[Bug c/35092] New: Global variable reference not resolved with -Os option

[Bug c/35092] New: Global variable reference not resolved with -Os option

[lee_merrill at yahoo dot com]

When the -Os option is specified, a global variable reference can generate code
that has a relocation-style entry, i.e. "load register A with 0x30", which
causes an invalid pointer reference. This was found in Linux kernel version
2.6.16.27-0.9-smp in Suse, compiling a driver, which seems to have the -Os
option turned on by default.

The following code duplicates the problem, type "make" and run "btifc" to get a
core dump.

Makefile:
CFLAGS = -Wall -Werror -g -Os

btifc: fcInclude.h fcMain.c lxTracing.c
        cc -o btifc $(CFLAGS) fcMain.c lxTracing.c

clean:
        rm -f btifc core*

----------
fcInclude.h:

typedef unsigned int u32;

extern u32 LxTrace_FC_UNKNOWN_APPL_PKT;

#ifdef LX_TRACE_INCLUDE_C_CODE

u32 LxTrace_FC_UNKNOWN_APPL_PKT;

#endif

extern u32 LxTraceLevel;

extern void lxTraceCopy(unsigned tag, u32 tagValue, unsigned code,
        const void *traceData, unsigned len);

typedef struct _lxTraceCode
{
    int         pri;
} lxTraceCode;

extern lxTraceCode LxTraceCode[];
typedef struct _fcBufPrefix
{ // The prefix for iuElt / ctrlBuf / applPkt buffers
    struct _fcPort         *port;               // The port this buffer is for
    int bufState;
} fcBufPrefix;

typedef struct _fcApplPkt
{ // Application packet, data flowing from and to the application
    fcBufPrefix         pfx;
    int subType;

    struct _fcCtrlBuf  *ccw;
} fcApplPkt;

typedef struct _FC_SB2
{
    char type;
} FC_SB2;

typedef struct _fcCtrlBuf
{
    fcBufPrefix         pfx;
    unsigned ctrlPath;

    FC_SB2              sb2;
} fcCtrlBuf;

typedef struct _fcSubchannel
{
    unsigned            traceTag;       // Current trace tag for this cu/sub
    u32                 curTagVal;      // Current tag value for this cu/sub
} fcSubchannel;

---------
lxTracing.c:

#include "fcInclude.h"

lxTraceCode LxTraceCode[5];
u32 LxTraceLevel;

void
lxTraceCopy(unsigned tagIdx, u32 tagValue, unsigned code, const void
*traceData, unsigned traceDataLen)
{
}

int
lxCopyTrace(void *elt, void *parm1, void *parm2)
{
    return 0;
}

void *
runSome(void)
{
    return (void *) 0;
}

----------
fcMain.c:

#include <stdio.h>
#include <malloc.h>

#define LX_TRACE_INCLUDE_C_CODE // Only define this once, here in fcMain.c

#include "fcInclude.h"

fcCtrlBuf *FcCtrlBuf;
fcApplPkt *FcApplPkt;
fcSubchannel FcSubchannel;

extern void *runSome(void);
int fcProcessMas(fcSubchannel *cuSub);

int
main(int argc, char **argv)
{
    FcApplPkt = (fcApplPkt *) malloc(sizeof(*FcApplPkt));

    FcCtrlBuf = runSome();
    fcProcessMas(&FcSubchannel);

    free(FcApplPkt);

    return 0;
}

int
fcProcessMas(fcSubchannel *cuSub)
{
    fcCtrlBuf *ctrl = FcCtrlBuf;
    fcApplPkt *pkt = FcApplPkt;
    FC_SB2 *sb2;

    while (1) {
        if (ctrl) {
            sb2 = &ctrl->sb2;
            switch (sb2->type & 5) {
            case 4:
                break;

            default:
    if(LxTraceCode[LxTrace_FC_UNKNOWN_APPL_PKT].pri >= LxTraceLevel) {
        u32 _parm_[1] = { (u32) (pkt->subType) };
                                            \
        lxTraceCopy(cuSub->traceTag, ctrl->ctrlPath,
LxTrace_FC_UNKNOWN_APPL_PKT, _parm_, 
4);
    }
                break;
            }
        } else if (pkt) {
            switch (pkt->subType) {
            default:
    if(LxTraceCode[LxTrace_FC_UNKNOWN_APPL_PKT].pri >= LxTraceLevel) {
        u32 _parm_[1] = { (u32) (pkt->subType) };
                                            \
        lxTraceCopy(cuSub->traceTag, ctrl->ctrlPath,
LxTrace_FC_UNKNOWN_APPL_PKT, _parm_, 
4);
    }
                break;

    return 0;
}


-- 
           Summary: Global variable reference not resolved with -Os option
           Product: gcc
           Version: 4.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: lee_merrill at yahoo dot com
 GCC build triplet: i586-suse-linux
  GCC host triplet: i586-suse-linux
GCC target triplet: i586-suse-linux


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=35092

[Bug c/35092] Global variable reference not resolved with -Os option

[lee_merrill at yahoo dot com]

------- Comment #1 from lee_merrill at yahoo dot com  2008-02-05 15:51 -------
Created an attachment (id=15101)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=15101&action=view)
The source code for causing the described problem

Type "make" and then run "btifc" to cause a core dump. The disassembly shows:

 8048473:       ff 35 08 00 00 00       pushl  0x8

which is the bad address which causes the core dump.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=35092

[Bug c/35092] Global variable reference not resolved with -Os option

[pluto at agmk dot net]

------- Comment #2 from pluto at agmk dot net  2008-02-05 16:33 -------
(In reply to comment #0)

it's not a gcc bug, it's a null pointer dereference.

>     while (1) {
>         if (ctrl) {
>             (...)
>             lxTraceCopy(cuSub->traceTag, ctrl->ctrlPath, ...
>         } else if (pkt) {
>             (...)
>             lxTraceCopy(cuSub->traceTag, ctrl->ctrlPath, ...
                                           ^^^^
              in this else-if branch compiler assumes ctrl == 0
              and pushes to stack only 0x8 (pure offset to ctrlPath field).


-- 

pluto at agmk dot net changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |pluto at agmk dot net


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=35092

[Bug c/35092] Global variable reference not resolved with -Os option

[rguenth at gcc dot gnu dot org]

------- Comment #3 from rguenth at gcc dot gnu dot org  2008-02-05 16:57 -------
Thus, invalid.


-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |INVALID


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=35092

[Bug c/35092] Global variable reference not resolved with -Os option

[lee_merrill at yahoo dot com]

------- Comment #4 from lee_merrill at yahoo dot com  2008-02-05 19:58 -------
It might be good to have the compiler issue a warning for such? It's neat that
it can tell that it's got a zero pointer...


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=35092

[Bug c/35092] Global variable reference not resolved with -Os option

[steven at gcc dot gnu dot org]

------- Comment #5 from steven at gcc dot gnu dot org  2008-02-06 09:05 -------
There was -Wnull-dereference once.  I don't know if it still exists.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=35092