* [Bug sanitizer/60861] out of bounds access of global var in .rodata/.bss not detected
2014-04-16 15:17 [Bug sanitizer/60861] New: out of bounds access of global var in .rodata/.bss not detected jan.smets@alcatel-lucent.com
@ 2014-04-16 19:02 ` kcc at gcc dot gnu.org
2014-04-16 21:33 ` jan.smets@alcatel-lucent.com
` (5 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: kcc at gcc dot gnu.org @ 2014-04-16 19:02 UTC (permalink / raw)
To: gcc-bugs
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60861
--- Comment #1 from Kostya Serebryany <kcc at gcc dot gnu.org> ---
Will adding "-fno-common" help?
Or building the test as C++?
See https://code.google.com/p/address-sanitizer/wiki/Flags
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Bug sanitizer/60861] out of bounds access of global var in .rodata/.bss not detected
2014-04-16 15:17 [Bug sanitizer/60861] New: out of bounds access of global var in .rodata/.bss not detected jan.smets@alcatel-lucent.com
2014-04-16 19:02 ` [Bug sanitizer/60861] " kcc at gcc dot gnu.org
@ 2014-04-16 21:33 ` jan.smets@alcatel-lucent.com
2014-04-17 5:00 ` y.gribov at samsung dot com
` (4 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: jan.smets@alcatel-lucent.com @ 2014-04-16 21:33 UTC (permalink / raw)
To: gcc-bugs
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60861
--- Comment #2 from Jan Smets <jan.smets@alcatel-lucent.com> ---
Using -fno-common (while compiling as C), or compiling as C++ works for the
unitialized bss example:
int testGlobalOutOfBoundsRODATAVar[5]; /* bss : works with -fno-common
(compiled as C) or when compiled as C++ */
but not for the .rodata example.
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Bug sanitizer/60861] out of bounds access of global var in .rodata/.bss not detected
2014-04-16 15:17 [Bug sanitizer/60861] New: out of bounds access of global var in .rodata/.bss not detected jan.smets@alcatel-lucent.com
2014-04-16 19:02 ` [Bug sanitizer/60861] " kcc at gcc dot gnu.org
2014-04-16 21:33 ` jan.smets@alcatel-lucent.com
@ 2014-04-17 5:00 ` y.gribov at samsung dot com
2014-04-17 5:04 ` pinskia at gcc dot gnu.org
` (3 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: y.gribov at samsung dot com @ 2014-04-17 5:00 UTC (permalink / raw)
To: gcc-bugs
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60861
Yury Gribov <y.gribov at samsung dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |y.gribov at samsung dot com
--- Comment #3 from Yury Gribov <y.gribov at samsung dot com> ---
I can reproduce this in trunk. Looks like Asan pass works correctly but gcc
reduces test() to 'return 1;' very early for some reason. I'll debug further.
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Bug sanitizer/60861] out of bounds access of global var in .rodata/.bss not detected
2014-04-16 15:17 [Bug sanitizer/60861] New: out of bounds access of global var in .rodata/.bss not detected jan.smets@alcatel-lucent.com
` (2 preceding siblings ...)
2014-04-17 5:00 ` y.gribov at samsung dot com
@ 2014-04-17 5:04 ` pinskia at gcc dot gnu.org
2014-04-17 6:32 ` y.gribov at samsung dot com
` (2 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: pinskia at gcc dot gnu.org @ 2014-04-17 5:04 UTC (permalink / raw)
To: gcc-bugs
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60861
--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Yury Gribov from comment #3)
> I can reproduce this in trunk. Looks like Asan pass works correctly but gcc
> reduces test() to 'return 1;' very early for some reason. I'll debug further.
Most likely due to GCC optimizing the code as it knows the only value it could
be is 1. Try it with a two element constant array and you most likely get the
result you want.
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Bug sanitizer/60861] out of bounds access of global var in .rodata/.bss not detected
2014-04-16 15:17 [Bug sanitizer/60861] New: out of bounds access of global var in .rodata/.bss not detected jan.smets@alcatel-lucent.com
` (3 preceding siblings ...)
2014-04-17 5:04 ` pinskia at gcc dot gnu.org
@ 2014-04-17 6:32 ` y.gribov at samsung dot com
2014-04-17 8:30 ` kcc at gcc dot gnu.org
2014-04-17 9:13 ` jakub at gcc dot gnu.org
6 siblings, 0 replies; 8+ messages in thread
From: y.gribov at samsung dot com @ 2014-04-17 6:32 UTC (permalink / raw)
To: gcc-bugs
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60861
--- Comment #5 from Yury Gribov <y.gribov at samsung dot com> ---
(In reply to Andrew Pinski from comment #4)
> (In reply to Yury Gribov from comment #3)
> > I can reproduce this in trunk. Looks like Asan pass works correctly but gcc
> > reduces test() to 'return 1;' very early for some reason. I'll debug further.
