public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
From: "torvalds@linux-foundation.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug tree-optimization/108552] Linux i386 kernel 5.14 memory corruption for pre_compound_page() when gcov is enabled
Date: Fri, 27 Jan 2023 17:00:59 +0000	[thread overview]
Message-ID: <bug-108552-4-Wum9p894Hy@http.gcc.gnu.org/bugzilla/> (raw)
In-Reply-To: <bug-108552-4@http.gcc.gnu.org/bugzilla/>

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108552

--- Comment #30 from Linus Torvalds <torvalds@linux-foundation.org> ---
(In reply to Richard Biener from comment #26)
> And yes, to IV optimization the gcov counter for the loop body is just
> another IV candidate that can be used, and in this case it allows to elide
> the otherwise
> unused original IV.

Ouch.

So we really don't mind the data race - the gcov data is obviously not primary
- but I don't think anybody expected the data race on the gcov data that isn't
"semantically visible" to then affect actual semantics.

And yeah, atomic updates would be too expensive even on 64-bit architectures,
so we pretty much *depend* on the data race being there. And on 32-bit
architectures (at least i386), atomic 64-bit ones go from "expensive" to
"ludicrously complicated" (ie to get a 64-bit atomic update you'd need to start
doing cmpxchg8b loops or something).

So I think the data race is not just what we expected, it's fundamental. Just
the "mix it with semantics" ends up being less than optimal. 

Having the gcov data be treated as 'volatile' would be one option, but probably
cause horrendous code generation issues as Jakub says.

Although I have several times hit that "I want to just update a volatile in
memory, I wish gcc would just be happy to combine a 'read-modify-update' to a
single instruction". So in a perfect world, that would be fixed too.

I guess from a kernel perspective, we might need to really document that GCOV
has these issues, and you can't use it for any real work. We have just been
lucky this hasn't hit us (admittedly because it's fairly odd that an expected
end gcov value would end up being used in that secondary way as a loop
variable).

  parent reply	other threads:[~2023-01-27 17:01 UTC|newest]

Thread overview: 48+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-01-26  8:00 [Bug c/108552] New: " feng.tang at intel dot com
2023-01-26  8:01 ` [Bug c/108552] " feng.tang at intel dot com
2023-01-26  8:02 ` [Bug target/108552] " pinskia at gcc dot gnu.org
2023-01-26  8:05 ` pinskia at gcc dot gnu.org
2023-01-26  8:13 ` feng.tang at intel dot com
2023-01-26  8:19 ` pinskia at gcc dot gnu.org
2023-01-26 11:35 ` feng.tang at intel dot com
2023-01-26 11:37 ` feng.tang at intel dot com
2023-01-26 11:39 ` feng.tang at intel dot com
2023-01-26 16:03 ` feng.tang at intel dot com
2023-01-26 16:07 ` feng.tang at intel dot com
2023-01-26 19:06 ` pinskia at gcc dot gnu.org
2023-01-26 19:22 ` torvalds@linux-foundation.org
2023-01-27  9:52 ` ubizjak at gmail dot com
2023-01-27 10:47 ` ubizjak at gmail dot com
2023-01-27 10:56 ` ubizjak at gmail dot com
2023-01-27 12:23 ` ubizjak at gmail dot com
2023-01-27 12:29 ` ubizjak at gmail dot com
2023-01-27 12:31 ` [Bug tree-optimization/108552] " ubizjak at gmail dot com
2023-01-27 12:51 ` ubizjak at gmail dot com
2023-01-27 12:52 ` ubizjak at gmail dot com
2023-01-27 13:17 ` jakub at gcc dot gnu.org
2023-01-27 13:40 ` ubizjak at gmail dot com
2023-01-27 14:14 ` jakub at gcc dot gnu.org
2023-01-27 14:59 ` rguenth at gcc dot gnu.org
2023-01-27 15:01 ` rguenth at gcc dot gnu.org
2023-01-27 15:13 ` rguenth at gcc dot gnu.org
2023-01-27 15:15 ` jakub at gcc dot gnu.org
2023-01-27 15:18 ` rguenth at gcc dot gnu.org
2023-01-27 15:20 ` jakub at gcc dot gnu.org
2023-01-27 17:00 ` torvalds@linux-foundation.org [this message]
2023-01-27 17:05 ` torvalds@linux-foundation.org
2023-01-27 17:15 ` torvalds@linux-foundation.org
2023-01-27 17:19 ` jakub at gcc dot gnu.org
2023-01-27 17:29 ` jakub at gcc dot gnu.org
2023-01-27 22:30 ` vmakarov at gcc dot gnu.org
2023-01-28 14:20 ` feng.tang at intel dot com
2023-01-28 14:27 ` feng.tang at intel dot com
2023-01-28 14:29 ` feng.tang at intel dot com
2023-01-28 23:40 ` hubicka at ucw dot cz
2023-01-29 10:08 ` jakub at gcc dot gnu.org
2023-01-30  7:05 ` rguenth at gcc dot gnu.org
2023-01-30  7:09 ` rguenth at gcc dot gnu.org
2023-01-30  8:06 ` torvalds@linux-foundation.org
2023-01-30  8:30 ` jakub at gcc dot gnu.org
2023-01-30  8:44 ` rguenth at gcc dot gnu.org
2023-01-30  8:46 ` rguenther at suse dot de
2023-01-30 18:54 ` torvalds@linux-foundation.org

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=bug-108552-4-Wum9p894Hy@http.gcc.gnu.org/bugzilla/ \
    --to=gcc-bugzilla@gcc.gnu.org \
    --cc=gcc-bugs@gcc.gnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).