, 1,
- 0) authenticated_value;
- unw_word_t opaque_value = (uint64_t)ptrauth_auth_and_resign(
- (void *)value, ptrauth_key_return_address, sp,
- ptrauth_key_return_address, &authenticated_value);
- memmove(reinterpret_cast<void *>(&authenticated_value),
- reinterpret_cast<void *>(&opaque_value),
- sizeof(authenticated_value));
- if (authenticated_value < info.start_ip ||
- authenticated_value > info.end_ip)
- _LIBUNWIND_ABORT("PC vs frame info mismatch");
+ //
+ // However many JITs do not configure CFI frames, so we cannot actually
+ // enforce this - at least not without an extremely expensive syscall.
+ //
+ // For the forseeable future this will need to be a debug only assertion
+ // so we just strip and assert to avoid the unnecessary auths in release
+ // builds.
+ unw_word_t stripped_value = (unw_word_t)ptrauth_strip(
+ (void *)value, ptrauth_key_return_address);
+ assert(stripped_value >= info.start_ip &&
+ stripped_value <= info.end_ip);
// PC should have been signed with the sp, so we verify that
// roundtripping does not fail. The `ptrauth_auth_and_resign` is
diff --git a/libunwind/test/cfi_violating_handler.pass.cpp b/libunwind/test/cfi_violating_handler.pass.cpp
new file mode 100644
index 0000000000000..c2bc912100ddf
--- /dev/null
+++ b/libunwind/test/cfi_violating_handler.pass.cpp
@@ -0,0 +1,101 @@
+// -*- C++ -*-
+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+// REQUIRES: target={{(aarch64|s390x|x86_64|arm64e)-.+}}
+// UNSUPPORTED: target={{.*-windows.*}}
+
+// *SAN does not like our clearly nonsense personality and handler functions
+// which is the correct response for them, but alas we have to allow it for JITs
+// because they tend to use a shared handler rather than having the handler
+// within the function bounds.
+// UNSUPPORTED: asan
+// UNSUPPORTED: msan
+
+#include <stdint.h>
+#include <stdio.h>
+#include <unwind.h>
+#include <libunwind.h>
+
+extern "C" void exit(int);
+
+struct alignas(16) AlignmentTester {
+ __attribute__((noinline)) void testAlignment() {
+ uintptr_t thisValue = (uintptr_t)thisValue;
+ if (thisValue % 16 != 0) {
+ fprintf(stderr, "Test bug: unaligned handler frame\n");
+ __builtin_trap();
+ }
+ }
+};
+
+
+#if defined(__x86_64__)
+// Use an intermediary function on x86_64 as the handlers are dispatched with
+// the expectation that they will perform some stack correction, most notably
+// planting down a restored base pointer
+extern "C" int randomUnrelatedFunctionImpl();
+ __attribute__((naked)) int randomUnrelatedFunction() {
+ asm(
+ "pushq %rbp \n\t"
+ "movq %rsp, %rbp\n\t"
+ "jmp _randomUnrelatedFunctionImpl\n\t"
+ );
+ }
+extern "C" __attribute__((noinline)) int randomUnrelatedFunctionImpl() {
+#else
+static int randomUnrelatedFunction() {
+#endif
+ AlignmentTester tester;
+ tester.testAlignment();
+ fprintf(stderr, "Successfully dispatched to handler unrelated to actual function\n");
+ exit(0);
+ return 0;
+}
+
+
+extern "C" int __gxx_personality_v0(int version,
+ _Unwind_Action actions,
+ uint64_t,
+ _Unwind_Exception*,
+ _Unwind_Context* context){
+
+ if (actions & 1) // Search
+ return _URC_HANDLER_FOUND;
+
+ // Having claimed to have found a handler, we just set an unrelated
+ // the PC to an unrelated function
+#if defined(__PTRAUTH__) || __has_feature(ptrauth_calls)
+ uintptr_t sp = _Unwind_GetCFA(context);
+ uintptr_t handler =
+ (uintptr_t)ptrauth_auth_and_resign((void *)&randomUnrelatedFunction,
+ ptrauth_key_function_pointer,
+ 0,
+ ptrauth_key_return_address,
+ (void*)sp);
+#else
+ uintptr_t handler = (uintptr_t)&randomUnrelatedFunction;
+#endif
+ _Unwind_SetIP(context, handler);
+ return _URC_INSTALL_CONTEXT;
+}
+
+__attribute__((noinline)) static int throwAThing() {
+ throw 1;
+}
+
+int main(int argc, const char **) {
+ try {
+ throwAThing();
+ } catch (int) {
+ fprintf(stderr, "Failed: did not call the overridden personality\n");
+ return 1;
+ }
+ fprintf(stderr, "Failed: did not trigger exception handler\n");
+ return 1;
+}
More information about the cfe-commits
mailing list