initify plugin crashes on arm allmodconfig

initify plugin crashes on arm allmodconfig

[Arnd Bergmann]

On my ARM test builds (using a recent gcc-7 snapshot), allmodconfig failed with a compiler
crash, I have managed to minimize the test case to this:

/home/arnd/cross-gcc/bin/arm-linux-gnueabi-gcc-7.0.1 -O2 -Wall -fplugin=/home/arnd/arm-soc/build/tmp/scripts/gcc-plugins/initify_plugin.so -DINITIFY_PLUGIN -fplugin-arg-initify_plugin-search_init_exit_functions  -fno-inline-functions-called-once -S atmel_lcdfb.i
arm-linux-gnueabi-gcc-7.0.1: internal compiler error: Segmentation fault (program cc1)

struct {
  void *par;
} * c, g;
struct atmel_lcdfb_pdata {
  void (*atmel_lcdfb_power_control)();
};
int a, f;
void *d, *e;
int fn1();
inline void fn2(int *p1) {
  struct atmel_lcdfb_pdata *b = b;
  if (b)
    b->atmel_lcdfb_power_control();
  a = fn1();
}
int __attribute__((__section__(".init.text"))) fn3() {
  if (c)
    goto out;
  if (f)
    goto free_info;
  if (0)
    goto put_bus_clk;
  if (0)
    goto release_intmem;
  if (0)
    goto stop_clk;
  if (0)
    goto free_fb;
  if (e)
    goto release_mem;
  if (f)
    goto unmap_mmio;
  if (0)
    goto unregister_irqs;
  if (0)
    goto reset_drvdata;
  fn2(d);
reset_drvdata:
unregister_irqs:
unmap_mmio:
release_mem:
free_fb:
release_intmem:
stop_clk:
put_bus_clk:
free_info:
out:
  return 0;
}
int __attribute__((__section__(".exit.text"))) __attribute__((__cold__)) fn4() {
  fn2(g.par);
  return 0;
}


While trying to reproduce it, one time I ended up killing the gcc task when it
used more than 80 gigabytes (!) of memory after around six minutes of compiling
the same file (drivers/video/fbdev/atmel_lcdfb.c), but other times it just crashed
as above using various ARM cross compilers (4.9.3, 5.3, 6.1.1).

	Arnd

[kernel-hardening] initify plugin crashes on arm allmodconfig

[Arnd Bergmann]

On my ARM test builds (using a recent gcc-7 snapshot), allmodconfig failed with a compiler
crash, I have managed to minimize the test case to this:

/home/arnd/cross-gcc/bin/arm-linux-gnueabi-gcc-7.0.1 -O2 -Wall -fplugin=/home/arnd/arm-soc/build/tmp/scripts/gcc-plugins/initify_plugin.so -DINITIFY_PLUGIN -fplugin-arg-initify_plugin-search_init_exit_functions  -fno-inline-functions-called-once -S atmel_lcdfb.i
arm-linux-gnueabi-gcc-7.0.1: internal compiler error: Segmentation fault (program cc1)

struct {
  void *par;
} * c, g;
struct atmel_lcdfb_pdata {
  void (*atmel_lcdfb_power_control)();
};
int a, f;
void *d, *e;
int fn1();
inline void fn2(int *p1) {
  struct atmel_lcdfb_pdata *b = b;
  if (b)
    b->atmel_lcdfb_power_control();
  a = fn1();
}
int __attribute__((__section__(".init.text"))) fn3() {
  if (c)
    goto out;
  if (f)
    goto free_info;
  if (0)
    goto put_bus_clk;
  if (0)
    goto release_intmem;
  if (0)
    goto stop_clk;
  if (0)
    goto free_fb;
  if (e)
    goto release_mem;
  if (f)
    goto unmap_mmio;
  if (0)
    goto unregister_irqs;
  if (0)
    goto reset_drvdata;
  fn2(d);
reset_drvdata:
unregister_irqs:
unmap_mmio:
release_mem:
free_fb:
release_intmem:
stop_clk:
put_bus_clk:
free_info:
out:
  return 0;
}
int __attribute__((__section__(".exit.text"))) __attribute__((__cold__)) fn4() {
  fn2(g.par);
  return 0;
}


While trying to reproduce it, one time I ended up killing the gcc task when it
used more than 80 gigabytes (!) of memory after around six minutes of compiling
the same file (drivers/video/fbdev/atmel_lcdfb.c), but other times it just crashed
as above using various ARM cross compilers (4.9.3, 5.3, 6.1.1).

	Arnd

Re: initify plugin crashes on arm allmodconfig

[PaX Team]

On 1 Feb 2017 at 14:52, Arnd Bergmann wrote:

> On my ARM test builds (using a recent gcc-7 snapshot), allmodconfig failed with a compiler
> crash, I have managed to minimize the test case to this:
> 
> /home/arnd/cross-gcc/bin/arm-linux-gnueabi-gcc-7.0.1 -O2 -Wall -fplugin=/home/arnd/arm-soc/build/tmp/scripts/gcc-plugins/initify_plugin.so -DINITIFY_PLUGIN
> -fplugin-arg-initify_plugin-search_init_exit_functions  -fno-inline-functions-called-once -S atmel_lcdfb.i arm-linux-gnueabi-gcc-7.0.1: internal compiler error: Segmentation fault (program cc1)
> 
[...]
> 
> While trying to reproduce it, one time I ended up killing the gcc task when it
> used more than 80 gigabytes (!) of memory after around six minutes of compiling
> the same file (drivers/video/fbdev/atmel_lcdfb.c), but other times it just crashed
> as above using various ARM cross compilers (4.9.3, 5.3, 6.1.1).

i tried to reproduce it with 5.4 and 6.3 to no avail (arm64->arm cross compiler)
so some more information will be needed. first, which plugin version did you try?
second, if you build your own gcc, can you configure one with this additional
option:

  --enable-checking=assert,df,gimple,misc,rtl,rtlflag,runtime,tree,types

this will enable lots of compile time self-checking in gcc and may pinpoint the
problem sooner (it also increases compile time so you probably want to keep this
gcc as a separate build from your main one).

[kernel-hardening] Re: initify plugin crashes on arm allmodconfig

[PaX Team]

On 1 Feb 2017 at 14:52, Arnd Bergmann wrote:

> On my ARM test builds (using a recent gcc-7 snapshot), allmodconfig failed with a compiler
> crash, I have managed to minimize the test case to this:
> 
> /home/arnd/cross-gcc/bin/arm-linux-gnueabi-gcc-7.0.1 -O2 -Wall -fplugin=/home/arnd/arm-soc/build/tmp/scripts/gcc-plugins/initify_plugin.so -DINITIFY_PLUGIN
> -fplugin-arg-initify_plugin-search_init_exit_functions  -fno-inline-functions-called-once -S atmel_lcdfb.i arm-linux-gnueabi-gcc-7.0.1: internal compiler error: Segmentation fault (program cc1)
> 
[...]
> 
> While trying to reproduce it, one time I ended up killing the gcc task when it
> used more than 80 gigabytes (!) of memory after around six minutes of compiling
> the same file (drivers/video/fbdev/atmel_lcdfb.c), but other times it just crashed
> as above using various ARM cross compilers (4.9.3, 5.3, 6.1.1).

i tried to reproduce it with 5.4 and 6.3 to no avail (arm64->arm cross compiler)
so some more information will be needed. first, which plugin version did you try?
second, if you build your own gcc, can you configure one with this additional
option:

  --enable-checking=assert,df,gimple,misc,rtl,rtlflag,runtime,tree,types

this will enable lots of compile time self-checking in gcc and may pinpoint the
problem sooner (it also increases compile time so you probably want to keep this
gcc as a separate build from your main one).

