[llvm-branch-commits] [llvm] [BOLT] Fix thread-safety of PointerAuthCFIAnalyzer (PR #165365)

[Gergely Bálint via llvm-branch-commits]

https://github.com/bgergely0 created https://github.com/llvm/llvm-project/pull/165365

The pass calls setIgnored() on functions in parallel, but setIgnored is
not thread safe. The patch adds a mutex to guard setIgnored calls.

Fixes: #165362

>From 4a02c9ee50ecbf020047800ff29976308df7b55b Mon Sep 17 00:00:00 2001
From: Gergely Balint <gergely.balint at arm.com>
Date: Tue, 28 Oct 2025 09:15:35 +0000
Subject: [PATCH] [BOLT] Fix thread-safety of PointerAuthCFIAnalyzer

The pass calls setIgnored() on functions in parallel, but setIgnored is
not thread safe. The patch adds a mutex to guard setIgnored calls.

Fixes: #165362
---
 bolt/include/bolt/Passes/PointerAuthCFIAnalyzer.h | 5 +++++
 bolt/lib/Passes/PointerAuthCFIAnalyzer.cpp        | 3 +++
 2 files changed, 8 insertions(+)

diff --git a/bolt/include/bolt/Passes/PointerAuthCFIAnalyzer.h b/bolt/include/bolt/Passes/PointerAuthCFIAnalyzer.h
index e63de077fad18..54da398f0b2b3 100644
--- a/bolt/include/bolt/Passes/PointerAuthCFIAnalyzer.h
+++ b/bolt/include/bolt/Passes/PointerAuthCFIAnalyzer.h
@@ -13,11 +13,16 @@
 #define BOLT_PASSES_POINTER_AUTH_CFI_ANALYZER
 
 #include "bolt/Passes/BinaryPasses.h"
+#include <mutex>
 
 namespace llvm {
 namespace bolt {
 
 class PointerAuthCFIAnalyzer : public BinaryFunctionPass {
+  // setIgnored() is not thread-safe, but the pass is running on functions in
+  // parallel.
+  std::mutex IgnoreMutex;
+
 public:
   explicit PointerAuthCFIAnalyzer() : BinaryFunctionPass(false) {}
 
diff --git a/bolt/lib/Passes/PointerAuthCFIAnalyzer.cpp b/bolt/lib/Passes/PointerAuthCFIAnalyzer.cpp
index 17486536202b8..68913a4785af6 100644
--- a/bolt/lib/Passes/PointerAuthCFIAnalyzer.cpp
+++ b/bolt/lib/Passes/PointerAuthCFIAnalyzer.cpp
@@ -47,6 +47,7 @@ bool PointerAuthCFIAnalyzer::runOnFunction(BinaryFunction &BF) {
         // Not all functions have .cfi_negate_ra_state in them. But if one does,
         // we expect psign/pauth instructions to have the hasNegateRAState
         // annotation.
+        std::lock_guard<std::mutex> Lock(IgnoreMutex);
         BF.setIgnored();
         if (opts::Verbosity >= 1)
           BC.outs() << "BOLT-INFO: inconsistent RAStates in function "
@@ -73,6 +74,7 @@ bool PointerAuthCFIAnalyzer::runOnFunction(BinaryFunction &BF) {
             BC.outs() << "BOLT-INFO: inconsistent RAStates in function "
                       << BF.getPrintName()
                       << ": ptr signing inst encountered in Signed RA state\n";
+          std::lock_guard<std::mutex> Lock(IgnoreMutex);
           BF.setIgnored();
           return false;
         }
@@ -84,6 +86,7 @@ bool PointerAuthCFIAnalyzer::runOnFunction(BinaryFunction &BF) {
                       << BF.getPrintName()
                       << ": ptr authenticating inst encountered in Unsigned RA "
                          "state\n";
+          std::lock_guard<std::mutex> Lock(IgnoreMutex);
           BF.setIgnored();
           return false;
         }