[Bug middle-end/107482] New: out-of-bounds heap access in IRA

[Bug middle-end/107482] New: out-of-bounds heap access in IRA

[jcmvbkbc at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107482

            Bug ID: 107482
           Summary: out-of-bounds heap access in IRA
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: jcmvbkbc at gcc dot gnu.org
  Target Milestone: ---

Created attachment 53806
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53806&action=edit
_gcov.i

Inside the functions update_costs_from_allocno and
assign_hard_reg the macro ALLOCNO_COLOR_DATA
may be applied to objects of type 'struct ira_allocno' whose
add_data field wasn't changed in the function color_pass to
point to a memory area sized for struct allocno_color_data.

It triggers ASAN and can be reproduced without ASAN with the attached
patch on a compiler built from revision gcc-13-3563-gf36bba013361
for target=microblazeel-linux-gnu:

$ gcc/cc1 -O2 _gcov.i
../../../../gcc/libgcc/libgcov-driver.c: In function ‘gcov_do_dump.constprop’:
../../../../gcc/libgcc/libgcov-driver.c:704:1: internal compiler error: in
assign_hard_reg, at ira-color.cc:2006

[Bug middle-end/107482] out-of-bounds heap access in IRA

[jcmvbkbc at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107482

--- Comment #1 from jcmvbkbc at gcc dot gnu.org ---
Created attachment 53807
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53807&action=edit
color-check.patch

[Bug rtl-optimization/107482] out-of-bounds heap access in IRA

[jcmvbkbc at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107482

jcmvbkbc at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Target|microblazeel-linux-gnu      |microblazeel-linux-gnu,
                   |                            |xtensa-linux-uclibc

--- Comment #2 from jcmvbkbc at gcc dot gnu.org ---
It can also be reproduced with the same input file and command line by the
compiler built from the same revision for target=xtensa-linux-uclibc.

[Bug rtl-optimization/107482] out-of-bounds heap access in IRA

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107482

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
https://gcc.gnu.org/pipermail/gcc/2022-October/239794.html

[Bug rtl-optimization/107482] out-of-bounds heap access in IRA

[jcmvbkbc at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107482

--- Comment #4 from jcmvbkbc at gcc dot gnu.org ---
The original ASAN report from the unmodified code:

==3761891==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x603000450ef8 at pc 0x000001a78e5c bp 0x7ffdcf35f2a0 sp 0x7ffdcf35f298
READ of size 8 at 0x603000450ef8 thread T0
    #0 0x1a78e5b in update_costs_from_allocno
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/ira-color.cc:1437
    #1 0x1a79983 in update_costs_from_copies
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/ira-color.cc:1524
    #2 0x1a7e5fa in assign_hard_reg
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/ira-color.cc:2213
    #3 0x1a8e35d in ira_reassign_conflict_allocnos(int)
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/ira-color.cc:4052
    #4 0x1a260ef in ira /home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/ira.cc:5834
    #5 0x1a27748 in execute /home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/ira.cc:6084
    #6 0x1e9b852 in execute_one_pass(opt_pass*)
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/passes.cc:2644
    #7 0x1e9c335 in execute_pass_list_1
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/passes.cc:2753
    #8 0x1e9c3b0 in execute_pass_list_1
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/passes.cc:2754
    #9 0x1e9c454 in execute_pass_list(function*, opt_pass*)
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/passes.cc:2764
    #10 0x1030e5d in cgraph_node::expand()
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/cgraphunit.cc:1834
    #11 0x1032294 in expand_all_functions
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/cgraphunit.cc:2008
    #12 0x103418c in symbol_table::compile()
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/cgraphunit.cc:2358
    #13 0x1034b20 in symbol_table::finalize_compilation_unit()
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/cgraphunit.cc:2543
    #14 0x23f702b in compile_file
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/toplev.cc:471
    #15 0x23ff902 in do_compile
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/toplev.cc:2125
    #16 0x240036d in toplev::main(int, char**)
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/toplev.cc:2277
    #17 0x4823f71 in main /home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/main.cc:39
    #18 0x7f1f4e4d4d09 in __libc_start_main ../csu/libc-start.c:308
    #19 0x9e4609 in _start
(/home/jcmvbkbc/ws/tensilica/gcc/builds/gcc-13-3563-gf36bba013361-windowed-be/gcc/cc1+0x9e4609)

0x603000450ef8 is located 0 bytes to the right of 24-byte region
[0x603000450ee0,0x603000450ef8)
freed by thread T0 here:
    #0 0x7f1f4ec6cb6f in __interceptor_free
../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:123
    #1 0xdf3132 in sbitmap_free(simple_bitmap_def*)
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/sbitmap.h:247
    #2 0xef31f1 in auto_sbitmap::~auto_sbitmap()
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/sbitmap.h:304
    #3 0x1aba525 in remove_some_program_points_and_update_live_ranges
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/ira-lives.cc:1586
    #4 0x1abad9f in ira_compress_allocno_live_ranges()
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/ira-lives.cc:1750
    #5 0x1a44483 in ira_flattening(int, int)
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/ira-build.cc:3392
    #6 0x1a26074 in ira /home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/ira.cc:5816
    #7 0x1a27748 in execute /home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/ira.cc:6084
    #8 0x1e9b852 in execute_one_pass(opt_pass*)
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/passes.cc:2644
    #9 0x1e9c335 in execute_pass_list_1
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/passes.cc:2753
    #10 0x1e9c3b0 in execute_pass_list_1
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/passes.cc:2754
    #11 0x1e9c454 in execute_pass_list(function*, opt_pass*)
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/passes.cc:2764
    #12 0x1030e5d in cgraph_node::expand()
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/cgraphunit.cc:1834
    #13 0x1032294 in expand_all_functions
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/cgraphunit.cc:2008
    #14 0x103418c in symbol_table::compile()
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/cgraphunit.cc:2358
    #15 0x1034b20 in symbol_table::finalize_compilation_unit()
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/cgraphunit.cc:2543
    #16 0x23f702b in compile_file
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/toplev.cc:471
    #17 0x23ff902 in do_compile
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/toplev.cc:2125
    #18 0x240036d in toplev::main(int, char**)
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/toplev.cc:2277
    #19 0x4823f71 in main /home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/main.cc:39
    #20 0x7f1f4e4d4d09 in __libc_start_main ../csu/libc-start.c:308

previously allocated by thread T0 here:
    #0 0x7f1f4ec6ce8f in __interceptor_malloc
../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x49fb588 in xmalloc
/home/jcmvbkbc/ws/tensilica/gcc/gcc/libiberty/xmalloc.c:149

SUMMARY: AddressSanitizer: heap-buffer-overflow
/home/jcmvbkbc/ws/tensilica/gcc/gcc/gcc/ira-color.cc:1437 in
update_costs_from_allocno
Shadow bytes around the buggy address:
  0x0c0680082180: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd
  0x0c0680082190: fd fd fa fa fd fd fd fd fa fa fd fd fd fa fa fa
  0x0c06800821a0: fd fd fd fa fa fa fd fd fd fd fa fa fd fd fd fa
  0x0c06800821b0: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd
  0x0c06800821c0: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa
=>0x0c06800821d0: fd fd fd fd fa fa 00 00 00 fa fa fa fd fd fd[fa]
  0x0c06800821e0: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fa fa
  0x0c06800821f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0680082200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0680082210: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0680082220: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

[Bug rtl-optimization/107482] out-of-bounds heap access in IRA

[jcmvbkbc at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107482

--- Comment #5 from jcmvbkbc at gcc dot gnu.org ---
I've bisected this issue to commit 86f0bef37378 ("re PR target/61578 (Code size
increase for ARM thumb compared to 4.8.x when compiling with -Os)")

[Bug rtl-optimization/107482] [10/11/12/13 Regression] out-of-bounds heap access in IRA since r6-3496-g86f0bef37378a0

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107482

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|out-of-bounds heap access   |[10/11/12/13 Regression]
                   |in IRA                      |out-of-bounds heap access
                   |                            |in IRA since
                   |                            |r6-3496-g86f0bef37378a0
   Target Milestone|---                         |10.5

--- Comment #6 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to jcmvbkbc from comment #5)
> I've bisected this issue to commit 86f0bef37378 ("re PR target/61578 (Code
> size increase for ARM thumb compared to 4.8.x when compiling with -Os)")

r6-3496-g86f0bef37378a0

[Bug rtl-optimization/107482] [10/11/12/13 Regression] out-of-bounds heap access in IRA since r6-3496-g86f0bef37378a0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107482

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2
                 CC|                            |vmakarov at gcc dot gnu.org

