Skip to content

fix: Strip PAC bits from return addresses in POSIX crash handler #315

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
awforsythe wants to merge 1 commit into
base: develop
Choose a base branch
from
Draft

fix: Strip PAC bits from return addresses in POSIX crash handler #315

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions src/datadog/impl/crash_reporting/handlers/inprocess/crash_handler_inprocess_posix.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,7 +163,17 @@ static void write_stack_trace(int fd, void* instruction_pointer, void* frame_poi
// address points to the instruction to be executed after this function returns
// (immediately following the call that created this frame). Symbolication tools
// will adjust to resolve the actual call site.
#ifdef __aarch64__
// Strip pointer authentication codes from the return address: on AArch64, return
// addresses stored on the stack have a PAC signature encoded in their upper 16
// bits, so we need to mask to 48-bit virtual address space to end up with the
// actual address within the relevant module.
uint64_t raw_ret = reinterpret_cast<uint64_t>(ret_addr);
raw_ret &= 0x0000ffffffffffff;

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preserve VA bits when stripping PAC

On AArch64 Linux processes that opt in to 52-bit user VAs (for example, executable mappings above 0x0000ffffffffffff), this hard-coded 48-bit mask truncates legitimate address bits before crash processing. write_modules() records full uintptr_t ranges from /proc/self/maps, so the truncated frame address will no longer fall inside the module range and symbolication will report the frame as unknown; use an architecture PAC-strip instruction/kernel PAC mask or derive the active VA width instead of assuming 48 bits.

Useful? React with 👍 / 👎.

WriteCrashReportStackFrame(fd, raw_ret);
#else
WriteCrashReportStackFrame(fd, reinterpret_cast<uint64_t>(ret_addr));
#endif

// Reading frame[0] into fp (effectively dereferencing fp) moves to the next frame
fp = frame[0];
Expand Down