Re: initify plugin crashes on arm allmodconfig

[Arnd Bergmann]

[-- Attachment #1: Type: text/plain, Size: 3207 bytes --]

On Wednesday, February 1, 2017 4:10:03 PM CET PaX Team wrote:
> On 1 Feb 2017 at 14:52, Arnd Bergmann wrote:
> 
> > On my ARM test builds (using a recent gcc-7 snapshot), allmodconfig failed with a compiler
> > crash, I have managed to minimize the test case to this:
> > 
> > /home/arnd/cross-gcc/bin/arm-linux-gnueabi-gcc-7.0.1 -O2 -Wall -fplugin=/home/arnd/arm-soc/build/tmp/scripts/gcc-plugins/initify_plugin.so -DINITIFY_PLUGIN
> > -fplugin-arg-initify_plugin-search_init_exit_functions  -fno-inline-functions-called-once -S atmel_lcdfb.i arm-linux-gnueabi-gcc-7.0.1: internal compiler error: Segmentation fault (program cc1)
> > 
> [...]
> > 
> > While trying to reproduce it, one time I ended up killing the gcc task when it
> > used more than 80 gigabytes (!) of memory after around six minutes of compiling
> > the same file (drivers/video/fbdev/atmel_lcdfb.c), but other times it just crashed
> > as above using various ARM cross compilers (4.9.3, 5.3, 6.1.1).
> 
> i tried to reproduce it with 5.4 and 6.3 to no avail (arm64->arm cross compiler)
> so some more information will be needed. first, which plugin version did you try?
> second, if you build your own gcc, can you configure one with this additional
> option:

The plugin version is from today's next-20170201 version, and that is the
only version I've seen so far. Unfortunately I could not reproduce on
plain linux-next but only on my working tree, which contains countless
other patches.

I took some snapshots during the creduce run, the attached file is not fully
reduced but for me this version crashes on gcc-4.9.3, 5.3.1, 6.1.1, and 7.0.1.

I think the 4.9.3 build still had checks enabled, this is the output I get there:

arm-linux-gnueabi-gcc-4.9.3: internal compiler error: Segmentation fault (program cc1)
0x40c0c6 execute
	/home/arnd/git/gcc/gcc/gcc.c:2854
0x40c464 do_spec_1
	/home/arnd/git/gcc/gcc/gcc.c:4658
0x40edc0 process_brace_body
	/home/arnd/git/gcc/gcc/gcc.c:5941
0x40edc0 handle_braces
	/home/arnd/git/gcc/gcc/gcc.c:5855
0x40d16e do_spec_1
	/home/arnd/git/gcc/gcc/gcc.c:5312
0x40edc0 process_brace_body
	/home/arnd/git/gcc/gcc/gcc.c:5941
0x40edc0 handle_braces
	/home/arnd/git/gcc/gcc/gcc.c:5855
0x40d16e do_spec_1
	/home/arnd/git/gcc/gcc/gcc.c:5312
0x40d0d3 do_spec_1
	/home/arnd/git/gcc/gcc/gcc.c:5427
0x40edc0 process_brace_body
	/home/arnd/git/gcc/gcc/gcc.c:5941
0x40edc0 handle_braces
	/home/arnd/git/gcc/gcc/gcc.c:5855
0x40d16e do_spec_1
	/home/arnd/git/gcc/gcc/gcc.c:5312
0x40edc0 process_brace_body
	/home/arnd/git/gcc/gcc/gcc.c:5941
0x40edc0 handle_braces
	/home/arnd/git/gcc/gcc/gcc.c:5855
0x40d16e do_spec_1
	/home/arnd/git/gcc/gcc/gcc.c:5312
0x40edc0 process_brace_body
	/home/arnd/git/gcc/gcc/gcc.c:5941
0x40edc0 handle_braces
	/home/arnd/git/gcc/gcc/gcc.c:5855
0x40d16e do_spec_1
	/home/arnd/git/gcc/gcc/gcc.c:5312
0x40edc0 process_brace_body
	/home/arnd/git/gcc/gcc/gcc.c:5941
0x40edc0 handle_braces
	/home/arnd/git/gcc/gcc/gcc.c:5855
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.

If you can't reproduce with the version below, I'll dig in further.

	Arnd

[-- Attachment #2: atmel_lcdfb.i.4 --]
[-- Type: text/plain, Size: 15204 bytes --]

