Skip to content

fix(arm64): unwind past PAC-signed return addresses - #10

Closed
jpnurmi wants to merge 1 commit into
getsentry:masterfrom
jpnurmi:jpnurmi/fix/strip-pac
Closed

jpnurmi wants to merge 1 commit into
getsentry:masterfrom
jpnurmi:jpnurmi/fix/strip-pac

Conversation

@jpnurmi

@jpnurmi jpnurmi commented Oct 28, 2026

Copy link
Copy Markdown
Collaborator

strip_pac() only strips with a mask, and nothing sets one. The __bionic_clear_pac_bits() fallback was compiled out because it is not in the NDK, so a signed return address ended the unwind. Strip with xpaclri like bionic does, spelled as hint #7 for assemblers without Armv8.3-A support. It is a NOP on older CPUs.

Verified locally on a Pixel 8 Pro (Tensor G3, Android 17), abort() through two -mbranch-protection=pac-ret functions, unwound from a SIGABRT handler like sentry-native's inproc backend.

Before:

#00 pc 000000000007fdc0  .../libc.so (abort+160)
#01 pc 006e8cdf7ce216d0  <unknown>

After:

#00 pc 000000000007fdc0  .../libc.so (abort+160)
#01 pc 000000000002867c  .../pac_test (pac_crash()+12)
#02 pc 000000000002868c  .../pac_test (pac_caller()+12)
#03 pc 0000000000028708  .../pac_test (main+120)
#04 pc 000000000007183c  .../libc.so (__libc_init+124)

Ref: getsentry/sentry-native#2258

`strip_pac()` only strips with a mask, and nothing sets one. The
`__bionic_clear_pac_bits()` fallback was compiled out because it is
not in the NDK, so a signed return address ended the unwind.

Strip with `xpaclri` like bionic does, spelled as `hint #7` for
assemblers without Armv8.3-A support. It is a NOP on older CPUs.

Pixel 8 Pro (Tensor G3, Android 17), `abort()` through two
`-mbranch-protection=pac-ret` functions, unwound from a SIGABRT
handler like sentry-native's inproc backend.

Before:
    #00 pc 000000000007fdc0  .../libc.so (abort+160)
    #1 pc 006e8cdf7ce216d0  <unknown>

After:
    #00 pc 000000000007fdc0  .../libc.so (abort+160)
    #1 pc 000000000002867c  .../pac_test (pac_crash()+12)
    #2 pc 000000000002868c  .../pac_test (pac_caller()+12)
    #3 pc 0000000000028708  .../pac_test (main+120)
    #4 pc 000000000007183c  .../libc.so (__libc_init+124)

Ref: getsentry/sentry-native#2258
@jpnurmi

jpnurmi commented Oct 29, 2026

Copy link
Copy Markdown
Collaborator Author

Superseded by #12

@jpnurmi jpnurmi closed this Oct 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant