[Bug target/100211] New: aarch64: OOB accesses in aarch64_{save,restore}_callee_saves

public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed

From: "acoplan at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug target/100211] New: aarch64: OOB accesses in aarch64_{save,restore}_callee_saves
Date: Thu, 22 Apr 2021 14:28:57 +0000	[thread overview]
Message-ID: <bug-100211-4@http.gcc.gnu.org/bugzilla/> (raw)

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100211

            Bug ID: 100211
           Summary: aarch64: OOB accesses in
                    aarch64_{save,restore}_callee_saves
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: acoplan at gcc dot gnu.org
  Target Milestone: ---

Bootstrapping on aarch64 --with-build-config=bootstrap-ubsan shows OOB accesses
in aarch64_{save,restore}_callee_saves with the following SVE testcase (reduced
from gcc.target/aarch64/sve/acle/general/cpy_1.c).

$ cat sve_test.c
#include <arm_sve.h>
svuint64_t a() {
  register svbool_t b asm("p15");
  asm("" : "=Upa"(b));
}
$ gcc/xgcc -B gcc sve_test.c -c -march=armv8.2-a+sve
/home/alecop01/toolchain/src/gcc/gcc/config/aarch64/aarch64.c:7754:57: runtime
error: index 83 out of bounds for type 'bool [83]'
    #0 0x2de50e4 in aarch64_save_callee_saves
/home/alecop01/toolchain/src/gcc/gcc/config/aarch64/aarch64.c:7754
    #1 0x2e25d48 in aarch64_expand_prologue()
/home/alecop01/toolchain/src/gcc/gcc/config/aarch64/aarch64.c:8776
    #2 0x3bdfad4 in gen_prologue()
/home/alecop01/toolchain/src/gcc/gcc/config/aarch64/aarch64.md:852
    #3 0x2da1610 in target_gen_prologue
/home/alecop01/toolchain/src/gcc/gcc/config/aarch64/aarch64.md:7444
    #4 0x11d210c in make_prologue_seq
/home/alecop01/toolchain/src/gcc/gcc/function.c:5801
    #5 0x11d27bc in thread_prologue_and_epilogue_insns()
/home/alecop01/toolchain/src/gcc/gcc/function.c:6019
    #6 0x11d4a24 in rest_of_handle_thread_prologue_and_epilogue
/home/alecop01/toolchain/src/gcc/gcc/function.c:6510
    #7 0x11d4a24 in execute
/home/alecop01/toolchain/src/gcc/gcc/function.c:6586
    #8 0x1b5ec1c in execute_one_pass(opt_pass*)
/home/alecop01/toolchain/src/gcc/gcc/passes.c:2567
    #9 0x1b623b8 in execute_pass_list_1
/home/alecop01/toolchain/src/gcc/gcc/passes.c:2656
    #10 0x1b623f0 in execute_pass_list_1
/home/alecop01/toolchain/src/gcc/gcc/passes.c:2657
    #11 0x1b623f0 in execute_pass_list_1
/home/alecop01/toolchain/src/gcc/gcc/passes.c:2657
    #12 0x1b624d4 in execute_pass_list(function*, opt_pass*)
/home/alecop01/toolchain/src/gcc/gcc/passes.c:2667
    #13 0xc7b2a4 in cgraph_node::expand()
/home/alecop01/toolchain/src/gcc/gcc/cgraphunit.c:1830
    #14 0xc7fa90 in output_in_order
/home/alecop01/toolchain/src/gcc/gcc/cgraphunit.c:2137
    #15 0xc7fa90 in symbol_table::compile()
/home/alecop01/toolchain/src/gcc/gcc/cgraphunit.c:2355
    #16 0xc8b81c in symbol_table::compile()
/home/alecop01/toolchain/src/gcc/gcc/cgraphunit.c:2271
    #17 0xc8b81c in symbol_table::finalize_compilation_unit()
/home/alecop01/toolchain/src/gcc/gcc/cgraphunit.c:2539
    #18 0x1f97478 in compile_file
/home/alecop01/toolchain/src/gcc/gcc/toplev.c:482
    #19 0x68d9b0 in do_compile
/home/alecop01/toolchain/src/gcc/gcc/toplev.c:2201
    #20 0x68d9b0 in toplev::main(int, char**)
/home/alecop01/toolchain/src/gcc/gcc/toplev.c:2340
    #21 0x6910d0 in main /home/alecop01/toolchain/src/gcc/gcc/main.c:39
    #22 0xffff881b66dc in __libc_start_main
(/lib/aarch64-linux-gnu/libc.so.6+0x206dc)
    #23 0x691b2c  (/data/alecop01/builds/bstrap-ubsan/gcc/cc1+0x691b2c)