enum { false };
extern int __this_module;
struct list_head {
  struct list_head *next, *prev;
};
struct resource;
extern struct resource *__request_region(void);
extern void lockdep_init_map(int *key);
typedef void *work_func_t;
struct work_struct {
  work_func_t func;
};
typedef int pm_message_t;
struct device {
  void *driver_data;
  int *of_node;
};
static inline __attribute__((no_instrument_function)) void *
dev_get_drvdata(const struct device *dev) {
  return dev->driver_data;
}
extern __attribute__((format(printf, 2, 3))) void
dev_err(const struct device *dev, const char *fmt, ...);
struct platform_device_id {
  char name[20];
  unsigned long driver_data;
};
struct platform_device {
  struct device dev;
  const struct platform_device_id *id_entry;
};
struct platform_driver {
  int (*remove)(struct platform_device *);
  int (*suspend)(struct platform_device *, pm_message_t state);
  int (*resume)(struct platform_device *);
  const struct platform_device_id *id_table;
};
extern int __platform_driver_probe(struct platform_driver *driver,
                                   int(struct platform_device *), int *module);
static inline __attribute__((no_instrument_function)) void
__raw_writel(unsigned int val, volatile void *addr) {}
unsigned int __raw_readl_val;
static inline __attribute__((no_instrument_function)) unsigned int
__raw_readl(const volatile void *addr) {
  return __raw_readl_val;
}
enum irqreturn { IRQ_HANDLED };
typedef enum irqreturn (*irq_handler_t)(int, void *);
static inline __attribute__((no_instrument_function)) int
    __attribute__((warn_unused_result)) request_irq(irq_handler_t handler) {
  return 0;
}
extern int *of_parse_phandle(const int *np);
int *of_property_read_u32_child;
int of_property_read_u32_num = 0;
static inline __attribute__((no_instrument_function)) int
of_property_read_u32(unsigned int *out_value) {
  for (of_property_read_u32_child = 0; 0 != 0; of_property_read_u32_child = 0)
    of_property_read_u32_num++;
  return 0;
}
struct fb_fix_screeninfo {};
struct fb_bitfield {
  unsigned int offset;
};
struct fb_var_screeninfo {
  unsigned int bits_per_pixel;
  struct fb_bitfield red;
  struct fb_bitfield green;
  struct fb_bitfield blue;
  unsigned int pixclock;
  unsigned int vsync_len;
};
enum { FB_BLANK_UNBLANK, FB_BLANK_NORMAL, FB_BLANK_POWERDOWN };
struct backlight_properties;
struct fb_info;
struct backlight_ops {
  int (*update_status)(struct backlight_properties *);
  int (*get_brightness)(struct backlight_properties *);
};
extern struct backlight_properties *
backlight_device_register(const struct backlight_ops *ops);
struct fb_ops {
  int *owner;
  int (*fb_check_var)(struct fb_var_screeninfo *var, struct fb_info *info);
  int (*fb_set_par)(struct fb_info *info);
  int (*fb_setcolreg)(unsigned regno, unsigned red, unsigned green,
                      unsigned blue, unsigned transp, struct fb_info *info);
  int (*fb_blank)(int blank, struct fb_info *info);
  int (*fb_pan_display)(struct fb_var_screeninfo *var, struct fb_info *info);
};
struct fb_info {
  struct fb_var_screeninfo var;
  struct fb_fix_screeninfo fix;
  struct list_head modelist;
  struct device *device;
  void *par;
};
extern struct fb_info *framebuffer_alloc(struct device *dev);
struct fb_modelist {
  struct list_head list;
} arm_delay_ops;
int __attribute__((warn_unused_result)) regulator_enable(void);
struct atmel_lcdfb_pdata {
  _Bool lcdcon_is_backlight;
  _Bool lcdcon_pol_negative;
  unsigned char lcd_wiring_mode;
  unsigned int default_lcdcon2;
  unsigned int default_dmacon;
  void (*atmel_lcdfb_power_control)(struct atmel_lcdfb_pdata *pdata, int on);
  struct list_head pwr_gpios;
};
struct atmel_lcdfb_config {
  _Bool have_hozval;
  _Bool have_intensity_bit;
};
struct atmel_lcdfb_info {
  struct fb_info *info;
  void *mmio;
  struct work_struct task;
  struct platform_device *pdev;
  struct atmel_lcdfb_pdata pdata;
  struct atmel_lcdfb_config *config;
  int *reg_lcd;
};
struct atmel_lcdfb_power_ctrl_gpio {
  struct list_head list;
};
static struct atmel_lcdfb_config at91sam9261_config;
static struct atmel_lcdfb_config at91sam9263_config;
static struct atmel_lcdfb_config at91sam9g10_config;
static struct atmel_lcdfb_config at91sam9g45_config;
static struct atmel_lcdfb_config at91sam9g45es_config;
static struct atmel_lcdfb_config at91sam9rl_config;
static struct atmel_lcdfb_config at32ap_config;
static const struct platform_device_id atmel_lcdfb_devtypes[] = {
    {.name = "at91sam9261lcdfb",
     .driver_data = (unsigned long)&at91sam9261_config},
    {.name = "at91sam9263lcdfb",
     .driver_data = (unsigned long)&at91sam9263_config},
    {.name = "at91sam9g10lcdfb",
     .driver_data = (unsigned long)&at91sam9g10_config},
    {.name = "at91sam9g45lcdfb",
     .driver_data = (unsigned long)&at91sam9g45_config},
    {.name = "at91sam9g45eslcdfb",
     .driver_data = (unsigned long)&at91sam9g45es_config},
    {.name = "at91sam9rllcdfb",
     .driver_data = (unsigned long)&at91sam9rl_config},
    {.name = "at32aplcdfb", .driver_data = (unsigned long)&at32ap_config}};
struct platform_device *atmel_lcdfb_get_config_pdev;
static unsigned int contrast_ctr = 3 << 0 | 1 << 2 | 1 << 3;
static int atmel_bl_update_status(struct backlight_properties *b) { return 0; }
static int atmel_bl_get_brightness(struct backlight_properties *b) { return 0; }
static const struct backlight_ops atmel_lcdc_bl_ops = {
    .update_status = atmel_bl_update_status,
    .get_brightness = atmel_bl_get_brightness};
struct backlight_properties *init_backlight_bl;
struct atmel_lcdfb_info *init_contrast_sinfo;
int atmel_lcdfb_power_control_ret;
static inline __attribute__((no_instrument_function)) void
atmel_lcdfb_power_control(struct atmel_lcdfb_info *sinfo, int on) {
  struct atmel_lcdfb_pdata *pdata = &sinfo->pdata;
  if (pdata->atmel_lcdfb_power_control)
    pdata->atmel_lcdfb_power_control(pdata, on);
  else if (on) {
    atmel_lcdfb_power_control_ret = regulator_enable();
    dev_err(&sinfo->pdev->dev, "lcd regulator enable failed	%d\n",
            atmel_lcdfb_power_control_ret);
  }
}
static struct fb_fix_screeninfo atmel_lcdfb_fix
    __attribute__((__section__(".init.data")));
struct atmel_lcdfb_info compute_hozval_sinfo;
unsigned long compute_hozval_xres;
static void atmel_lcdfb_start(struct atmel_lcdfb_info *sinfo) {
  struct atmel_lcdfb_pdata *pdata = &sinfo->pdata;
  __raw_writel(pdata->default_dmacon, sinfo->mmio + 0x1c);
}
unsigned int atmel_lcdfb_check_var___UNIQUE_ID_min2_15 = 1;
static int atmel_lcdfb_check_var(struct fb_var_screeninfo *var,
                                 struct fb_info *info) {
  const int *__trans_tmp_1;
  struct device dev = *(info->device);
  struct atmel_lcdfb_info *sinfo = info->par;
  struct atmel_lcdfb_pdata pdata = sinfo->pdata;
  {
    { __trans_tmp_1 = 0; }
    dev_err(&dev, "needed value not specified\n");
  }
  do
    ;
  while (0);
  var->vsync_len = ({
    unsigned int __UNIQUE_ID_min1_14 = var->vsync_len;
    __UNIQUE_ID_min1_14 < atmel_lcdfb_check_var___UNIQUE_ID_min2_15;
  });
  switch (var->bits_per_pixel) {
  case 1:
  case 2:
  case 4:
  case 8:
    var= 0;
    if (pdata.lcd_wiring_mode == 1)
      ;
  }
  return 0;
}
static void atmel_lcdfb_reset(struct atmel_lcdfb_info *sinfo) {}
unsigned long atmel_lcdfb_set_par_value;
static int atmel_lcdfb_set_par(struct fb_info *info) {
  unsigned long __trans_tmp_2;
  struct atmel_lcdfb_info *sinfo = info->par;
  struct atmel_lcdfb_pdata pdata = sinfo->pdata;
  atmel_lcdfb_set_par_value = pdata.default_lcdcon2;
  { __trans_tmp_2 = compute_hozval_xres; }
  return 0;
}
static int atmel_lcdfb_setcolreg(unsigned int regno, unsigned int red,
                                 unsigned int green, unsigned int blue,
                                 unsigned int transp, struct fb_info *info) {
  struct atmel_lcdfb_info *sinfo = info->par;
  struct atmel_lcdfb_pdata pdata = sinfo->pdata;
  {
    if (pdata.lcd_wiring_mode == 1)
      ;
  }
  return 1;
}
static int atmel_lcdfb_pan_display(struct fb_var_screeninfo *var,
                                   struct fb_info *info) {
  do
    ;
  while (0);
  return 0;
}
static int atmel_lcdfb_blank(int blank_mode, struct fb_info *info) {
  struct atmel_lcdfb_info *sinfo = info->par;
  switch (blank_mode) {
  case FB_BLANK_UNBLANK:
  case FB_BLANK_NORMAL:
    atmel_lcdfb_start(sinfo);
  }
  return blank_mode == FB_BLANK_NORMAL ? 1 : 0;
}
static struct fb_ops atmel_lcdfb_ops = {.owner = &__this_module,
                                        .fb_check_var = atmel_lcdfb_check_var,
                                        .fb_set_par = atmel_lcdfb_set_par,
                                        .fb_setcolreg = atmel_lcdfb_setcolreg,
                                        .fb_blank = atmel_lcdfb_blank,
                                        .fb_pan_display =
                                            atmel_lcdfb_pan_display};
unsigned int atmel_lcdfb_interrupt_status;
static enum irqreturn atmel_lcdfb_interrupt(int irq, void *dev_id) {
  struct fb_info *info = dev_id;
  struct atmel_lcdfb_info *sinfo = info->par;
  atmel_lcdfb_interrupt_status = __raw_readl(sinfo->mmio + 0x0854);
  return IRQ_HANDLED;
}
static void atmel_lcdfb_task(void) {
  struct atmel_lcdfb_info sinfo;
  atmel_lcdfb_reset(&sinfo);
}
struct atmel_lcdfb_info atmel_lcdfb_init_fbinfo_sinfo;
static void atmel_lcdfb_start_clock(struct atmel_lcdfb_info *sinfo) {}
static void atmel_lcdfb_stop_clock(void) {}
static const char *atmel_lcdfb_wiring_modes[] = {[0] = "BRGRGB"};
int atmel_lcdfb_get_of_wiring_modes_i;
struct atmel_lcdfb_power_ctrl_gpio *atmel_lcdfb_power_control_gpio_og;
struct list_head atmel_lcdfb_power_control_gpio_og_1_0;
static void atmel_lcdfb_power_control_gpio(struct atmel_lcdfb_pdata *pdata,
                                           int on) {
  for (atmel_lcdfb_power_control_gpio_og = ({
         const typeof(((typeof(*atmel_lcdfb_power_control_gpio_og) *)0)->list)
             __mptr = *((&pdata->pwr_gpios)->next);
         (typeof(*atmel_lcdfb_power_control_gpio_og) *)&__mptr -
             __builtin_offsetof(typeof(*atmel_lcdfb_power_control_gpio_og),
                                list);
       });
       &atmel_lcdfb_power_control_gpio_og->list != &pdata->pwr_gpios;
       atmel_lcdfb_power_control_gpio_og = ({
         const typeof(((typeof(*atmel_lcdfb_power_control_gpio_og) *)0)->list)
             __mptr = atmel_lcdfb_power_control_gpio_og_1_0;
         (typeof(*atmel_lcdfb_power_control_gpio_og) *)&__mptr -
             __builtin_offsetof(typeof(*atmel_lcdfb_power_control_gpio_og),
                                list);
       }))
    ;
}
int *atmel_lcdfb_of_init_display_np;
int atmel_lcdfb_of_init_ret = 2;
int atmel_lcdfb_of_init_i;
int atmel_lcdfb_of_init_gpio;
struct atmel_lcdfb_info *atmel_lcdfb_of_init_sinfo;
static int atmel_lcdfb_of_init(void) {
  int __trans_tmp_3;
  struct fb_info *info = atmel_lcdfb_of_init_sinfo->info;
  struct atmel_lcdfb_pdata *pdata = &atmel_lcdfb_of_init_sinfo->pdata;
  struct fb_var_screeninfo var = info->var;
  struct device dev = atmel_lcdfb_of_init_sinfo->pdev->dev;
  int *np = dev.of_node;
  atmel_lcdfb_of_init_display_np = of_parse_phandle(np);
  atmel_lcdfb_of_init_ret = of_property_read_u32(&var.bits_per_pixel);
  for (atmel_lcdfb_of_init_i = 0; 0 < 0; atmel_lcdfb_of_init_i++)
    atmel_lcdfb_of_init_gpio = 0;
  goto put_display_node;
  pdata->atmel_lcdfb_power_control = atmel_lcdfb_power_control_gpio;
  {
    for (atmel_lcdfb_get_of_wiring_modes_i = 0;
         0 < sizeof(atmel_lcdfb_wiring_modes) / sizeof sizeof(struct {});
         atmel_lcdfb_get_of_wiring_modes_i++)
      __trans_tmp_3 = 0;
  }
put_display_node:
  return atmel_lcdfb_of_init_ret;
}
struct fb_info *atmel_lcdfb_probe_info;
char *atmel_lcdfb_probe_info_5_0;
struct fb_ops atmel_lcdfb_probe_info_3;
struct atmel_lcdfb_info *atmel_lcdfb_probe_sinfo;
void *atmel_lcdfb_probe_sinfo_1;
struct fb_modelist *atmel_lcdfb_probe_modelist;
int atmel_lcdfb_probe_ret;
static int __attribute__((__section__(".init.text"))) __attribute__((__cold__))
__attribute__((no_instrument_function))
atmel_lcdfb_probe(struct platform_device *pdev) {
  int __trans_tmp_6;
  int __trans_tmp_5;
  struct atmel_lcdfb_config *__trans_tmp_4;
  if (atmel_lcdfb_probe_info)
    goto out;
  atmel_lcdfb_probe_ret = atmel_lcdfb_of_init();
  if (atmel_lcdfb_probe_ret)
    goto free_info;
  else {
    {
      __trans_tmp_4 = (struct atmel_lcdfb_config *)
                          atmel_lcdfb_get_config_pdev->id_entry->driver_data;
    }
  }
  atmel_lcdfb_probe_info_3 = atmel_lcdfb_ops;
  atmel_lcdfb_probe_info->fix = atmel_lcdfb_fix;
  if (0)
    goto put_bus_clk;
  atmel_lcdfb_probe_modelist = ({
    const typeof(((struct fb_modelist *)0)->list) __mptr =
        *((&atmel_lcdfb_probe_info->modelist)->next);
    (struct fb_modelist *)&__mptr -
        __builtin_offsetof(struct fb_modelist, list);
  });
  if (0) {
    goto release_intmem;
  } else {
    { __trans_tmp_5 = 0; }
  }
  if (0 < 0)
    goto stop_clk;
  if (__request_region())
    goto free_fb;
  if (atmel_lcdfb_probe_sinfo_1)
    goto release_mem;
  {
    struct atmel_lcdfb_pdata pdata = init_contrast_sinfo->pdata;
    contrast_ctr = 1 << 2;
    if (pdata.lcdcon_is_backlight) {
      { init_backlight_bl = backlight_device_register(&atmel_lcdc_bl_ops); }
    }
  }
  atmel_lcdfb_probe_ret = request_irq(atmel_lcdfb_interrupt);
  if (atmel_lcdfb_probe_ret)
    goto unmap_mmio;
  do {
    static int __key;
    lockdep_init_map(&__key);
    (&atmel_lcdfb_probe_sinfo->task)->func = atmel_lcdfb_task;
  } while (0);
  {
    struct fb_info info = *(atmel_lcdfb_init_fbinfo_sinfo.info);
    dev_err(info.device, "Alloc color map failed\n");
    __trans_tmp_6 = 0;
  }
  if (0 < 0)
    goto unregister_irqs;
  if (0 < 0)
    goto reset_drvdata;
  atmel_lcdfb_power_control(atmel_lcdfb_probe_info->par, 1);
reset_drvdata:
unregister_irqs:
unmap_mmio:
release_mem:
free_fb:
release_intmem:
stop_clk:
  atmel_lcdfb_stop_clock();
put_bus_clk:
free_info:
out:
  do
    ;
  while (0);
  return 0;
}
static int __attribute__((__section__(".exit.text"))) __attribute__((__cold__))
__attribute__((no_instrument_function))
atmel_lcdfb_remove(struct platform_device *pdev) {
  struct device dev = pdev->dev;
  struct fb_info *info = dev_get_drvdata(&dev);
  atmel_lcdfb_power_control(info->par, 0);
  return 0;
}
struct fb_info atmel_lcdfb_suspend_info;
static int atmel_lcdfb_suspend(struct platform_device *pdev,
                               pm_message_t mesg) {
  struct atmel_lcdfb_info *sinfo = atmel_lcdfb_suspend_info.par;
  atmel_lcdfb_power_control(sinfo, 0);
  return 0;
}
struct fb_info *atmel_lcdfb_resume_info = 0;
static int atmel_lcdfb_resume(struct platform_device *pdev) {
  struct atmel_lcdfb_info *sinfo = atmel_lcdfb_resume_info->par;
  atmel_lcdfb_start_clock(sinfo);
  return 0;
}
static struct platform_driver atmel_lcdfb_driver = {
    .remove = atmel_lcdfb_remove,
    .suspend = atmel_lcdfb_suspend,
    .resume = atmel_lcdfb_resume,
    .id_table = atmel_lcdfb_devtypes};
void atmel_lcdfb_driver_init(void) {
  __platform_driver_probe(&atmel_lcdfb_driver, atmel_lcdfb_probe,
                          &__this_module);
}

