[Bug sanitizer/96307] New: ICE in sanopt on riscv64 since r11-2283-g2ca1b6d009b194286c3ec91f9c51cc6b0a475458

[Bug sanitizer/96307] New: ICE in sanopt on riscv64 since r11-2283-g2ca1b6d009b194286c3ec91f9c51cc6b0a475458

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96307

            Bug ID: 96307
           Summary: ICE in sanopt on riscv64 since
                    r11-2283-g2ca1b6d009b194286c3ec91f9c51cc6b0a475458
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: sanitizer
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
                    jakub at gcc dot gnu.org, kcc at gcc dot gnu.org, kito at gcc dot gnu.org,
                    marxin at gcc dot gnu.org
  Target Milestone: ---

I see the following ICE with a cross compiler:

$ riscv64-linux-gnu-gcc
/home/marxin/Programming/gcc/gcc/testsuite/gcc.dg/lto/c-compatible-types-1_1.c
-fsanitize=kernel-address --param=asan-instrumentation-with-call-threshold=8
during GIMPLE pass: sanopt
/home/marxin/Programming/gcc/gcc/testsuite/gcc.dg/lto/c-compatible-types-1_1.c:
In function ‘t’:
/home/marxin/Programming/gcc/gcc/testsuite/gcc.dg/lto/c-compatible-types-1_1.c:9:1:
internal compiler error: Segmentation fault
    9 | t()
      | ^
0xae236f crash_signal
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-riscv64/build/gcc/toplev.c:328
0x7ffff78d752f ???
       
/usr/src/debug/glibc-2.31-6.1.x86_64/signal/../sysdeps/unix/sysv/linux/x86_64/sigaction.c:0
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug sanitizer/96307] ICE in sanopt on riscv64 since r11-2283-g2ca1b6d009b194286c3ec91f9c51cc6b0a475458

[kito at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96307

Kito Cheng <kito at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2020-07-24
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1

--- Comment #1 from Kito Cheng <kito at gcc dot gnu.org> ---
Confirmed, thanks for report that :)

[Bug sanitizer/96307] [10/11 Regression] ICE in sanopt on riscv64 since r11-2283-g2ca1b6d009b194286c3ec91f9c51cc6b0a475458

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96307

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |10.2.0
             Target|                            |riscv
            Summary|ICE in sanopt on riscv64    |[10/11 Regression] ICE in
                   |since                       |sanopt on riscv64 since
                   |r11-2283-g2ca1b6d009b194286 |r11-2283-g2ca1b6d009b194286
                   |c3ec91f9c51cc6b0a475458     |c3ec91f9c51cc6b0a475458
   Target Milestone|---                         |10.3
      Known to fail|                            |10.2.1

[Bug sanitizer/96307] [10/11 Regression] ICE in sanopt on riscv64 since r11-2283-g2ca1b6d009b194286c3ec91f9c51cc6b0a475458

[wilson at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96307

Jim Wilson <wilson at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |wilson at gcc dot gnu.org

--- Comment #2 from Jim Wilson <wilson at gcc dot gnu.org> ---
It is calling targetm.asan_shadow_offset which is a null function pointer
currently for RISC-V.  This is related to Kito's recent patch to re-enable ksan
support when asan_shadow_offset isn't defined.  But it looks like there are
multiple params that can cause asan_shadow_offset to be called for ksan when it
normally isn't.  So this change may need to be removed.

Good news is that we have a patch to add asan support for RISC-V which would
make Kito's toplev.c patch unnecessary for us.

[Bug sanitizer/96307] [10/11 Regression] ICE in sanopt on riscv64 since r11-2283-g2ca1b6d009b194286c3ec91f9c51cc6b0a475458

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96307

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
May I ask about progress of the RISC-V sanitization enablement?

[Bug sanitizer/96307] [10/11 Regression] ICE in sanopt on riscv64 since r11-2283-g2ca1b6d009b194286c3ec91f9c51cc6b0a475458

[kito at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96307

--- Comment #4 from Kito Cheng <kito at gcc dot gnu.org> ---
ASAN related patches are seems need take more time than expect, I plan to fix
that this week, and I think ASAN is a new feature so that it won't back port to
GCC 10.

