python / python/cpython

asm_trampoline.S misses GCS flag for aarch64

Open
#142,034 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

build type-bug
Dominant language
Python
Stars
77.2k
Forks
35.9k
PR merge metrics
PR metrics pending

Description

Bug report

Bug description:

When building with GCC15+, binutils 2.44+, glibc 2.41+ and -mbranch-protection=standard on aarch64, this enables PAC and BTI as stated in https://github.com/python/cpython/issues/139808 but also GCS (Guarded Control Stack).
PAC/BTI is already covered with https://github.com/python/cpython/pull/130864
For GCS, we would need to add some additional gnu properties on top of this patch, similarly to https://github.com/smuellerDD/leancrypto/commit/fe9751f2b13581e938f25b82f3e725372223af81

Maybe https://github.com/python/cpython/pull/130864 could be updated to also cover GCS?

More details on GCS:

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with asm_trampoline.S and the existing PAC/BTI handling from pull request 130864. Compare the GNU properties in the referenced leancrypto commit, then build CPython main on Linux with GCC 15+, binutils 2.44+, glibc 2.41+ and -mbranch-protection=standard; done means the aarch64 trampoline declares GCS support as well.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux, python
Domain
build-system, operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.