[kernel-hardening] Re: initify plugin crashes on arm allmodconfig

[Arnd Bergmann]

[-- Attachment #1: Type: text/plain, Size: 3207 bytes --]

On Wednesday, February 1, 2017 4:10:03 PM CET PaX Team wrote:
> On 1 Feb 2017 at 14:52, Arnd Bergmann wrote:
> 
> > On my ARM test builds (using a recent gcc-7 snapshot), allmodconfig failed with a compiler
> > crash, I have managed to minimize the test case to this:
> > 
> > /home/arnd/cross-gcc/bin/arm-linux-gnueabi-gcc-7.0.1 -O2 -Wall -fplugin=/home/arnd/arm-soc/build/tmp/scripts/gcc-plugins/initify_plugin.so -DINITIFY_PLUGIN
> > -fplugin-arg-initify_plugin-search_init_exit_functions  -fno-inline-functions-called-once -S atmel_lcdfb.i arm-linux-gnueabi-gcc-7.0.1: internal compiler error: Segmentation fault (program cc1)
> > 
> [...]
> > 
> > While trying to reproduce it, one time I ended up killing the gcc task when it
> > used more than 80 gigabytes (!) of memory after around six minutes of compiling
> > the same file (drivers/video/fbdev/atmel_lcdfb.c), but other times it just crashed
> > as above using various ARM cross compilers (4.9.3, 5.3, 6.1.1).
> 
> i tried to reproduce it with 5.4 and 6.3 to no avail (arm64->arm cross compiler)
> so some more information will be needed. first, which plugin version did you try?
> second, if you build your own gcc, can you configure one with this additional
> option:

The plugin version is from today's next-20170201 version, and that is the
only version I've seen so far. Unfortunately I could not reproduce on
plain linux-next but only on my working tree, which contains countless
other patches.

I took some snapshots during the creduce run, the attached file is not fully
reduced but for me this version crashes on gcc-4.9.3, 5.3.1, 6.1.1, and 7.0.1.

I think the 4.9.3 build still had checks enabled, this is the output I get there:

arm-linux-gnueabi-gcc-4.9.3: internal compiler error: Segmentation fault (program cc1)
0x40c0c6 execute
	/home/arnd/git/gcc/gcc/gcc.c:2854
0x40c464 do_spec_1
	/home/arnd/git/gcc/gcc/gcc.c:4658
0x40edc0 process_brace_body
	/home/arnd/git/gcc/gcc/gcc.c:5941
0x40edc0 handle_braces
	/home/arnd/git/gcc/gcc/gcc.c:5855
0x40d16e do_spec_1
	/home/arnd/git/gcc/gcc/gcc.c:5312
0x40edc0 process_brace_body
	/home/arnd/git/gcc/gcc/gcc.c:5941
0x40edc0 handle_braces
	/home/arnd/git/gcc/gcc/gcc.c:5855
0x40d16e do_spec_1
	/home/arnd/git/gcc/gcc/gcc.c:5312
0x40d0d3 do_spec_1
	/home/arnd/git/gcc/gcc/gcc.c:5427
0x40edc0 process_brace_body
	/home/arnd/git/gcc/gcc/gcc.c:5941
0x40edc0 handle_braces
	/home/arnd/git/gcc/gcc/gcc.c:5855
0x40d16e do_spec_1
	/home/arnd/git/gcc/gcc/gcc.c:5312
0x40edc0 process_brace_body
	/home/arnd/git/gcc/gcc/gcc.c:5941
0x40edc0 handle_braces
	/home/arnd/git/gcc/gcc/gcc.c:5855
0x40d16e do_spec_1
	/home/arnd/git/gcc/gcc/gcc.c:5312
0x40edc0 process_brace_body
	/home/arnd/git/gcc/gcc/gcc.c:5941
0x40edc0 handle_braces
	/home/arnd/git/gcc/gcc/gcc.c:5855
0x40d16e do_spec_1
	/home/arnd/git/gcc/gcc/gcc.c:5312
0x40edc0 process_brace_body
	/home/arnd/git/gcc/gcc/gcc.c:5941
0x40edc0 handle_braces
	/home/arnd/git/gcc/gcc/gcc.c:5855
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.