[Bug sanitizer/96307] [10/11 Regression] ICE in sanopt on riscv64 since r11-2283-g2ca1b6d009b194286c3ec91f9c51cc6b0a475458

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96307

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P4

[Bug sanitizer/96307] [10/11 Regression] ICE in sanopt on riscv64 since r11-2283-g2ca1b6d009b194286c3ec91f9c51cc6b0a475458

[kito at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96307

Kito Cheng <kito at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P4                          |P3

--- Comment #5 from Kito Cheng <kito at gcc dot gnu.org> ---
Patch posted, waiting for review: 
https://gcc.gnu.org/pipermail/gcc-patches/2020-October/555482.html

[Bug sanitizer/96307] [10/11 Regression] ICE in sanopt on riscv64 since r11-2283-g2ca1b6d009b194286c3ec91f9c51cc6b0a475458

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96307

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Kito Cheng <kito@gcc.gnu.org>:

https://gcc.gnu.org/g:65e82636bcdb72a878c2e53943e71b15dd9fb22d

commit r11-4762-g65e82636bcdb72a878c2e53943e71b15dd9fb22d
Author: Kito Cheng <kito.cheng@sifive.com>
Date:   Mon Oct 5 14:01:04 2020 +0800

    PR target/96307: Fix KASAN option checking.

     - Disable kasan if target is unsupported and -fasan-shadow-offset= is not
       given, no matter `--param asan-stack=1` is given or not.

     - Moving KASAN option checking testcase to gcc.dg, those testcase could be
       useful for all other target which not support asan.

     - Verifed on riscv and x86.

    gcc/ChangeLog:

            PR target/96307
            * toplev.c (process_options): Remove param_asan_stack checking for
kasan
            option checking.

    gcc/testsuite/ChangeLog:

            PR target/96307
            * gcc.dg/pr96307.c: New.
            * gcc.target/riscv/pr96260.c: Move this test case from here to ...
            * gcc.dg/pr96260.c: ... here.
            * gcc.target/riscv/pr91441.c: Move this test case from here to ...
            * gcc.dg/pr91441.c: ... here.
            * lib/target-supports.exp
(check_effective_target_no_fsanitize_address):
            New proc.

[Bug sanitizer/96307] [10/11 Regression] ICE in sanopt on riscv64 since r11-2283-g2ca1b6d009b194286c3ec91f9c51cc6b0a475458

[kito at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96307

--- Comment #7 from Kito Cheng <kito at gcc dot gnu.org> ---
Committed fix into trunk, wait one week to commit to gcc 10 branh.

[Bug sanitizer/96307] [10/11 Regression] ICE in sanopt on riscv64 since r11-2283-g2ca1b6d009b194286c3ec91f9c51cc6b0a475458

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96307

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P4

[Bug sanitizer/96307] [10 Regression] ICE in sanopt on riscv64 since r11-2283-g2ca1b6d009b194286c3ec91f9c51cc6b0a475458

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96307

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Kito Cheng <kito@gcc.gnu.org>:

https://gcc.gnu.org/g:037a02be13d24f3be65480b50c58c7f6cf654f9a

commit r10-9329-g037a02be13d24f3be65480b50c58c7f6cf654f9a
Author: Kito Cheng <kito.cheng@sifive.com>
Date:   Mon Oct 5 14:01:04 2020 +0800

    PR target/96307: Fix KASAN option checking.

     - Disable kasan if target is unsupported and -fasan-shadow-offset= is not
       given, no matter `--param asan-stack=1` is given or not.

     - Moving KASAN option checking testcase to gcc.dg, those testcase could be
       useful for all other target which not support asan.

     - Verifed on riscv and x86.

    gcc/ChangeLog:

            PR target/96307
            * toplev.c (process_options): Remove param_asan_stack checking for
kasan
            option checking.

    gcc/testsuite/ChangeLog:

            PR target/96307
            * gcc.dg/pr96307.c: New.
            * gcc.target/riscv/pr96260.c: Move this test case from here to ...
            * gcc.dg/pr96260.c: ... here.
            * gcc.target/riscv/pr91441.c: Move this test case from here to ...
            * gcc.dg/pr91441.c: ... here.
            * lib/target-supports.exp
(check_effective_target_no_fsanitize_address):
            New proc.

