public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug rtl-optimization/107248] New: Sparc V8 Invalid Stack Pointer Code
@ 2022-10-13 13:21 dennis.borde at ohb dot de
  2022-10-13 13:25 ` [Bug rtl-optimization/107248] " dennis.borde at ohb dot de
                   ` (12 more replies)
  0 siblings, 13 replies; 14+ messages in thread
From: dennis.borde at ohb dot de @ 2022-10-13 13:21 UTC (permalink / raw)
  To: gcc-bugs

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107248

            Bug ID: 107248
           Summary: Sparc V8 Invalid Stack Pointer Code
           Product: gcc
           Version: 7.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: rtl-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: dennis.borde at ohb dot de
  Target Milestone: ---

Created attachment 53700
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53700&action=edit
source code to trigger the bug

Environment: GCC V7.1.0, Sparc V8, RTEMS V4.8.0

When compiling with optimization level -O2 (including -fschedule-insns2) the
compiler generates code like this:

(1) add %sp, 0x50, %g1
(2) add %sp, 0x50, %sp
(3) add %g1, %o0, %o0
(4) ld [ %o0 + -8 ], %o0

In line (2) the stack pointer is moved by 80 bytes forward, which means memory
is "freed".
In line (4) it accesses the "freed" stack memory.

When an interrupt occurs in between line (2) and (4) it will overwrite the
stack data and "corrupt" it for the reading in line (4).

E.g.: As part of the RTEMS _ISR_Handler() the interrupt stack frame is stored
(see label symbol save_isf). For more information see RTEMS source code.
However, this is just one example to show the order of instructions above is
not safe. It is not important for the bug itself.

Work-around: Compile with -fno-schedule-insns2

With the work-around the generated code looks like this:
(1) add %sp, 0x50, %g1
(2) add %g1, %o0, %o0
(3) ld [ %o0 + -8 ], %o0
(4) add %sp, 0x50, %sp 

Here the stack memory is "freed" (4) after the access (3).

It seems to be related to
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=38644

^ permalink raw reply	[flat|nested] 14+ messages in thread
end of thread, other threads:[~2023-01-03  8:58 UTC | newest]

Thread overview: 14+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-10-13 13:21 [Bug rtl-optimization/107248] New: Sparc V8 Invalid Stack Pointer Code dennis.borde at ohb dot de
2022-10-13 13:25 ` [Bug rtl-optimization/107248] " dennis.borde at ohb dot de
2022-10-13 20:28 ` [Bug target/107248] " pinskia at gcc dot gnu.org
2022-10-13 22:09 ` [Bug target/107248] wrong scheduling of stack adjustment in leaf function at -O2 ebotcazou at gcc dot gnu.org
2022-10-13 22:10 ` ebotcazou at gcc dot gnu.org
2022-10-14  9:56 ` cvs-commit at gcc dot gnu.org
2022-10-14  9:57 ` cvs-commit at gcc dot gnu.org
2022-10-14  9:58 ` cvs-commit at gcc dot gnu.org
2022-10-14 10:00 ` cvs-commit at gcc dot gnu.org
2022-10-14 10:03 ` ebotcazou at gcc dot gnu.org
2022-10-17 11:05 ` dennis.borde at ohb dot de
2022-10-25  8:00 ` ebotcazou at gcc dot gnu.org
2023-01-03  8:30 ` cederman at gaisler dot com
2023-01-03  8:58 ` ebotcazou at gcc dot gnu.org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).