If you can't reproduce with the version below, I'll dig in further.

	Arnd

[-- Attachment #2: atmel_lcdfb.i.4 --]
[-- Type: text/plain, Size: 15204 bytes --]

enum { false };
extern int __this_module;
struct list_head {
  struct list_head *next, *prev;
};
struct resource;
extern struct resource *__request_region(void);
extern void lockdep_init_map(int *key);
typedef void *work_func_t;
struct work_struct {
  work_func_t func;
};
typedef int pm_message_t;
struct device {
  void *driver_data;
  int *of_node;
};
static inline __attribute__((no_instrument_function)) void *
dev_get_drvdata(const struct device *dev) {
  return dev->driver_data;
}
extern __attribute__((format(printf, 2, 3))) void
dev_err(const struct device *dev, const char *fmt, ...);
struct platform_device_id {
  char name[20];
  unsigned long driver_data;
};
struct platform_device {
  struct device dev;
  const struct platform_device_id *id_entry;
};
struct platform_driver {
  int (*remove)(struct platform_device *);
  int (*suspend)(struct platform_device *, pm_message_t state);
  int (*resume)(struct platform_device *);
  const struct platform_device_id *id_table;
};
extern int __platform_driver_probe(struct platform_driver *driver,
                                   int(struct platform_device *), int *module);
static inline __attribute__((no_instrument_function)) void
__raw_writel(unsigned int val, volatile void *addr) {}
unsigned int __raw_readl_val;
static inline __attribute__((no_instrument_function)) unsigned int
__raw_readl(const volatile void *addr) {
  return __raw_readl_val;
}
enum irqreturn { IRQ_HANDLED };
typedef enum irqreturn (*irq_handler_t)(int, void *);
static inline __attribute__((no_instrument_function)) int
    __attribute__((warn_unused_result)) request_irq(irq_handler_t handler) {
  return 0;
}
extern int *of_parse_phandle(const int *np);
int *of_property_read_u32_child;
int of_property_read_u32_num = 0;
static inline __attribute__((no_instrument_function)) int
of_property_read_u32(unsigned int *out_value) {
  for (of_property_read_u32_child = 0; 0 != 0; of_property_read_u32_child = 0)
    of_property_read_u32_num++;
  return 0;
}
struct fb_fix_screeninfo {};
struct fb_bitfield {
  unsigned int offset;
};
struct fb_var_screeninfo {
  unsigned int bits_per_pixel;
  struct fb_bitfield red;
  struct fb_bitfield green;
  struct fb_bitfield blue;
  unsigned int pixclock;
  unsigned int vsync_len;
};
enum { FB_BLANK_UNBLANK, FB_BLANK_NORMAL, FB_BLANK_POWERDOWN };
struct backlight_properties;
struct fb_info;
struct backlight_ops {
  int (*update_status)(struct backlight_properties *);
  int (*get_brightness)(struct backlight_properties *);
};
extern struct backlight_properties *
backlight_device_register(const struct backlight_ops *ops);
struct fb_ops {
  int *owner;
  int (*fb_check_var)(struct fb_var_screeninfo *var, struct fb_info *info);
  int (*fb_set_par)(struct fb_info *info);
  int (*fb_setcolreg)(unsigned regno, unsigned red, unsigned green,
                      unsigned blue, unsigned transp, struct fb_info *info);
  int (*fb_blank)(int blank, struct fb_info *info);
  int (*fb_pan_display)(struct fb_var_screeninfo *var, struct fb_info *info);
};
struct fb_info {
  struct fb_var_screeninfo var;
  struct fb_fix_screeninfo fix;
  struct list_head modelist;
  struct device *device;
  void *par;
};
extern struct fb_info *framebuffer_alloc(struct device *dev);
struct fb_modelist {
  struct list_head list;
} arm_delay_ops;
int __attribute__((warn_unused_result)) regulator_enable(void);
struct atmel_lcdfb_pdata {
  _Bool lcdcon_is_backlight;
  _Bool lcdcon_pol_negative;
  unsigned char lcd_wiring_mode;
  unsigned int default_lcdcon2;
  unsigned int default_dmacon;
  void (*atmel_lcdfb_power_control)(struct atmel_lcdfb_pdata *pdata, int on);
  struct list_head pwr_gpios;
};
struct atmel_lcdfb_config {
  _Bool have_hozval;
  _Bool have_intensity_bit;
};
struct atmel_lcdfb_info {
  struct fb_info *info;
  void *mmio;
  struct work_struct task;
  struct platform_device *pdev;
  struct atmel_lcdfb_pdata pdata;
  struct atmel_lcdfb_config *config;
  int *reg_lcd;
};
struct atmel_lcdfb_power_ctrl_gpio {
  struct list_head list;
};
static struct atmel_lcdfb_config at91sam9261_config;
static struct atmel_lcdfb_config at91sam9263_config;
static struct atmel_lcdfb_config at91sam9g10_config;
static struct atmel_lcdfb_config at91sam9g45_config;
static struct atmel_lcdfb_config at91sam9g45es_config;
static struct atmel_lcdfb_config at91sam9rl_config;
static struct atmel_lcdfb_config at32ap_config;
static const struct platform_device_id atmel_lcdfb_devtypes[] = {
    {.name = "at91sam9261lcdfb",
     .driver_data = (unsigned long)&at91sam9261_config},
    {.name = "at91sam9263lcdfb",
     .driver_data = (unsigned long)&at91sam9263_config},
    {.name = "at91sam9g10lcdfb",
     .driver_data = (unsigned long)&at91sam9g10_config},
    {.name = "at91sam9g45lcdfb",
     .driver_data = (unsigned long)&at91sam9g45_config},
    {.name = "at91sam9g45eslcdfb",
     .driver_data = (unsigned long)&at91sam9g45es_config},
    {.name = "at91sam9rllcdfb",
     .driver_data = (unsigned long)&at91sam9rl_config},
    {.name = "at32aplcdfb", .driver_data = (unsigned long)&at32ap_config}};
struct platform_device *atmel_lcdfb_get_config_pdev;
static unsigned int contrast_ctr = 3 << 0 | 1 << 2 | 1 << 3;
static int atmel_bl_update_status(struct backlight_properties *b) { return 0; }
static int atmel_bl_get_brightness(struct backlight_properties *b) { return 0; }
static const struct backlight_ops atmel_lcdc_bl_ops = {
    .update_status = atmel_bl_update_status,
    .get_brightness = atmel_bl_get_brightness};
struct backlight_properties *init_backlight_bl;
struct atmel_lcdfb_info *init_contrast_sinfo;
int atmel_lcdfb_power_control_ret;
static inline __attribute__((no_instrument_function)) void
atmel_lcdfb_power_control(struct atmel_lcdfb_info *sinfo, int on) {
  struct atmel_lcdfb_pdata *pdata = &sinfo->pdata;
  if (pdata->atmel_lcdfb_power_control)
    pdata->atmel_lcdfb_power_control(pdata, on);
  else if (on) {
    atmel_lcdfb_power_control_ret = regulator_enable();
    dev_err(&sinfo->pdev->dev, "lcd regulator enable failed	%d\n",
            atmel_lcdfb_power_control_ret);
  }
}
static struct fb_fix_screeninfo atmel_lcdfb_fix
    __attribute__((__section__(".init.data")));
struct atmel_lcdfb_info compute_hozval_sinfo;
unsigned long compute_hozval_xres;
static void atmel_lcdfb_start(struct atmel_lcdfb_info *sinfo) {
  struct atmel_lcdfb_pdata *pdata = &sinfo->pdata;
  __raw_writel(pdata->default_dmacon, sinfo->mmio + 0x1c);
}
unsigned int atmel_lcdfb_check_var___UNIQUE_ID_min2_15 = 1;
static int atmel_lcdfb_check_var(struct fb_var_screeninfo *var,
                                 struct fb_info *info) {
  const int *__trans_tmp_1;
  struct device dev = *(info->device);
  struct atmel_lcdfb_info *sinfo = info->par;
  struct atmel_lcdfb_pdata pdata = sinfo->pdata;
  {
    { __trans_tmp_1 = 0; }
    dev_err(&dev, "needed value not specified\n");
  }
  do
    ;
  while (0);
  var->vsync_len = ({
    unsigned int __UNIQUE_ID_min1_14 = var->vsync_len;
    __UNIQUE_ID_min1_14 < atmel_lcdfb_check_var___UNIQUE_ID_min2_15;
  });
  switch (var->bits_per_pixel) {
  case 1:
  case 2:
  case 4:
  case 8:
    var= 0;
    if (pdata.lcd_wiring_mode == 1)
      ;
  }
  return 0;
}
static void atmel_lcdfb_reset(struct atmel_lcdfb_info *sinfo) {}
unsigned long atmel_lcdfb_set_par_value;
static int atmel_lcdfb_set_par(struct fb_info *info) {
  unsigned long __trans_tmp_2;
  struct atmel_lcdfb_info *sinfo = info->par;
  struct atmel_lcdfb_pdata pdata = sinfo->pdata;
  atmel_lcdfb_set_par_value = pdata.default_lcdcon2;
