fix(backtrace): Strip pointer auth mask before returning usable IP #319
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
kattrali
force-pushed
the
kattrali/arm64e-fix
branch
from
73936e6 to
a6a50f5
Compare
fractalwrench
approved these changes
Nov 27, 2018
The Arm64e architecture introduces pointer authentication codes to detect and guard against unexpected changes to pointers in memory. For most application functions, this is a nice bonus that nobody needs to think about, however, for a crash reporting library, we need to strip this extraneous value ahead of time to avoid reporting a stack frame address which does not align to a function exactly, causing unreadable stack traces. PACs work by adding a signature to the higher order bits of a pointer before it is stored. When the pointer is read, the signature is validated prior to executing a function. If the signature has been tampered with, then the app is forced to crash rather than execute altered code.
kattrali
force-pushed
the
kattrali/arm64e-fix
branch
from
a6a50f5 to
bffdf4b
Compare
Reflejo
reviewed
Nov 30, 2018
| * devices. Example usage, assuming the usage is guarded for __arm64__: | ||
| * uintptr_t ptr_address = ptr & BSG_PACStrippingMaskArm64e; | ||
| */ | ||
| #define BSG_PACStrippingMaskArm64e 0x0000000fffffffff |
There was a problem hiding this comment.
The address is located at VA_SIZE - 1; what's the rationale to hardcode 36bits here? Is this true for all devices?
There was a problem hiding this comment.
Hey @Reflejo! It is true for the existing devices, but you're right, and it could change in the future. I'll slot it in for a subsequent patch.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Background
The Arm64e architecture introduces pointer authentication codes to
detect and guard against unexpected changes to pointers in memory. For
most application functions, this is a nice bonus that nobody needs to
think about, however, for a crash reporting library, we need to strip
this extraneous value ahead of time to avoid reporting a stack frame
address which does not align to a function exactly, causing unreadable
stack traces.
PACs work by adding a signature to the higher order bits of a pointer
before it is stored. When the pointer is read, the signature is
validated prior to executing a function. If the signature has been
tampered with, then the app is forced to crash rather than execute
altered code.
Design
Modified the Arm64-specific method for reading the instruction
pointer from a crash context to strip a value prior to reporting the
value.
Tests