public inbox for gcc-bugs@sourceware.org help / color / mirror / Atom feed
From: "sneves at dei dot uc.pt" <gcc-bugzilla@gcc.gnu.org> To: gcc-bugs@gcc.gnu.org Subject: [Bug sanitizer/110027] New: Misaligned vector store on detect_stack_use_after_return Date: Mon, 29 May 2023 20:18:55 +0000 [thread overview] Message-ID: <bug-110027-4@http.gcc.gnu.org/bugzilla/> (raw) https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110027 Bug ID: 110027 Summary: Misaligned vector store on detect_stack_use_after_return Product: gcc Version: 13.1.1 Status: UNCONFIRMED Severity: normal Priority: P3 Component: sanitizer Assignee: unassigned at gcc dot gnu.org Reporter: sneves at dei dot uc.pt CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org, jakub at gcc dot gnu.org, kcc at gcc dot gnu.org, marxin at gcc dot gnu.org Target Milestone: --- (As reported by Jack O'Connor, along with reproducibility instructions, at https://gist.github.com/oconnor663/69176654f1db1bb96077d6ff4141a022) Given the following snippet, #include <immintrin.h> int main() { __m512i v = _mm512_set1_epi32(0); // It doesn't really matter what we do next, as long as we convince the // compiler to put v on the stack. Here we just read an int from it. return *((int *)&v); } compiled with `gcc repro.c -g -mavx512f -fsanitize=address` results in a segfault due to a misaligned AVX-512 store. The assembly output is visible at https://gist.github.com/oconnor663/69176654f1db1bb96077d6ff4141a022#file-repro-s. Specifically, we have the relevant sequence andq $-64, %rsp subq $192, %rsp leaq 32(%rsp), %rbx ... cmpl $0, __asan_option_detect_stack_use_after_return(%rip) je .L1 ... call __asan_stack_malloc_1@PLT ... movq %rax, %rbx ... .L1: leaq 160(%rbx), %rax movq %rax, %rcx ... vmovdqa64 %zmm0, -128(%rcx) Now, if `__asan_option_detect_stack_use_after_return` is 0, the variable at %rcx-128 is correctly aligned to 64. However, if it is 1, __asan_stack_malloc_1 returns something aligned to 64 << 1 (as per https://github.com/gcc-mirror/gcc/blob/master/gcc/asan.cc#L1917) and adding 160 results in %rcx-128 being only aligned to 32. And thus the segfault. Interestingly this seems to be only reproducible on Arch Linux. Other gcc 13.1.1 builds, Fedora for instance, seem to behave correctly. It is unclear to me what the reason for this is.
next reply other threads:[~2023-05-29 20:18 UTC|newest] Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top 2023-05-29 20:18 sneves at dei dot uc.pt [this message] 2023-05-29 20:54 ` [Bug target/110027] " pinskia at gcc dot gnu.org 2023-05-30 8:06 ` rguenth at gcc dot gnu.org 2023-05-30 14:49 ` oconnor663 at gmail dot com 2023-10-22 18:06 ` gcc at sicherha dot de 2023-12-01 17:42 ` pinskia at gcc dot gnu.org 2023-12-01 17:46 ` pinskia at gcc dot gnu.org 2023-12-17 23:24 ` pinskia at gcc dot gnu.org 2024-03-08 4:13 ` pinskia at gcc dot gnu.org 2024-03-08 11:41 ` elrodc at gmail dot com 2024-03-08 18:10 ` gcc at sicherha dot de 2024-03-08 18:52 ` [Bug target/110027] [11/12/13/14 regression] " sjames at gcc dot gnu.org 2024-03-11 3:28 ` liuhongt at gcc dot gnu.org 2024-03-12 5:10 ` liuhongt at gcc dot gnu.org 2024-03-12 6:35 ` liuhongt at gcc dot gnu.org 2024-03-15 1:51 ` liuhongt at gcc dot gnu.org 2024-03-25 12:34 ` rguenth at gcc dot gnu.org 2024-04-08 15:43 ` xry111 at gcc dot gnu.org 2024-04-09 18:25 ` [Bug target/110027] [11/12/13/14 regression] Stack objects with extended alignments (vectors etc) misaligned " jakub at gcc dot gnu.org 2024-04-10 10:25 ` [Bug middle-end/110027] " jakub at gcc dot gnu.org 2024-04-11 6:53 ` liuhongt at gcc dot gnu.org 2024-04-11 8:16 ` jakub at gcc dot gnu.org 2024-04-11 9:14 ` cvs-commit at gcc dot gnu.org 2024-04-11 10:06 ` [Bug middle-end/110027] [11/12/13 " jakub at gcc dot gnu.org 2024-04-12 18:09 ` carlos.seo at linaro dot org 2024-04-21 4:09 ` cvs-commit at gcc dot gnu.org 2024-04-23 6:44 ` [Bug middle-end/110027] [11/12 " jakub at gcc dot gnu.org
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=bug-110027-4@http.gcc.gnu.org/bugzilla/ \ --to=gcc-bugzilla@gcc.gnu.org \ --cc=gcc-bugs@gcc.gnu.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).