llvm / llvm/llvm-project

[aarch64] Potential tail call miscompilation, causing branch protection to fault

Open
#167,181 2 comments 0 reactions 0 assignees View on GitHub
backend:AArch64
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

Here is a reasonably minimal reproducing case (see https://godbolt.org/z/1eojGroKK or https://godbolt.org/z/zss9Pndhx):

```
define internal tailcc void @g(ptr %0) #0 {
call void @h(ptr null) #2
musttail call tailcc void@f(
ptr null, ptr null, ptr null, ptr null,
ptr null, ptr null, ptr null, ptr null, ptr null)
ret void
}

define void @f(ptr, ptr, ptr, ptr, ptr, ptr, ptr,
ptr, ptr, ptr) #0 {
ret void
}

define void @h(ptr) #2 {
ret void
}

define protected i32 @main(i32 %0, ptr %1) #0 {
entry:
call void @g(ptr null)
ret i32 0
}

attributes #0 = {
"branch-target-enforcement"
"frame-pointer"="non-leaf"
"no-trapping-math"="true"
"sign-return-address"="non-leaf"
"sign-return-address-key"="a_key"
"stack-protector-buffer-size"="8"
"target-cpu"="generic"
"target-features"="+fp-armv8,+neon,+strict-align,+v8a"
}

!llvm.module.flags = !{!2, !3}

!2 = !{i32 8, !"branch-target-enforcement", i32 1}
!3 = !{i32 8, !"sign-return-address", i32 1}
```

Function `g`'s stack pointer appears to not be restored properly:

```
g:
hint #25
orr x29, x29, #0x1000000000000000
sub sp, sp, #48
...
add sp, sp, #32
hint #29
b f
```

(This causes crashes in Swift when branch protection is enabled since Swift uses tail-calls in its concurrency system, see swiftlang/swift#80059)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.