[libunwind] [libunwind] Fix an uninitialized read of __ra_sign_state (PR #205152)

via cfe-commits cfe-commits at lists.llvm.org
Mon Jun 22 10:53:38 PDT 2026


llvmorg-github-actions[bot] wrote:


<!--LLVM PR SUMMARY COMMENT-->

@llvm/pr-subscribers-libunwind

Author: Jon Roelofs (jroelofs)

<details>
<summary>Changes</summary>

The Arm DWARF spec defines UNW_AARCH64_RA_SIGN_STATE as being zeroed until the first .cfi_negate_ra_state / .cfi_set_ra_state [1]. The GPRs struct containing __ra_sign_state is memcpy'd directly from the unw_context_t, which in turn is initialized by __unw_getcontext. Since it is a pseudo register, there is no corresponding state to restore in __unw_resume.

https://github.com/ARM-software/abi-aa/blob/main/aadwarf64/aadwarf64.rst#<!-- -->44call-frame-instructions

---
Full diff: https://github.com/llvm/llvm-project/pull/205152.diff


1 Files Affected:

- (modified) libunwind/src/UnwindRegistersSave.S (+1) 


``````````diff
diff --git a/libunwind/src/UnwindRegistersSave.S b/libunwind/src/UnwindRegistersSave.S
index ca9a97b18e764..a82ebd1ead23b 100644
--- a/libunwind/src/UnwindRegistersSave.S
+++ b/libunwind/src/UnwindRegistersSave.S
@@ -807,6 +807,7 @@ DEFINE_LIBUNWIND_FUNCTION(__unw_getcontext)
   mov    x1,sp
   str    x1,      [x0, #0x0F8]
   str    x30,     [x0, #0x100]    // store return address as pc
+  str    xzr,     [x0, #0x108]    // zero __ra_sign_state
   // skip cpsr
 #if defined(__ARM_FP) && __ARM_FP != 0
   stp    d0, d1,  [x0, #0x110]

``````````

</details>


https://github.com/llvm/llvm-project/pull/205152


More information about the cfe-commits mailing list