[libunwind] [libunwind] Fix an uninitialized read of __ra_sign_state (PR #205152)
via cfe-commits
cfe-commits at lists.llvm.org
Mon Jun 22 10:53:38 PDT 2026
llvmorg-github-actions[bot] wrote:
<!--LLVM PR SUMMARY COMMENT-->
@llvm/pr-subscribers-libunwind
Author: Jon Roelofs (jroelofs)
<details>
<summary>Changes</summary>
The Arm DWARF spec defines UNW_AARCH64_RA_SIGN_STATE as being zeroed until the first .cfi_negate_ra_state / .cfi_set_ra_state [1]. The GPRs struct containing __ra_sign_state is memcpy'd directly from the unw_context_t, which in turn is initialized by __unw_getcontext. Since it is a pseudo register, there is no corresponding state to restore in __unw_resume.
https://github.com/ARM-software/abi-aa/blob/main/aadwarf64/aadwarf64.rst#<!-- -->44call-frame-instructions
---
Full diff: https://github.com/llvm/llvm-project/pull/205152.diff
1 Files Affected:
- (modified) libunwind/src/UnwindRegistersSave.S (+1)
``````````diff
diff --git a/libunwind/src/UnwindRegistersSave.S b/libunwind/src/UnwindRegistersSave.S
index ca9a97b18e764..a82ebd1ead23b 100644
--- a/libunwind/src/UnwindRegistersSave.S
+++ b/libunwind/src/UnwindRegistersSave.S
@@ -807,6 +807,7 @@ DEFINE_LIBUNWIND_FUNCTION(__unw_getcontext)
mov x1,sp
str x1, [x0, #0x0F8]
str x30, [x0, #0x100] // store return address as pc
+ str xzr, [x0, #0x108] // zero __ra_sign_state
// skip cpsr
#if defined(__ARM_FP) && __ARM_FP != 0
stp d0, d1, [x0, #0x110]
``````````
</details>
https://github.com/llvm/llvm-project/pull/205152
More information about the cfe-commits
mailing list