2 files changed, 96 insertions, 0 deletions

diff --git a/meta/recipes-devtools/gcc/gcc-15.1.inc b/meta/recipes-devtools/gcc/gcc-15.1.inc
index f3e9204131..0e6ae67c8b 100644
--- a/meta/recipes-devtools/gcc/gcc-15.1.inc
+++ b/meta/recipes-devtools/gcc/gcc-15.1.inc
@@ -71,6 +71,7 @@ SRC_URI = "${BASEURI} \
            file://0023-Fix-install-path-of-linux64.h.patch \
            file://0024-Avoid-hardcoded-build-paths-into-ppc-libgcc.patch \
            file://0025-gcc-testsuite-tweaks-for-mips-OE.patch \
+           file://0026-arm-fully-validate-mem_noofs_operand-PR120351.patch \
 "
 
 S = "${TMPDIR}/work-shared/gcc-${PV}-${PR}/${SOURCEDIR}"
diff --git a/meta/recipes-devtools/gcc/gcc/0026-arm-fully-validate-mem_noofs_operand-PR120351.patch b/meta/recipes-devtools/gcc/gcc/0026-arm-fully-validate-mem_noofs_operand-PR120351.patch
new file mode 100644
index 0000000000..3f324fdc22
--- /dev/null
+++ b/meta/recipes-devtools/gcc/gcc/0026-arm-fully-validate-mem_noofs_operand-PR120351.patch
@@ -0,0 +1,95 @@
+From bb7adc5dab8bcee2ef1c0d2af370ea77c49bb5c5 Mon Sep 17 00:00:00 2001
+From: Richard Earnshaw <rearnsha@arm.com>
+Date: Mon, 19 May 2025 16:19:39 +0100
+Subject: [PATCH] arm: fully validate mem_noofs_operand [PR120351]
+
+It's not enough to just check that a memory operand is of the form
+mem(reg); after RA we also need to validate the register being used.
+The safest way to do this is to call memory_operand.
+
+        PR target/120351
+
+gcc/ChangeLog:
+
+        * config/arm/predicates.md (mem_noofs_operand): Also check the op
+        is a valid memory_operand.
+
+gcc/testsuite/ChangeLog:
+
+        * gcc.target/arm/pr120351.c: New test.
+
+Upstream-Status: Backport [https://gcc.gnu.org/cgit/gcc/commit/?id=e5bb7a328eb71daa02d15b48d3a6c6b8cd24abc5]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ gcc/config/arm/predicates.md            |  3 +-
+ gcc/testsuite/gcc.target/arm/pr120351.c | 47 +++++++++++++++++++++++++
+ 2 files changed, 49 insertions(+), 1 deletion(-)
+ create mode 100644 gcc/testsuite/gcc.target/arm/pr120351.c
+
+diff --git a/gcc/config/arm/predicates.md b/gcc/config/arm/predicates.md
+index 75c06d9be25..655f60312de 100644
+--- a/gcc/config/arm/predicates.md
++++ b/gcc/config/arm/predicates.md
+@@ -907,7 +907,8 @@
+ 
+ (define_predicate "mem_noofs_operand"
+   (and (match_code "mem")
+-       (match_code "reg" "0")))
++       (match_code "reg" "0")
++       (match_operand 0 "memory_operand")))
+ 
+ (define_predicate "call_insn_operand"
+   (ior (and (match_code "symbol_ref")
+diff --git a/gcc/testsuite/gcc.target/arm/pr120351.c b/gcc/testsuite/gcc.target/arm/pr120351.c
+new file mode 100644
+index 00000000000..d8e9d73275c
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/arm/pr120351.c
+@@ -0,0 +1,47 @@
++/* { dg-do assemble } */
++/* { dg-require-effective-target arm_neon_ok } */
++/* { dg-add-options arm_neon } */
++/* { dg-additional-options "-O2" } */
++
++
++typedef struct A
++{
++  int f1;
++} A;
++
++__inline void ref (A* x)
++{
++  __atomic_fetch_add(&x->f1, 1, 0);
++}
++
++typedef struct B
++{
++  A *d;
++  int *ptr;
++} B;
++
++void insertOne (B*, B*);
++
++void init (B *);
++__inline void copy (B *p, B *q)
++{
++  p->d  = q->d;
++  p->ptr = q->ptr;
++  ref (p->d);
++}
++
++__inline void emplace(B* x)
++{
++  B dummy;
++  B _tmp;
++  init (&dummy);
++  copy (&_tmp, &dummy);
++  insertOne(x, &_tmp);
++}
++
++void testing ()
++{
++  B test;
++  init (&test);
++  emplace(&test);
++}