[Bug c/99168] New: inconsistent behavior on -O0 and -O2 with ASAN on

[Bug c/99168] New: inconsistent behavior on -O0 and -O2 with ASAN on

[zhan3299 at purdue dot edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99168

            Bug ID: 99168
           Summary: inconsistent behavior on -O0 and -O2 with ASAN on
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhan3299 at purdue dot edu
  Target Milestone: ---

I am not sure whether the following problem is caused by ASAN or O2.

Following code has different behaviors between "-fsanitize=address -O0" and
"-fsanitize=address -O2"

It affects my local 7.5.0, 10.2.0, and 11.0.0 on godbolt.

O0 (succ): https://godbolt.org/z/zMKP6K
O1 (succ): https://godbolt.org/z/Yf3oP7
O2 (fail): https://godbolt.org/z/erahvc
O3 (fail): https://godbolt.org/z/7zaqaf
Os (fail): https://godbolt.org/z/38e6xc

-----

$ cat test.c
#include <stdio.h>

struct my_struct {
    unsigned long volatile x;
} __attribute__((aligned(128)));

static int k[5][6] = {};

static struct my_struct s1 = {0UL};

static struct my_struct s2 __attribute__((aligned(32))) = {0UL};

int main() {
    int i, j;
    for (i = 0; i < 5; i++) {
        for (j = 0; j < 6; j++) {
            printf("%d\n", k[i][j]);
        }
    }

    printf("%lu\n", s1.x);
    printf("%lu\n", s2.x);

    return 0;
}



$ gcc test.c -Wall -fsanitize=address -O0 -o g0.out 
# no any warning or error

$ gcc test.c -Wall -fsanitize=address -O2 -o g2.out 
# no any warning or error

$ ./g0.out
... # normal output

$ ./g2.out
=================================================================
==26165==ERROR: AddressSanitizer: global-buffer-overflow on address
0x55a5cf268184 at pc 0x55a5cf267201 bp 0x7ffd23b80f60 sp 0x7ffd23b80f50
READ of size 4 at 0x55a5cf268184 thread T0
    #0 0x55a5cf267200 in main
(/root/docker_share/csmith/gcc_self_10/g2.out+0x1200)
    #1 0x7efea78c10b2 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #2 0x55a5cf26726d in _start
(/root/docker_share/csmith/gcc_self_10/g2.out+0x126d)

0x55a5cf268184 is located 4 bytes inside of global variable 'k' defined in
'test.c:7:12' (0x55a5cf268180) of size 120
0x55a5cf268184 is located 4 bytes to the right of global variable 's2' defined
in 'test.c:11:25' (0x55a5cf268100) of size 128
SUMMARY: AddressSanitizer: global-buffer-overflow
(/root/docker_share/csmith/gcc_self_10/g2.out+0x1200) in main
Shadow bytes around the buggy address:
  0x0ab539e44fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ab539e44ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ab539e45000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ab539e45010: 04 f9 f9 f9 f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9
  0x0ab539e45020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0ab539e45030:[f9]f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 f9
  0x0ab539e45040: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ab539e45050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ab539e45060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ab539e45070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ab539e45080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc

[Bug c/99168] inconsistent behavior on -O0 and -O2 with ASAN on

[zhan3299 at purdue dot edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99168

--- Comment #1 from zhan3299 at purdue dot edu ---
If we resolved the conflicts on "aligned", it would behave normally. I feel
like the ASAN is confused by the "aligned" somehow.

Should it have thrown some warnings?

[Bug sanitizer/99168] inconsistent behavior on -O0 and -O2 with ASAN on

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99168

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |marxin at gcc dot gnu.org
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2021-02-22

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
I'll take a look.

[Bug sanitizer/99168] inconsistent behavior on -O0 and -O2 with ASAN on

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99168

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
Very interesting issue, the failure is caused by IPA ICF that merges 2
variables with different alignments. I've got a patch candidate.

[Bug sanitizer/99168] inconsistent behavior on -O0 and -O2 with ASAN on

[zhan3299 at purdue dot edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99168

--- Comment #4 from zhan3299 at purdue dot edu ---
(In reply to Martin Liška from comment #3)
> Very interesting issue, the failure is caused by IPA ICF that merges 2
> variables with different alignments. I've got a patch candidate.

Hi, just curious because I am also studying the source code of GCC.

Is this issue is about sanitizer or optimization?

[Bug sanitizer/99168] inconsistent behavior on -O0 and -O2 with ASAN on

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99168

--- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
(In reply to zhan3299 from comment #4)
> (In reply to Martin Liška from comment #3)
> > Very interesting issue, the failure is caused by IPA ICF that merges 2
> > variables with different alignments. I've got a patch candidate.
> 
> Hi, just curious because I am also studying the source code of GCC.
> 
> Is this issue is about sanitizer or optimization?

It's bad optimization done by IPA ICF. The issue is gone with -fno-ipa-icf.

[Bug sanitizer/99168] inconsistent behavior on -O0 and -O2 with ASAN on

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99168

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Liska <marxin@gcc.gnu.org>:

https://gcc.gnu.org/g:3f8384545784696fbd66aaec24a998a819e912c5

commit r11-7346-g3f8384545784696fbd66aaec24a998a819e912c5
Author: Martin Liska <mliska@suse.cz>
Date:   Tue Feb 23 09:01:53 2021 +0100

    IPA ICF + ASAN: do not merge vars with different alignment

    gcc/ChangeLog:

            PR sanitizer/99168
            * ipa-icf.c (sem_variable::merge): Do not merge 2 variables
            with different alignment. That leads to an invalid red zone
            size allocated in runtime.

    gcc/testsuite/ChangeLog:

            PR sanitizer/99168
            * c-c++-common/asan/pr99168.c: New test.

[Bug sanitizer/99168] inconsistent behavior on -O0 and -O2 with ASAN on

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99168

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #7 from Martin Liška <marxin at gcc dot gnu.org> ---
Fixed on master.