[Bug rtl-optimization/107482] [10/11/12/13 Regression] out-of-bounds heap access in IRA since r6-3496-g86f0bef37378a0

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107482

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Max Filippov <jcmvbkbc@gcc.gnu.org>:

https://gcc.gnu.org/g:e581490f0cfa80c58d2b648d71a44a597fbe3008

commit r13-3801-ge581490f0cfa80c58d2b648d71a44a597fbe3008
Author: Max Filippov <jcmvbkbc@gmail.com>
Date:   Mon Nov 7 13:58:49 2022 -0800

    gcc: fix PR rtl-optimization/107482

    gcc/
            PR rtl-optimization/107482
            * ira-color.cc (assign_hard_reg): Only call
            update_costs_from_copies when retry_p is false.

[Bug rtl-optimization/107482] [10/11/12 Regression] out-of-bounds heap access in IRA since r6-3496-g86f0bef37378a0

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107482

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[10/11/12/13 Regression]    |[10/11/12 Regression]
                   |out-of-bounds heap access   |out-of-bounds heap access
                   |in IRA since                |in IRA since
                   |r6-3496-g86f0bef37378a0     |r6-3496-g86f0bef37378a0
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Assuming this is fixed on the trunk.

[Bug rtl-optimization/107482] [10/11/12 Regression] out-of-bounds heap access in IRA since r6-3496-g86f0bef37378a0

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107482

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
                 CC|                            |marxin at gcc dot gnu.org
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2022-11-21

[Bug rtl-optimization/107482] [10/11/12 Regression] out-of-bounds heap access in IRA since r6-3496-g86f0bef37378a0

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107482

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Max Filippov
<jcmvbkbc@gcc.gnu.org>:

https://gcc.gnu.org/g:1fb5287dfcf3bef8adea98a4bded441c95e43914

commit r12-8947-g1fb5287dfcf3bef8adea98a4bded441c95e43914
Author: Max Filippov <jcmvbkbc@gmail.com>
Date:   Mon Nov 7 13:58:49 2022 -0800

    gcc: fix PR rtl-optimization/107482

    gcc/
            PR rtl-optimization/107482
            * ira-color.cc (assign_hard_reg): Only call
            update_costs_from_copies when retry_p is false.

    (cherry picked from commit e581490f0cfa80c58d2b648d71a44a597fbe3008)

[Bug rtl-optimization/107482] [10/11/12 Regression] out-of-bounds heap access in IRA since r6-3496-g86f0bef37378a0

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107482

--- Comment #10 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Max Filippov
<jcmvbkbc@gcc.gnu.org>:

https://gcc.gnu.org/g:01df02a881a0b6d7c5746e717a9d0355ee4e747a

commit r11-10399-g01df02a881a0b6d7c5746e717a9d0355ee4e747a
Author: Max Filippov <jcmvbkbc@gmail.com>
Date:   Mon Nov 7 13:58:49 2022 -0800

    gcc: fix PR rtl-optimization/107482

    gcc/
            PR rtl-optimization/107482
            * ira-color.c (assign_hard_reg): Only call
            update_costs_from_copies when retry_p is false.

    (cherry picked from commit e581490f0cfa80c58d2b648d71a44a597fbe3008)

[Bug rtl-optimization/107482] [10/11/12 Regression] out-of-bounds heap access in IRA since r6-3496-g86f0bef37378a0

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107482

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Max Filippov
<jcmvbkbc@gcc.gnu.org>:

https://gcc.gnu.org/g:bd6963543042ce713d290c23e098de84865a287f

commit r10-11100-gbd6963543042ce713d290c23e098de84865a287f
Author: Max Filippov <jcmvbkbc@gmail.com>
Date:   Mon Nov 7 13:58:49 2022 -0800

    gcc: fix PR rtl-optimization/107482

    gcc/
            PR rtl-optimization/107482
            * ira-color.c (assign_hard_reg): Only call
            update_costs_from_copies when retry_p is false.

    (cherry picked from commit e581490f0cfa80c58d2b648d71a44a597fbe3008)

[Bug rtl-optimization/107482] [10/11/12 Regression] out-of-bounds heap access in IRA since r6-3496-g86f0bef37378a0

[jcmvbkbc at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107482

jcmvbkbc at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #12 from jcmvbkbc at gcc dot gnu.org ---
Fix backported to gcc-12, gcc-11 and gcc-10.