public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug sanitizer/58543] New: Invalid unpoisoning of stack redzones on ARM
@ 2013-09-26 15:05 y.gribov at samsung dot com
  2013-09-26 15:06 ` [Bug sanitizer/58543] " y.gribov at samsung dot com
                   ` (10 more replies)
  0 siblings, 11 replies; 12+ messages in thread
From: y.gribov at samsung dot com @ 2013-09-26 15:05 UTC (permalink / raw)
  To: gcc-bugs

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58543

            Bug ID: 58543
           Summary: Invalid unpoisoning of stack redzones on ARM
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: sanitizer
          Assignee: unassigned at gcc dot gnu.org
          Reporter: y.gribov at samsung dot com
                CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
                    jakub at gcc dot gnu.org, kcc at gcc dot gnu.org

Created attachment 30902
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=30902&action=edit
Repro

Gcc seems to generate mismatched prologue/epilogue code to poison/unpoison
stack frame for the attached source code when I compile it with

 $ ~/install/gcc-master-arm/bin/arm-v7a15v3r2-linux-gnueabi-gcc bad.i -O0 -S
-fsanitize=address

Prologue seems to poison words at frame_shadow_base + { 0, 4, 8, 12, 16, 24,
28}:

  add  r4, r3, #536870912
  ldr  r3, .L3+8
  str  r3, [r4]
  ldr  r3, .L3+12
  str  r3, [r4, #4]
  ldr  r3, .L3+16
  str  r3, [r4, #8]
  ldr  r3, .L3+20
  str  r3, [r4, #12]
  ldr  r3, .L3+16
  str  r3, [r4, #16]
  ldr  r3, .L3+20
  str  r3, [r4, #24]
  ldr  r3, .L3+24
  str  r3, [r4, #28]

Whereas epilogue poisons frame_shadow_base + { 0, 4, 8, 12, 16, 40, 44}:

  add  r3, r4, #20
.L1:
  mov  r2, #0
  str  r2, [r4]
  add  r4, r4, #4
  cmp  r4, r3
  bcc  .L1
  add  r3, r4, #24   ; r3 gets invalid value here
  mov  r2, #0
  strb  r2, [r3]
  add  r3, r3, #1
  mov  r2, #0
  strb  r2, [r3]
  add  r3, r3, #1
  mov  r2, #0
  strb  r2, [r3]
  add  r3, r3, #1
  mov  r2, #0
  strb  r2, [r3]
  add  r3, r3, #1
  mov  r2, #0
  strb  r2, [r3]
  add  r3, r3, #1
  mov  r2, #0
  strb  r2, [r3]
  add  r3, r3, #1
  mov  r2, #0
  strb  r2, [r3]
  add  r3, r3, #1
  mov  r2, #0
  strb  r2, [r3]

This causes some shadow bytes to remain set after function returns. Those may
trigger incorrect Asan errors later.

-Y


PS: my configuration:

* GCC version: trunk, September 24

* OS: Ubuntu 12.04

* GCC configuration string: ~/gcc/gcc-master/configure
--target=arm-v7a15v3r2-linux-gnueabi
--prefix=/home/ygribov/install/gcc-master-arm --disable-libmudflap
--disable-libssp --disable-nls --enable-long-long --enable-languages=c,c++
--disable-bootstrap --disable-multilib --disable-libstdcxx --disable-libgcc
--disable-libgomp --disable-libatomic --disable-libquadmath
--disable-libstdc++-v3 --disable-libsanitizer --disable-libitm


^ permalink raw reply	[flat|nested] 12+ messages in thread
end of thread, other threads:[~2013-11-15  8:34 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-09-26 15:05 [Bug sanitizer/58543] New: Invalid unpoisoning of stack redzones on ARM y.gribov at samsung dot com
2013-09-26 15:06 ` [Bug sanitizer/58543] " y.gribov at samsung dot com
2013-09-26 15:06 ` y.gribov at samsung dot com
2013-09-27  9:56 ` y.gribov at samsung dot com
2013-09-30 10:15 ` dodji at seketeli dot org
2013-09-30 10:26 ` y.gribov at samsung dot com
2013-10-01  8:28 ` y.gribov at samsung dot com
2013-10-02  6:18 ` y.gribov at samsung dot com
2013-10-18 11:04 ` y.gribov at samsung dot com
2013-10-31  9:58 ` ramana at gcc dot gnu.org
2013-10-31 12:10 ` ygribov at gcc dot gnu.org
2013-11-15  8:34 ` y.gribov at samsung dot com

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).