  { __trans_tmp_2 = compute_hozval_xres; }
  return 0;
}
static int atmel_lcdfb_setcolreg(unsigned int regno, unsigned int red,
                                 unsigned int green, unsigned int blue,
                                 unsigned int transp, struct fb_info *info) {
  struct atmel_lcdfb_info *sinfo = info->par;
  struct atmel_lcdfb_pdata pdata = sinfo->pdata;
  {
    if (pdata.lcd_wiring_mode == 1)
      ;
  }
  return 1;
}
static int atmel_lcdfb_pan_display(struct fb_var_screeninfo *var,
                                   struct fb_info *info) {
  do
    ;
  while (0);
  return 0;
}
static int atmel_lcdfb_blank(int blank_mode, struct fb_info *info) {
  struct atmel_lcdfb_info *sinfo = info->par;
  switch (blank_mode) {
  case FB_BLANK_UNBLANK:
  case FB_BLANK_NORMAL:
    atmel_lcdfb_start(sinfo);
  }
  return blank_mode == FB_BLANK_NORMAL ? 1 : 0;
}
static struct fb_ops atmel_lcdfb_ops = {.owner = &__this_module,
                                        .fb_check_var = atmel_lcdfb_check_var,
                                        .fb_set_par = atmel_lcdfb_set_par,
                                        .fb_setcolreg = atmel_lcdfb_setcolreg,
                                        .fb_blank = atmel_lcdfb_blank,
                                        .fb_pan_display =
                                            atmel_lcdfb_pan_display};
unsigned int atmel_lcdfb_interrupt_status;
static enum irqreturn atmel_lcdfb_interrupt(int irq, void *dev_id) {
  struct fb_info *info = dev_id;
  struct atmel_lcdfb_info *sinfo = info->par;
  atmel_lcdfb_interrupt_status = __raw_readl(sinfo->mmio + 0x0854);
  return IRQ_HANDLED;
}
static void atmel_lcdfb_task(void) {
  struct atmel_lcdfb_info sinfo;
  atmel_lcdfb_reset(&sinfo);
}
struct atmel_lcdfb_info atmel_lcdfb_init_fbinfo_sinfo;
static void atmel_lcdfb_start_clock(struct atmel_lcdfb_info *sinfo) {}
static void atmel_lcdfb_stop_clock(void) {}
static const char *atmel_lcdfb_wiring_modes[] = {[0] = "BRGRGB"};
int atmel_lcdfb_get_of_wiring_modes_i;
struct atmel_lcdfb_power_ctrl_gpio *atmel_lcdfb_power_control_gpio_og;
struct list_head atmel_lcdfb_power_control_gpio_og_1_0;
static void atmel_lcdfb_power_control_gpio(struct atmel_lcdfb_pdata *pdata,
                                           int on) {
  for (atmel_lcdfb_power_control_gpio_og = ({
         const typeof(((typeof(*atmel_lcdfb_power_control_gpio_og) *)0)->list)
             __mptr = *((&pdata->pwr_gpios)->next);
         (typeof(*atmel_lcdfb_power_control_gpio_og) *)&__mptr -
             __builtin_offsetof(typeof(*atmel_lcdfb_power_control_gpio_og),
                                list);
       });
       &atmel_lcdfb_power_control_gpio_og->list != &pdata->pwr_gpios;
       atmel_lcdfb_power_control_gpio_og = ({
         const typeof(((typeof(*atmel_lcdfb_power_control_gpio_og) *)0)->list)
             __mptr = atmel_lcdfb_power_control_gpio_og_1_0;
         (typeof(*atmel_lcdfb_power_control_gpio_og) *)&__mptr -
             __builtin_offsetof(typeof(*atmel_lcdfb_power_control_gpio_og),
                                list);
       }))
    ;
}
int *atmel_lcdfb_of_init_display_np;
int atmel_lcdfb_of_init_ret = 2;
int atmel_lcdfb_of_init_i;
int atmel_lcdfb_of_init_gpio;
struct atmel_lcdfb_info *atmel_lcdfb_of_init_sinfo;
static int atmel_lcdfb_of_init(void) {
  int __trans_tmp_3;
  struct fb_info *info = atmel_lcdfb_of_init_sinfo->info;
  struct atmel_lcdfb_pdata *pdata = &atmel_lcdfb_of_init_sinfo->pdata;
  struct fb_var_screeninfo var = info->var;
  struct device dev = atmel_lcdfb_of_init_sinfo->pdev->dev;
  int *np = dev.of_node;
  atmel_lcdfb_of_init_display_np = of_parse_phandle(np);
  atmel_lcdfb_of_init_ret = of_property_read_u32(&var.bits_per_pixel);
  for (atmel_lcdfb_of_init_i = 0; 0 < 0; atmel_lcdfb_of_init_i++)
    atmel_lcdfb_of_init_gpio = 0;
  goto put_display_node;
  pdata->atmel_lcdfb_power_control = atmel_lcdfb_power_control_gpio;
  {
    for (atmel_lcdfb_get_of_wiring_modes_i = 0;
         0 < sizeof(atmel_lcdfb_wiring_modes) / sizeof sizeof(struct {});
         atmel_lcdfb_get_of_wiring_modes_i++)
      __trans_tmp_3 = 0;
  }
put_display_node:
  return atmel_lcdfb_of_init_ret;
}
struct fb_info *atmel_lcdfb_probe_info;
char *atmel_lcdfb_probe_info_5_0;
struct fb_ops atmel_lcdfb_probe_info_3;
struct atmel_lcdfb_info *atmel_lcdfb_probe_sinfo;
void *atmel_lcdfb_probe_sinfo_1;
struct fb_modelist *atmel_lcdfb_probe_modelist;
int atmel_lcdfb_probe_ret;
static int __attribute__((__section__(".init.text"))) __attribute__((__cold__))
__attribute__((no_instrument_function))
atmel_lcdfb_probe(struct platform_device *pdev) {
  int __trans_tmp_6;
  int __trans_tmp_5;
  struct atmel_lcdfb_config *__trans_tmp_4;
  if (atmel_lcdfb_probe_info)
    goto out;
  atmel_lcdfb_probe_ret = atmel_lcdfb_of_init();
  if (atmel_lcdfb_probe_ret)
    goto free_info;
  else {
    {
      __trans_tmp_4 = (struct atmel_lcdfb_config *)
                          atmel_lcdfb_get_config_pdev->id_entry->driver_data;
    }
  }
  atmel_lcdfb_probe_info_3 = atmel_lcdfb_ops;
  atmel_lcdfb_probe_info->fix = atmel_lcdfb_fix;
  if (0)
    goto put_bus_clk;
  atmel_lcdfb_probe_modelist = ({
    const typeof(((struct fb_modelist *)0)->list) __mptr =
        *((&atmel_lcdfb_probe_info->modelist)->next);
    (struct fb_modelist *)&__mptr -
        __builtin_offsetof(struct fb_modelist, list);
  });
  if (0) {
    goto release_intmem;
  } else {
    { __trans_tmp_5 = 0; }
  }
  if (0 < 0)
    goto stop_clk;
  if (__request_region())
    goto free_fb;
  if (atmel_lcdfb_probe_sinfo_1)
    goto release_mem;
  {
    struct atmel_lcdfb_pdata pdata = init_contrast_sinfo->pdata;
    contrast_ctr = 1 << 2;
    if (pdata.lcdcon_is_backlight) {
      { init_backlight_bl = backlight_device_register(&atmel_lcdc_bl_ops); }
    }
  }
  atmel_lcdfb_probe_ret = request_irq(atmel_lcdfb_interrupt);
  if (atmel_lcdfb_probe_ret)
    goto unmap_mmio;
  do {
    static int __key;
    lockdep_init_map(&__key);
    (&atmel_lcdfb_probe_sinfo->task)->func = atmel_lcdfb_task;
  } while (0);
  {
    struct fb_info info = *(atmel_lcdfb_init_fbinfo_sinfo.info);
    dev_err(info.device, "Alloc color map failed\n");
    __trans_tmp_6 = 0;
  }
  if (0 < 0)
    goto unregister_irqs;
  if (0 < 0)
    goto reset_drvdata;
  atmel_lcdfb_power_control(atmel_lcdfb_probe_info->par, 1);
reset_drvdata:
unregister_irqs:
unmap_mmio:
release_mem:
free_fb:
release_intmem:
stop_clk:
  atmel_lcdfb_stop_clock();
put_bus_clk:
free_info:
out:
  do
    ;
  while (0);
  return 0;
}
static int __attribute__((__section__(".exit.text"))) __attribute__((__cold__))
__attribute__((no_instrument_function))
atmel_lcdfb_remove(struct platform_device *pdev) {
  struct device dev = pdev->dev;
  struct fb_info *info = dev_get_drvdata(&dev);
  atmel_lcdfb_power_control(info->par, 0);
  return 0;
}
struct fb_info atmel_lcdfb_suspend_info;
static int atmel_lcdfb_suspend(struct platform_device *pdev,
                               pm_message_t mesg) {
  struct atmel_lcdfb_info *sinfo = atmel_lcdfb_suspend_info.par;
  atmel_lcdfb_power_control(sinfo, 0);
  return 0;
}
struct fb_info *atmel_lcdfb_resume_info = 0;
static int atmel_lcdfb_resume(struct platform_device *pdev) {
  struct atmel_lcdfb_info *sinfo = atmel_lcdfb_resume_info->par;
  atmel_lcdfb_start_clock(sinfo);
  return 0;
}
static struct platform_driver atmel_lcdfb_driver = {
    .remove = atmel_lcdfb_remove,
    .suspend = atmel_lcdfb_suspend,
    .resume = atmel_lcdfb_resume,
    .id_table = atmel_lcdfb_devtypes};
void atmel_lcdfb_driver_init(void) {
  __platform_driver_probe(&atmel_lcdfb_driver, atmel_lcdfb_probe,
                          &__this_module);
}