/home/alecop01/toolchain/src/gcc/gcc/config/aarch64/aarch64.c:7855:57: runtime
error: index 83 out of bounds for type 'bool [83]'
    #0 0x2de26e8 in aarch64_restore_callee_saves
/home/alecop01/toolchain/src/gcc/gcc/config/aarch64/aarch64.c:7855
    #1 0x2de363c in aarch64_expand_epilogue(bool)
/home/alecop01/toolchain/src/gcc/gcc/config/aarch64/aarch64.c:8888
    #2 0x3bdfb4c in gen_epilogue()
/home/alecop01/toolchain/src/gcc/gcc/config/aarch64/aarch64.md:861
    #3 0x2da14bc in target_gen_epilogue
/home/alecop01/toolchain/src/gcc/gcc/config/aarch64/aarch64.md:7193
    #4 0x11d2338 in make_epilogue_seq
/home/alecop01/toolchain/src/gcc/gcc/function.c:5938
    #5 0x11d27c4 in thread_prologue_and_epilogue_insns()
/home/alecop01/toolchain/src/gcc/gcc/function.c:6020
    #6 0x11d4a24 in rest_of_handle_thread_prologue_and_epilogue
/home/alecop01/toolchain/src/gcc/gcc/function.c:6510
    #7 0x11d4a24 in execute
/home/alecop01/toolchain/src/gcc/gcc/function.c:6586
    #8 0x1b5ec1c in execute_one_pass(opt_pass*)
/home/alecop01/toolchain/src/gcc/gcc/passes.c:2567
    #9 0x1b623b8 in execute_pass_list_1
/home/alecop01/toolchain/src/gcc/gcc/passes.c:2656
    #10 0x1b623f0 in execute_pass_list_1
/home/alecop01/toolchain/src/gcc/gcc/passes.c:2657
    #11 0x1b623f0 in execute_pass_list_1
/home/alecop01/toolchain/src/gcc/gcc/passes.c:2657
    #12 0x1b624d4 in execute_pass_list(function*, opt_pass*)
/home/alecop01/toolchain/src/gcc/gcc/passes.c:2667
    #13 0xc7b2a4 in cgraph_node::expand()
/home/alecop01/toolchain/src/gcc/gcc/cgraphunit.c:1830
    #14 0xc7fa90 in output_in_order
/home/alecop01/toolchain/src/gcc/gcc/cgraphunit.c:2137
    #15 0xc7fa90 in symbol_table::compile()
/home/alecop01/toolchain/src/gcc/gcc/cgraphunit.c:2355
    #16 0xc8b81c in symbol_table::compile()
/home/alecop01/toolchain/src/gcc/gcc/cgraphunit.c:2271
    #17 0xc8b81c in symbol_table::finalize_compilation_unit()
/home/alecop01/toolchain/src/gcc/gcc/cgraphunit.c:2539
    #18 0x1f97478 in compile_file
/home/alecop01/toolchain/src/gcc/gcc/toplev.c:482
    #19 0x68d9b0 in do_compile
/home/alecop01/toolchain/src/gcc/gcc/toplev.c:2201
    #20 0x68d9b0 in toplev::main(int, char**)
/home/alecop01/toolchain/src/gcc/gcc/toplev.c:2340
    #21 0x6910d0 in main /home/alecop01/toolchain/src/gcc/gcc/main.c:39
    #22 0xffff881b66dc in __libc_start_main
(/lib/aarch64-linux-gnu/libc.so.6+0x206dc)
    #23 0x691b2c  (/data/alecop01/builds/bstrap-ubsan/gcc/cc1+0x691b2c)

next             reply	other threads:[~2021-04-22 14:28 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-04-22 14:28 acoplan at gcc dot gnu.org [this message]
2021-07-19  7:51 ` [Bug target/100211] [9/10/11/12 Regression] " pinskia at gcc dot gnu.org
2022-01-21 12:18 ` rguenth at gcc dot gnu.org
2022-05-27  9:45 ` [Bug target/100211] [10/11/12/13 " rguenth at gcc dot gnu.org
2022-06-28 10:44 ` jakub at gcc dot gnu.org
2023-07-07 10:39 ` [Bug target/100211] [11/12/13/14 " rguenth at gcc dot gnu.org

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=bug-100211-4@http.gcc.gnu.org/bugzilla/ \
    --to=gcc-bugzilla@gcc.gnu.org \
    --cc=gcc-bugs@gcc.gnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Be sure your reply has a Subject: header at the top and a blank line before the message body.

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).