From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753037AbcJMUQU (ORCPT ); Thu, 13 Oct 2016 16:16:20 -0400 Received: from mx1.redhat.com ([209.132.183.28]:45762 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752952AbcJMUPt (ORCPT ); Thu, 13 Oct 2016 16:15:49 -0400 Date: Thu, 13 Oct 2016 15:15:46 -0500 From: Josh Poimboeuf To: Denys Vlasenko Cc: Arnd Bergmann , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , x86@kernel.org, linux-kernel@vger.kernel.org, Emese Revfy Subject: Re: Another gcc corruption bug (was Re: [PATCH] [RFC] x86: avoid -mtune=atom for objtool warnings) Message-ID: <20161013201546.wy6b24y7kgeg2npv@treble> References: <20161010125709.1870563-1-arnd@arndb.de> <20161011150541.opini6gbolmnpzy5@treble> <20161011155146.icyl3zewdvmms2h2@treble> <2252957.Vm1BYSSRqP@wuerfel> <20161013124636.6ze7ff4qncbmtonv@treble> <1e64229d-4383-8211-ee4b-155d185abb30@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <1e64229d-4383-8211-ee4b-155d185abb30@redhat.com> User-Agent: Mutt/1.6.0.1 (2016-04-01) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Thu, 13 Oct 2016 20:15:48 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Oct 13, 2016 at 07:57:41PM +0200, Denys Vlasenko wrote: > On 10/13/2016 02:46 PM, Josh Poimboeuf wrote: > > On Tue, Oct 11, 2016 at 10:38:42PM +0200, Arnd Bergmann wrote: > > > 0000000000000000 : > > > 0: 55 push %rbp > > > 1: 48 89 e5 mov %rsp,%rbp > > > 4: 53 push %rbx > > > 5: 48 89 fb mov %rdi,%rbx > > > 8: 48 83 ec 08 sub $0x8,%rsp > > > c: e8 00 00 00 00 callq 11 > > > d: R_X86_64_PC32 __sanitizer_cov_trace_pc-0x4 > > > 11: 8b 03 mov (%rbx),%eax > > > 13: 85 c0 test %eax,%eax > > > 15: 75 11 jne 28 > > > 17: 48 83 c4 08 add $0x8,%rsp > > > 1b: 5b pop %rbx > > > 1c: 5d pop %rbp > > > 1d: e9 00 00 00 00 jmpq 22 > > > 1e: R_X86_64_PC32 __sanitizer_cov_trace_pc-0x4 > > > 22: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1) > > > 28: e8 00 00 00 00 callq 2d > > > 29: R_X86_64_PC32 __sanitizer_cov_trace_pc-0x4 > > > 2d: 48 8b 7b 10 mov 0x10(%rbx),%rdi > > > 31: e8 00 00 00 00 callq 36 > > > 32: R_X86_64_PC32 ioread32-0x4 > > > 36: 89 05 00 00 00 00 mov %eax,0x0(%rip) # 3c > > > 38: R_X86_64_PC32 snic_log_q_error_err_status-0x4 > > > 3c: 83 3b 01 cmpl $0x1,(%rbx) > > > 3f: 76 d6 jbe 17 > > > 41: e8 00 00 00 00 callq 46 > > > 42: R_X86_64_PC32 __sanitizer_cov_trace_pc-0x4 > > > > I opened a bug: > > > > https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77966 > > > > Surprisingly, it's really "not a bug". The only way you can end up in this branch > is if you have a bug and run off the end of wq[1] array member: i.e. > if snic->wq_count >= 2. (See gcc BZ for smaller example) > > It's debatable whether it's okay for gcc to just let buggy code to run off > and execute something random. It is surely surprising, and not debug-friendly. > > An option to emit a crashing instruction (HLT, INT3, that sort of thing) > instead of just stopping code generation might be useful. Ah, you're right. IMO it's still a gcc bug though. Instead of following a bad pointer, it would instead start executing some random function. That takes "undefined behavior" to a new level. -- Josh