[Bug target/66780] New: [4.9 Regression] Compiling with -fstack-protector-strong causes binary to segfault

[Bug target/66780] New: [4.9 Regression] Compiling with -fstack-protector-strong causes binary to segfault

[glaubitz at physik dot fu-berlin.de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66780

            Bug ID: 66780
           Summary: [4.9 Regression] Compiling with
                    -fstack-protector-strong causes binary to segfault
           Product: gcc
           Version: 4.9.3
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: glaubitz at physik dot fu-berlin.de
                CC: kkojima at gcc dot gnu.org, olegendo at gcc dot gnu.org
  Target Milestone: ---
            Target: sh*-*-*

Hello!

After several days of debugging, I finally found out why many packages build on
the Debian sh4 buildds currently segfault on sh4, it's the CFLAG
-fstack-protector-strong which is the culprit.

To reproduce:

$ wget
http://http.debian.net/debian/pool/main/p/procps/procps_3.3.10.orig.tar.xz
$ tar xf procps_3.3.10.orig.tar.xz
$ cd procps-3.3.10
$ export CFLAGS="-g -fstack-protector-strong -Wformat -Werror=format-security"
; export "CXXFLAGS=-g -fstack-protector-strong -Wformat
-Werror=format-security" ; ./configure ; make
$ ./ps/pscommand 
Signal 11 (SEGV) caught by lt-pscommand (procps-ng version 3.3.10).
/root/procps/procps-3.3.10/ps/.libs/lt-pscommand:display.c:66: please report
this bug
Segmentation fault
$ make clean
$ export CFLAGS="-g -Wformat -Werror=format-security" ; export "CXXFLAGS=-g
-Wformat -Werror=format-security" ; ./configure ; make
$ ./ps/pscommand 
  PID TTY          TIME CMD
 5396 pts/0    00:00:00 lt-pscommand
32356 pts/0    00:00:00 bash
$

This bug affects many packages in the Debian sh4 port, for example:

pcre3:
http://buildd.debian-ports.org/status/fetch.php?pkg=pcre3&arch=sh4&ver=2%3A8.35-7&stamp=1436092677
cups:
http://buildd.debian-ports.org/status/fetch.php?pkg=cups&arch=sh4&ver=1.7.5-12&stamp=1436128958
glib-2.0:
http://buildd.debian-ports.org/status/fetch.php?pkg=glib2.0&arch=sh4&ver=2.44.1-1.1&stamp=1436141984

Adrian

[Bug target/66780] [4.9 Regression] Compiling with -fstack-protector-strong causes binary to segfault

[glaubitz at physik dot fu-berlin.de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66780

--- Comment #2 from John Paul Adrian Glaubitz <glaubitz at physik dot fu-berlin.de> ---
(In reply to Kazumoto Kojima from comment #1)
> It turned out that the fix for PR65249 causes this problem.
> The codes for stack protect can be inserted after some function
> call returning a value.  That return value in R0 register could
> be clobbered with the fix for PR65249.

Interesting. Could this also be the cause for PR66312 and PR66563 after all?
Both actually occurred only after the patch for PR65249 was merged. In PR65979
(comment 8) [1], we already speculated which recent change introduced the issue
and I'd bet that the wrong code generated here is responsible for the
aforementioned issues as well as the weird behavior I have observed with grep
[2] as well.

> I think that the wrong code is worse than the ICE.  I'd like
> to revert the patches of PR65249 and reopen that PR.

I agree. Please revert this fix as soon as possible as currently almost all
packages fail to build as Debian enables -fstack-protector-strong by default.

Adrian

> [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65979#c8
> [2] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66563#c46

[Bug target/66780] [4.9 Regression] Compiling with -fstack-protector-strong causes binary to segfault

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66780

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |4.9.4

[Bug target/66780] [4.9 Regression] Compiling with -fstack-protector-strong causes binary to segfault

[kkojima at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66780

--- Comment #3 from Kazumoto Kojima <kkojima at gcc dot gnu.org> ---
Author: kkojima
Date: Tue Jul  7 12:29:16 2015
New Revision: 225512

URL: https://gcc.gnu.org/viewcvs?rev=225512&root=gcc&view=rev
Log:
PR target/66780
* config/sh/sh.md (symGOT_load): Revert a part of 2015-03-03 change for
target/65249.


Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/config/sh/sh.md

[Bug target/66780] [4.9 Regression] Compiling with -fstack-protector-strong causes binary to segfault

[kkojima at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66780

--- Comment #4 from Kazumoto Kojima <kkojima at gcc dot gnu.org> ---
(In reply to John Paul Adrian Glaubitz from comment #2)
> Could this also be the cause for PR66312 and PR66563 after all? 

My 2 cents.

I've just revert the problematic part on trunk after usual test.
I'll revert it on 4.9 when the usual test is done and to 5 when
the branch reopens.

[Bug target/66780] [4.9 Regression] Compiling with -fstack-protector-strong causes binary to segfault

[kkojima at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66780

--- Comment #5 from Kazumoto Kojima <kkojima at gcc dot gnu.org> ---
Author: kkojima
Date: Tue Jul  7 20:39:28 2015
New Revision: 225526

URL: https://gcc.gnu.org/viewcvs?rev=225526&root=gcc&view=rev
Log:
PR target/66780
* config/sh/sh.md (symGOT_load): Revert a part of 2015-03-03 change for
target/65249.


Modified:
    branches/gcc-4_9-branch/gcc/ChangeLog
    branches/gcc-4_9-branch/gcc/config/sh/sh.md

[Bug target/66780] [4.9 Regression] Compiling with -fstack-protector-strong causes binary to segfault

[kkojima at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66780

--- Comment #6 from Kazumoto Kojima <kkojima at gcc dot gnu.org> ---
Author: kkojima
Date: Fri Jul 10 09:50:18 2015
New Revision: 225660

URL: https://gcc.gnu.org/viewcvs?rev=225660&root=gcc&view=rev
Log:
PR target/66780
* config/sh/sh.md (symGOT_load): Revert a part of 2015-03-03
change for target/65249.


Modified:
    branches/gcc-5-branch/gcc/ChangeLog
    branches/gcc-5-branch/gcc/config/sh/sh.md

[Bug target/66780] [4.9 Regression] Compiling with -fstack-protector-strong causes binary to segfault

[glaubitz at physik dot fu-berlin.de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66780

--- Comment #7 from John Paul Adrian Glaubitz <glaubitz at physik dot fu-berlin.de> ---
(In reply to John Paul Adrian Glaubitz from comment #0)
> To reproduce:
> 
> $ wget
> http://http.debian.net/debian/pool/main/p/procps/procps_3.3.10.orig.tar.xz
> $ tar xf procps_3.3.10.orig.tar.xz
> $ cd procps-3.3.10
> $ export CFLAGS="-g -fstack-protector-strong -Wformat
> -Werror=format-security" ; export "CXXFLAGS=-g -fstack-protector-strong
> -Wformat -Werror=format-security" ; ./configure ; make
> $ ./ps/pscommand 
> Signal 11 (SEGV) caught by lt-pscommand (procps-ng version 3.3.10).
> /root/procps/procps-3.3.10/ps/.libs/lt-pscommand:display.c:66: please report
> this bug
> Segmentation fault
> $

Alright, just re-tested this with gcc-4.9_4.9.3+sh4 which I built manually with
Kaz' patch applied. The segmentation fault is gone, at least for procps.

Will do further testing, just to be safe.

Adrian

[Bug target/66780] [4.9 Regression] Compiling with -fstack-protector-strong causes binary to segfault

[glaubitz at physik dot fu-berlin.de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66780

--- Comment #8 from John Paul Adrian Glaubitz <glaubitz at physik dot fu-berlin.de> ---
I think it's safe to say this has been fixed.

[Bug target/66780] [4.9 Regression] Compiling with -fstack-protector-strong causes binary to segfault

[kkojima at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66780

Kazumoto Kojima <kkojima at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

--- Comment #9 from Kazumoto Kojima <kkojima at gcc dot gnu.org> ---
Fixed.