Re: initify plugin crashes on arm allmodconfig

[PaX Team]

On 1 Feb 2017 at 16:26, Arnd Bergmann wrote:
> arm-linux-gnueabi-gcc-4.9.3: internal compiler error: Segmentation fault (program cc1)
> 0x40c0c6 execute
>  /home/arnd/git/gcc/gcc/gcc.c:2854
> 0x40c464 do_spec_1
>  /home/arnd/git/gcc/gcc/gcc.c:4658
> 0x40edc0 process_brace_body
>  /home/arnd/git/gcc/gcc/gcc.c:5941
> 0x40edc0 handle_braces
>  /home/arnd/git/gcc/gcc/gcc.c:5855
> 0x40d16e do_spec_1

considering the repeating pattern, it may be some infinite recursion, perhaps
run with -dH and look at the backtrace in the coredump. also this code seems to
be the language frontend (the specfile parser in particular) that the initify
plugin doesn't affect, perhaps you have some changes there?

> If you can't reproduce with the version below, I'll dig in further.

no dice, both 5.4 and 6.3 worked fine (save for a few -Wunused-but-set-variable
warnings).

[kernel-hardening] Re: initify plugin crashes on arm allmodconfig

[PaX Team]

On 1 Feb 2017 at 16:26, Arnd Bergmann wrote:
> arm-linux-gnueabi-gcc-4.9.3: internal compiler error: Segmentation fault (program cc1)
> 0x40c0c6 execute
>  /home/arnd/git/gcc/gcc/gcc.c:2854
> 0x40c464 do_spec_1
>  /home/arnd/git/gcc/gcc/gcc.c:4658
> 0x40edc0 process_brace_body
>  /home/arnd/git/gcc/gcc/gcc.c:5941
> 0x40edc0 handle_braces
>  /home/arnd/git/gcc/gcc/gcc.c:5855
> 0x40d16e do_spec_1

considering the repeating pattern, it may be some infinite recursion, perhaps
run with -dH and look at the backtrace in the coredump. also this code seems to
be the language frontend (the specfile parser in particular) that the initify
plugin doesn't affect, perhaps you have some changes there?

> If you can't reproduce with the version below, I'll dig in further.

no dice, both 5.4 and 6.3 worked fine (save for a few -Wunused-but-set-variable
warnings).

Re: initify plugin crashes on arm allmodconfig

[Arnd Bergmann]

On Wed, Feb 1, 2017 at 5:07 PM, PaX Team <pageexec@freemail.hu> wrote:
> On 1 Feb 2017 at 16:26, Arnd Bergmann wrote:
>> If you can't reproduce with the version below, I'll dig in further.
>
> no dice, both 5.4 and 6.3 worked fine (save for a few -Wunused-but-set-variable
> warnings).
>

Maybe one more thing to try, I've uploaded my current branch to
git://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground.git#randconfig-4.11-next
now, so maybe try this sequence:

arnd@wuerfel:~/git/arm-soc$ git fetch
git://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground.git
randconfig-4.11-next
>From git://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground
 * branch            randconfig-4.11-next -> FETCH_HEAD

arnd@wuerfel:~/git/arm-soc$ git checkout FETCH_HEAD
HEAD is now at fbb1b68... fixup! [SUBMITTED 20170201] [RFC v2] sched:
make DECLARE_COMPLETION_ONSTACK() work with clang

arnd@wuerfel:~/git/arm-soc$ make -skj20 O=obj-arm
CROSS_COMPILE=/home/arnd/cross-gcc/bin/arm-linux-gnueabi- ARCH=arm
allmodconfig

arnd@wuerfel:~/git/arm-soc$ make -skj20 O=obj-arm
CROSS_COMPILE=/home/arnd/cross-gcc/bin/arm-linux-gnueabi- ARCH=arm
drivers/video/fbdev/atmel_lcdfb.o
CC=/home/arnd/cross-gcc/bin/arm-linux-gnueabi-gcc-5.3.1

Interestingly, the first time I run this, I seem to always get into
out-of-memory, while the second run is then an immediate crash.

     Arnd

[kernel-hardening] Re: initify plugin crashes on arm allmodconfig

[Arnd Bergmann]

On Wed, Feb 1, 2017 at 5:07 PM, PaX Team <pageexec@freemail.hu> wrote:
> On 1 Feb 2017 at 16:26, Arnd Bergmann wrote:
>> If you can't reproduce with the version below, I'll dig in further.
>
> no dice, both 5.4 and 6.3 worked fine (save for a few -Wunused-but-set-variable
> warnings).
>

Maybe one more thing to try, I've uploaded my current branch to
git://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground.git#randconfig-4.11-next
now, so maybe try this sequence:

arnd@wuerfel:~/git/arm-soc$ git fetch
git://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground.git
randconfig-4.11-next
>From git://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground
 * branch            randconfig-4.11-next -> FETCH_HEAD

arnd@wuerfel:~/git/arm-soc$ git checkout FETCH_HEAD
HEAD is now at fbb1b68... fixup! [SUBMITTED 20170201] [RFC v2] sched:
make DECLARE_COMPLETION_ONSTACK() work with clang

arnd@wuerfel:~/git/arm-soc$ make -skj20 O=obj-arm
CROSS_COMPILE=/home/arnd/cross-gcc/bin/arm-linux-gnueabi- ARCH=arm
allmodconfig

arnd@wuerfel:~/git/arm-soc$ make -skj20 O=obj-arm
CROSS_COMPILE=/home/arnd/cross-gcc/bin/arm-linux-gnueabi- ARCH=arm
drivers/video/fbdev/atmel_lcdfb.o
CC=/home/arnd/cross-gcc/bin/arm-linux-gnueabi-gcc-5.3.1

Interestingly, the first time I run this, I seem to always get into
out-of-memory, while the second run is then an immediate crash.