    (cherry picked from commit 65e82636bcdb72a878c2e53943e71b15dd9fb22d)

[Bug sanitizer/96307] [10 Regression] ICE in sanopt on riscv64 since r11-2283-g2ca1b6d009b194286c3ec91f9c51cc6b0a475458

[kito at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96307

Kito Cheng <kito at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #9 from Kito Cheng <kito at gcc dot gnu.org> ---
Fixed on 10 and trunk.

[Bug sanitizer/96307] [10 Regression] ICE in sanopt on riscv64 since r11-2283-g2ca1b6d009b194286c3ec91f9c51cc6b0a475458

[schwab@linux-m68k.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96307

--- Comment #10 from Andreas Schwab <schwab@linux-m68k.org> ---
This disables the CC_HAS_KASAN_GENERIC config of the kernel, making KASAN
unavailable.

[Bug sanitizer/96307] [10 Regression] ICE in sanopt on riscv64 since r11-2283-g2ca1b6d009b194286c3ec91f9c51cc6b0a475458

[schwab@linux-m68k.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96307

Andreas Schwab <schwab@linux-m68k.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|FIXED                       |---
             Status|RESOLVED                    |REOPENED

--- Comment #11 from Andreas Schwab <schwab@linux-m68k.org> ---
Also, the warning text doesn't make sense:

$ gcc -fsanitize=kernel-address -S -xc /dev/null -o /dev/null
cc1: warning: ‘-fsanitize=kernel-address’ with stack protection is not
supported without ‘-fasan-shadow-offset=’ for this target

[Bug sanitizer/96307] [10 Regression] ICE in sanopt on riscv64 since r11-2283-g2ca1b6d009b194286c3ec91f9c51cc6b0a475458

[kito at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96307

--- Comment #12 from Kito Cheng <kito at gcc dot gnu.org> ---
> This disables the CC_HAS_KASAN_GENERIC config of the kernel, making KASAN unavailable.

Hmmmm, I checked with kernel source code, it only feed
-fsanitize=kernel-address during checking, but in fact it must work with
-fasan-shadow-offset=, and it does actually, what do you think about fix that
on kernel side?

diff --git a/lib/Kconfig.kasan b/lib/Kconfig.kasan
index fba9909e31b7..9a2484132b2d 100644
--- a/lib/Kconfig.kasan
+++ b/lib/Kconfig.kasan
@@ -13,7 +13,7 @@ config HAVE_ARCH_KASAN_VMALLOC
        bool

 config CC_HAS_KASAN_GENERIC
-       def_bool $(cc-option, -fsanitize=kernel-address)
+       def_bool $(cc-option, -fsanitize=kernel-address
-fasan-shadow-offset=0x1)

 config CC_HAS_KASAN_SW_TAGS
        def_bool $(cc-option, -fsanitize=kernel-hwaddress)


> Also, the warning text doesn't make sense:
>
> $ gcc -fsanitize=kernel-address -S -xc /dev/null -o /dev/null
> cc1: warning: ‘-fsanitize=kernel-address’ with stack protection is not supported without ‘-fasan-shadow-offset=’ for this target

That's my fault I didn't update the error message there, that error message was
introduced when fixing PR96260, but during fix this PR.

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96260

[Bug sanitizer/96307] [10 Regression] ICE in sanopt on riscv64 since r11-2283-g2ca1b6d009b194286c3ec91f9c51cc6b0a475458

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96307

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.3                        |10.4

--- Comment #13 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10.3 is being released, retargeting bugs to GCC 10.4.

[Bug sanitizer/96307] [10 Regression] ICE in sanopt on riscv64 since r11-2283-g2ca1b6d009b194286c3ec91f9c51cc6b0a475458

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96307

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.4                        |10.5

--- Comment #14 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 10.4 is being released, retargeting bugs to GCC 10.5.

[Bug sanitizer/96307] [10 Regression] ICE in sanopt on riscv64 since r11-2283-g2ca1b6d009b194286c3ec91f9c51cc6b0a475458

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96307

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
   Target Milestone|10.5                        |10.2
             Status|REOPENED                    |RESOLVED

--- Comment #15 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed in GCC 10.2