IssueTracker

I have found a strange behavior when using LTO and branch-protection together. It seems that branch-protection takes a minimum value for all modules when linking with LTO.

Let's say there are 2 modules and we want to build them using LTO, one with PAC (Pointer Authentication Code) and the other without PAC.

```
echo "int f(int x, int y) {return x+y;}" > f.c
echo "int g(int x, int y) {return x*y;}" > g.c
clang -O2 --target=aarch64-unknown-linux-gnu -march=armv8.5-a -arch arm64e -mbranch-protection=pac-ret+leaf -flto f.c -c -o f.pac.lto.o
clang -O2 --target=aarch64-unknown-linux-gnu -march=armv8.5-a -arch arm64e -mbranch-protection=none -flto g.c -c -o g.nopac.lto.o
ld.lld -r f.pac.lto.o g.nopac.lto.o -o bug
```

As a result, both modules will be built without PAC:

```
$ llvm-objdump -d bug

bug:    file format elf64-littleaarch64

Disassembly of section .text.f:

0000000000000000 <f>:
       0: 0b000020      add     w0, w1, w0
       4: d65f03c0      ret

Disassembly of section .text.g:

0000000000000000 <g>:
       0: 1b007c20      mul     w0, w1, w0
       4: d65f03c0      ret
```

This behavior can lead to a significant expansion of the attack surface in the case of code reuse attacks.

As a workaround, you can compile modules where you need to disable PAC, without LTO. Or selectively set the branch-protection=none attribute for certain functions, it seems that this works as expected with LTO enabled.