     Arnd

Re: initify plugin crashes on arm allmodconfig

[Arnd Bergmann]

I ran into three more problems now that I haven't analysed yet:


1. I suspect this one is from a string that got deduplicated but is
used from both __init and non-__init functions now. Same tree,
randconfig output at http://pastebin.com/dl/XA3fXTtp

==> build/x86/0x27D13D98_defconfig/log <==
WARNING: drivers/clk/built-in.o(.text+0x9324): Section mismatch in
reference from the function clk_gate() to the variable
.init.rodata.str:__func__.27925
The function clk_gate() references
the variable __initconst __func__.27925.
This is often because clk_gate lacks a __initconst
annotation or the annotation of __func__.27925 is wrong.

WARNING: drivers/clk/built-in.o(.text+0x9365): Section mismatch in
reference from the function clk_gate() to the variable
.init.rodata.str:__func__.27929
The function clk_gate() references
the variable __initconst __func__.27929.
This is often because clk_gate lacks a __initconst
annotation or the annotation of __func__.27929 is wrong.

WARNING: drivers/clk/built-in.o(.text+0x95d6): Section mismatch in
reference from the function kona_peri_clk_set_parent() to the variable
.init.rodata.str:__func__.27925
The function kona_peri_clk_set_parent() references
the variable __initconst __func__.27925.
This is often because kona_peri_clk_set_parent lacks a __initconst
annotation or the annotation of __func__.27925 is wrong.

WARNING: drivers/clk/built-in.o(.text+0x961d): Section mismatch in
reference from the function kona_peri_clk_set_parent() to the variable
.init.rodata.str:__func__.27929
The function kona_peri_clk_set_parent() references
the variable __initconst __func__.27929.
This is often because kona_peri_clk_set_parent lacks a __initconst
annotation or the annotation of __func__.27929 is wrong.

2. futher incorrect nocapture annotations, same tree, randconfig file
at http://pastebin.com/dl/xZrAHAfU
/git/arm-soc/mm/util.c: In function 'kstrdup':
/git/arm-soc/mm/util.c:44:7: error: 'kstrdup' captures its 1 ('s')
parameter, please remove it from the nocapture attribute. [-Werror]
 char *kstrdup(const char *s, gfp_t gfp)
       ^~~~~~~
/git/arm-soc/mm/util.c: In function 'kmemdup':
/git/arm-soc/mm/util.c:109:7: error: 'kmemdup' captures its 1 ('src')
parameter, please remove it from the nocapture attribute. [-Werror]
 void *kmemdup(const void *src, size_t len, gfp_t gfp)
       ^~~~~~~
/git/arm-soc/mm/util.c: In function 'kstrndup':
/git/arm-soc/mm/util.c:84:7: error: 'kstrndup' captures its 1 ('s')
parameter, please remove it from the nocapture attribute. [-Werror]
 char *kstrndup(const char *s, size_t max, gfp_t gfp)
       ^~~~~~~~
/git/arm-soc/lib/string.c: In function 'strlcpy':
/git/arm-soc/lib/string.c:139:8: error: 'strlcpy' captures its 2
('src') parameter, please remove it from the nocapture attribute.
[-Werror]
 size_t strlcpy(char *dest, const char *src, size_t size)
        ^~~~~~~
/git/arm-soc/lib/string.c: In function 'strlcat':
/git/arm-soc/lib/string.c:294:8: error: 'strlcat' captures its 2
('src') parameter, please remove it from the nocapture attribute.
[-Werror]
 size_t strlcat(char *dest, const char *src, size_t count)
        ^~~~~~~
cc1: all warnings being treated as errors
/git/arm-soc/scripts/Makefile.build:307: recipe for target 'lib/string.o' failed
make[3]: *** [lib/string.o] Error 1
/git/arm-soc/lib/vsprintf.c: In function 'bstr_printf':
/git/arm-soc/lib/vsprintf.c:2406:5: error: 'bstr_printf' captures its
3 ('fmt') parameter, please remove it from the nocapture attribute.
[-Werror]
 int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
     ^~~~~~~~~~~
cc1: all warnings being treated as errors

3. some configurations seem to take very long to build, over 10
minutes instead of the usual 3. Haven't done any concrete measurements
yet to confirm that it's the initify plugin causing this.

I'll turn off the plugin for my build testing now.

     Arnd

[kernel-hardening] Re: initify plugin crashes on arm allmodconfig

[Arnd Bergmann]

I ran into three more problems now that I haven't analysed yet:


1. I suspect this one is from a string that got deduplicated but is
used from both __init and non-__init functions now. Same tree,
randconfig output at http://pastebin.com/dl/XA3fXTtp

==> build/x86/0x27D13D98_defconfig/log <==
WARNING: drivers/clk/built-in.o(.text+0x9324): Section mismatch in
reference from the function clk_gate() to the variable
.init.rodata.str:__func__.27925
The function clk_gate() references
the variable __initconst __func__.27925.
This is often because clk_gate lacks a __initconst
annotation or the annotation of __func__.27925 is wrong.

WARNING: drivers/clk/built-in.o(.text+0x9365): Section mismatch in
reference from the function clk_gate() to the variable
.init.rodata.str:__func__.27929
The function clk_gate() references
the variable __initconst __func__.27929.
This is often because clk_gate lacks a __initconst
annotation or the annotation of __func__.27929 is wrong.

WARNING: drivers/clk/built-in.o(.text+0x95d6): Section mismatch in
reference from the function kona_peri_clk_set_parent() to the variable
.init.rodata.str:__func__.27925
The function kona_peri_clk_set_parent() references
the variable __initconst __func__.27925.
This is often because kona_peri_clk_set_parent lacks a __initconst
annotation or the annotation of __func__.27925 is wrong.

WARNING: drivers/clk/built-in.o(.text+0x961d): Section mismatch in
reference from the function kona_peri_clk_set_parent() to the variable
.init.rodata.str:__func__.27929
The function kona_peri_clk_set_parent() references
the variable __initconst __func__.27929.
This is often because kona_peri_clk_set_parent lacks a __initconst
annotation or the annotation of __func__.27929 is wrong.

2. futher incorrect nocapture annotations, same tree, randconfig file
at http://pastebin.com/dl/xZrAHAfU
/git/arm-soc/mm/util.c: In function 'kstrdup':
/git/arm-soc/mm/util.c:44:7: error: 'kstrdup' captures its 1 ('s')
parameter, please remove it from the nocapture attribute. [-Werror]
 char *kstrdup(const char *s, gfp_t gfp)
       ^~~~~~~
/git/arm-soc/mm/util.c: In function 'kmemdup':
/git/arm-soc/mm/util.c:109:7: error: 'kmemdup' captures its 1 ('src')
parameter, please remove it from the nocapture attribute. [-Werror]
 void *kmemdup(const void *src, size_t len, gfp_t gfp)
       ^~~~~~~
/git/arm-soc/mm/util.c: In function 'kstrndup':
/git/arm-soc/mm/util.c:84:7: error: 'kstrndup' captures its 1 ('s')
parameter, please remove it from the nocapture attribute. [-Werror]
 char *kstrndup(const char *s, size_t max, gfp_t gfp)
       ^~~~~~~~
/git/arm-soc/lib/string.c: In function 'strlcpy':
/git/arm-soc/lib/string.c:139:8: error: 'strlcpy' captures its 2
('src') parameter, please remove it from the nocapture attribute.
[-Werror]
 size_t strlcpy(char *dest, const char *src, size_t size)
        ^~~~~~~
/git/arm-soc/lib/string.c: In function 'strlcat':
/git/arm-soc/lib/string.c:294:8: error: 'strlcat' captures its 2
('src') parameter, please remove it from the nocapture attribute.
[-Werror]
 size_t strlcat(char *dest, const char *src, size_t count)
        ^~~~~~~
cc1: all warnings being treated as errors
/git/arm-soc/scripts/Makefile.build:307: recipe for target 'lib/string.o' failed
make[3]: *** [lib/string.o] Error 1
/git/arm-soc/lib/vsprintf.c: In function 'bstr_printf':
/git/arm-soc/lib/vsprintf.c:2406:5: error: 'bstr_printf' captures its
3 ('fmt') parameter, please remove it from the nocapture attribute.
[-Werror]
 int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
     ^~~~~~~~~~~
cc1: all warnings being treated as errors

3. some configurations seem to take very long to build, over 10
minutes instead of the usual 3. Haven't done any concrete measurements
yet to confirm that it's the initify plugin causing this.

I'll turn off the plugin for my build testing now.

     Arnd