summary refs log tree commit diff
path: root/doc
diff options
context:
space:
mode:
authorQuentin Carbonneaux <quentin@c9x.me>2021-11-08 10:46:20 +0100
committerQuentin Carbonneaux <quentin@c9x.me>2021-11-08 11:29:36 +0100
commitcd095a44db262351b09ea144a44b76e22d62c77a (patch)
treeab9489f2084a5ebced26504b03c85ec104369708 /doc
parent0d68986b6f6aa046ab13776f39cc37b67b3477ba (diff)
downloadroux-cd095a44db262351b09ea144a44b76e22d62c77a.tar.gz
fix for sloppy reg->mem in arm64 abi
Michael found a bug where some copies
from registers to memory in the arm64
abi clobber the stack. The test case
is:

    type :T = { w }
    function w $f() {
    @start
    	%p =:T call $g()
    	%x =w loadw %p
    	ret %x
    }

qbe will write 4 bytes out of bounds
when pulling the result struct from
its register. The same bug can be
observed if :T's definition is {w 3};
in this case qbe writes 16 bytes in
a slot of 12 bytes.

This patch changes stkblob() to use
the rounded argument size if it is
going to be restored from registers.

Relatedly, mem->reg loads for structs
with size < 16 and != 8, are treated
a bit sloppily both in the arm64 and
in the sysv abis. That is much less
harmful than the present bug.
Diffstat (limited to 'doc')
0 files changed, 0 insertions, 0 deletions