From: Josh Poimboeuf <jpoimboe@redhat.com>
To: Arnd Bergmann <arnd@arndb.de>
Cc: Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, "H. Peter Anvin" <hpa@zytor.com>,
x86@kernel.org, linux-kernel@vger.kernel.org,
Denys Vlasenko <dvlasenk@redhat.com>,
Emese Revfy <re.emese@gmail.com>
Subject: Another gcc corruption bug (was Re: [PATCH] [RFC] x86: avoid -mtune=atom for objtool warnings)
Date: Thu, 13 Oct 2016 07:46:36 -0500 [thread overview]
Message-ID: <20161013124636.6ze7ff4qncbmtonv@treble> (raw)
In-Reply-To: <2252957.Vm1BYSSRqP@wuerfel>
On Tue, Oct 11, 2016 at 10:38:42PM +0200, Arnd Bergmann wrote:
> On Tuesday, October 11, 2016 10:51:46 AM CEST Josh Poimboeuf wrote:
> > Notice how it just falls off the end of the function. We had a similar
> > bug before:
> >
> > https://lkml.kernel.org/r/20160413033649.7r3msnmo3trtq47z@treble
>
> I remember that nightmare :(
>
> > https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70646
> >
> > I'm not sure yet if this is the same gcc bug or a different one. Maybe
> > it's related to the new GCC_PLUGIN_SANCOV?
>
> I've reduced one of the test cases to this now:
>
> /* gcc-6 -O2 -fno-strict-aliasing -fno-reorder-blocks -fno-omit-frame-pointer -Wno-pointer-sign -fsanitize-coverage=trace-pc -Wall -Werror -c snic_res.c -o snic_res.o */
> typedef int spinlock_t;
> extern unsigned int ioread32(void *);
> struct vnic_wq_ctrl {
> unsigned int error_status;
> };
> struct vnic_wq {
> struct vnic_wq_ctrl *ctrl;
> } mempool_t;
> struct snic {
> unsigned int wq_count;
> __attribute__ ((__aligned__)) struct vnic_wq wq[1];
> spinlock_t wq_lock[1];
> };
> unsigned int snic_log_q_error_err_status;
> void snic_log_q_error(struct snic *snic)
> {
> unsigned int i;
> for (i = 0; i < snic->wq_count; i++)
> snic_log_q_error_err_status =
> ioread32(&snic->wq[i].ctrl->error_status);
> }
>
> which gets compiled into
>
> 0000000000000000 <snic_log_q_error>:
> 0: 55 push %rbp
> 1: 48 89 e5 mov %rsp,%rbp
> 4: 53 push %rbx
> 5: 48 89 fb mov %rdi,%rbx
> 8: 48 83 ec 08 sub $0x8,%rsp
> c: e8 00 00 00 00 callq 11 <snic_log_q_error+0x11>
> d: R_X86_64_PC32 __sanitizer_cov_trace_pc-0x4
> 11: 8b 03 mov (%rbx),%eax
> 13: 85 c0 test %eax,%eax
> 15: 75 11 jne 28 <snic_log_q_error+0x28>
> 17: 48 83 c4 08 add $0x8,%rsp
> 1b: 5b pop %rbx
> 1c: 5d pop %rbp
> 1d: e9 00 00 00 00 jmpq 22 <snic_log_q_error+0x22>
> 1e: R_X86_64_PC32 __sanitizer_cov_trace_pc-0x4
> 22: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1)
> 28: e8 00 00 00 00 callq 2d <snic_log_q_error+0x2d>
> 29: R_X86_64_PC32 __sanitizer_cov_trace_pc-0x4
> 2d: 48 8b 7b 10 mov 0x10(%rbx),%rdi
> 31: e8 00 00 00 00 callq 36 <snic_log_q_error+0x36>
> 32: R_X86_64_PC32 ioread32-0x4
> 36: 89 05 00 00 00 00 mov %eax,0x0(%rip) # 3c <snic_log_q_error+0x3c>
> 38: R_X86_64_PC32 snic_log_q_error_err_status-0x4
> 3c: 83 3b 01 cmpl $0x1,(%rbx)
> 3f: 76 d6 jbe 17 <snic_log_q_error+0x17>
> 41: e8 00 00 00 00 callq 46 <snic_log_q_error+0x46>
> 42: R_X86_64_PC32 __sanitizer_cov_trace_pc-0x4
I opened a bug:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77966
--
Josh
next prev parent reply other threads:[~2016-10-13 12:46 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-10-10 12:56 [PATCH] [RFC] x86: avoid -mtune=atom for objtool warnings Arnd Bergmann
2016-10-10 20:23 ` Josh Poimboeuf
2016-10-11 8:08 ` Arnd Bergmann
2016-10-11 12:20 ` Josh Poimboeuf
2016-10-11 13:30 ` Arnd Bergmann
2016-10-11 15:05 ` Josh Poimboeuf
2016-10-11 15:51 ` Josh Poimboeuf
2016-10-11 20:38 ` Arnd Bergmann
2016-10-12 13:01 ` Josh Poimboeuf
2016-10-13 12:46 ` Josh Poimboeuf [this message]
2016-10-13 17:57 ` Another gcc corruption bug (was Re: [PATCH] [RFC] x86: avoid -mtune=atom for objtool warnings) Denys Vlasenko
2016-10-13 20:15 ` Josh Poimboeuf
2017-03-01 9:34 ` [PATCH] [RFC] x86: avoid -mtune=atom for objtool warnings Arnd Bergmann
2017-03-01 9:45 ` Arnd Bergmann
2017-03-01 14:40 ` Josh Poimboeuf
2017-03-01 15:27 ` Arnd Bergmann
2017-03-01 16:53 ` Josh Poimboeuf
2017-03-01 22:05 ` Arnd Bergmann
2017-03-01 22:42 ` Arnd Bergmann
2017-03-02 1:03 ` Josh Poimboeuf
2017-03-02 6:31 ` Ingo Molnar
2017-03-02 12:49 ` Josh Poimboeuf
2017-03-02 13:46 ` Ingo Molnar
2017-03-02 14:08 ` Josh Poimboeuf
2017-03-02 14:46 ` Ingo Molnar
2017-03-02 22:49 ` Arnd Bergmann
2017-03-02 23:05 ` Josh Poimboeuf
2017-03-03 8:58 ` Arnd Bergmann
2017-03-03 11:27 ` Arnd Bergmann
2017-03-01 14:31 ` Josh Poimboeuf
2017-03-01 15:21 ` Arnd Bergmann
2017-03-02 18:25 ` Josh Poimboeuf
2017-03-02 22:43 ` Arnd Bergmann
2017-03-02 22:57 ` [PATCH] objtool: fix another gcc jump table detection issue Josh Poimboeuf
2017-03-02 23:01 ` Arnd Bergmann
2016-10-11 1:53 ` [PATCH] objtool: support '-mtune=atom' stack frame setup instruction Josh Poimboeuf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161013124636.6ze7ff4qncbmtonv@treble \
--to=jpoimboe@redhat.com \
--cc=arnd@arndb.de \
--cc=dvlasenk@redhat.com \
--cc=hpa@zytor.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=re.emese@gmail.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).