>
> Most likely due to GCC optimizing the code as it knows the only value it
> could be is 1.
Yup, testGlobalOutOfBoundsRODATAVar[depth] is cynically folded to 1 right in
the gimplifier:
#0 fold_array_ctor_reference (type=0x7ffff6c93000, ctor=0x7ffff6c7ae28,
offset=0, size=32, from_decl=0x7ffff6c91098) at
/home/ygribov/src/gcc-master/gcc/gimple-fold.c:2994
#1 0x00000000007fbc4b in fold_ctor_reference (type=0x7ffff6c93000,
ctor=0x7ffff6c7ae28, offset=0, size=32, from_decl=0x7ffff6c91098) at
/home/ygribov/src/gcc-master/gcc/gimple-fold.c:3124
#2 0x00000000007fc1b4 in fold_const_aggregate_ref_1 (t=0x7ffff6c35188,
valueize=0) at /home/ygribov/src/gcc-master/gcc/gimple-fold.c:3226
#3 0x00000000007fc2d7 in fold_const_aggregate_ref (t=0x7ffff6c35188) at
/home/ygribov/src/gcc-master/gcc/gimple-fold.c:3248
#4 0x00000000007f2478 in maybe_fold_reference (expr=0x7ffff6c35188,
is_lhs=false) at /home/ygribov/src/gcc-master/gcc/gimple-fold.c:310
#5 0x00000000007f2957 in fold_gimple_assign (si=0x7fffffffd1f0) at
/home/ygribov/src/gcc-master/gcc/gimple-fold.c:377
#6 0x00000000007f57a2 in fold_stmt_1 (gsi=0x7fffffffd1f0, inplace=false) at
/home/ygribov/src/gcc-master/gcc/gimple-fold.c:1281
#7 0x00000000007f5eba in fold_stmt (gsi=0x7fffffffd1f0) at
/home/ygribov/src/gcc-master/gcc/gimple-fold.c:1409
#8 0x00000000008115d1 in maybe_fold_stmt (gsi=0x7fffffffd1f0) at
/home/ygribov/src/gcc-master/gcc/gimplify.c:2224
#9 0x000000000081af78 in gimplify_modify_expr (expr_p=0x7fffffffd4a8,
pre_p=0x7fffffffd760, post_p=0x7fffffffd330, want_value=false) at
/home/ygribov/src/gcc-master/gcc/gimplify.c:4620
#10 0x0000000000826bf4 in gimplify_expr (expr_p=0x7fffffffd4a8,
pre_p=0x7fffffffd760, post_p=0x7fffffffd330, gimple_test_f=0x819e8b
<is_gimple_stmt(tree)>, fallback=0) at
/home/ygribov/src/gcc-master/gcc/gimplify.c:7479
This kind of makes sense (although this optimization will break in presence of
LD_PRELOAD or weak symbols). In any case optimizations like this are typical
for gcc so I'm not sure there's a chance for a fix.
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Bug sanitizer/60861] out of bounds access of global var in .rodata/.bss not detected
2014-04-16 15:17 [Bug sanitizer/60861] New: out of bounds access of global var in .rodata/.bss not detected jan.smets@alcatel-lucent.com
` (4 preceding siblings ...)
2014-04-17 6:32 ` y.gribov at samsung dot com
@ 2014-04-17 8:30 ` kcc at gcc dot gnu.org
2014-04-17 9:13 ` jakub at gcc dot gnu.org
6 siblings, 0 replies; 8+ messages in thread
From: kcc at gcc dot gnu.org @ 2014-04-17 8:30 UTC (permalink / raw)
To: gcc-bugs
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60861
Kostya Serebryany <kcc at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |RESOLVED
Resolution|--- |WORKSFORME
--- Comment #6 from Kostya Serebryany <kcc at gcc dot gnu.org> ---
None of these is an asan bug, closing.
Feel free to reopen if you disagree.
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Bug sanitizer/60861] out of bounds access of global var in .rodata/.bss not detected
2014-04-16 15:17 [Bug sanitizer/60861] New: out of bounds access of global var in .rodata/.bss not detected jan.smets@alcatel-lucent.com
` (5 preceding siblings ...)
2014-04-17 8:30 ` kcc at gcc dot gnu.org
@ 2014-04-17 9:13 ` jakub at gcc dot gnu.org
6 siblings, 0 replies; 8+ messages in thread
From: jakub at gcc dot gnu.org @ 2014-04-17 9:13 UTC (permalink / raw)
To: gcc-bugs
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60861
--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
I'd say it is fine for test to be optimized to 1 at -O2, but am not sure we
want to do that even for -O0 (and if we disable it for -O0, whether we want it
for -Og). Then it will be user's choice whether he wants to instrument
optimized code (where there is no out of bound access), or non-optimized code
(where there would be out of bounds access).
^ permalink raw reply [flat|nested] 8+ messages in thread