public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug c/99168] New: inconsistent behavior on -O0 and -O2 with ASAN on
@ 2021-02-19 16:44 zhan3299 at purdue dot edu
  2021-02-19 16:57 ` [Bug c/99168] " zhan3299 at purdue dot edu
                   ` (6 more replies)
  0 siblings, 7 replies; 8+ messages in thread
From: zhan3299 at purdue dot edu @ 2021-02-19 16:44 UTC (permalink / raw)
  To: gcc-bugs

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99168

            Bug ID: 99168
           Summary: inconsistent behavior on -O0 and -O2 with ASAN on
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhan3299 at purdue dot edu
  Target Milestone: ---

I am not sure whether the following problem is caused by ASAN or O2.

Following code has different behaviors between "-fsanitize=address -O0" and
"-fsanitize=address -O2"

It affects my local 7.5.0, 10.2.0, and 11.0.0 on godbolt.

O0 (succ): https://godbolt.org/z/zMKP6K
O1 (succ): https://godbolt.org/z/Yf3oP7
O2 (fail): https://godbolt.org/z/erahvc
O3 (fail): https://godbolt.org/z/7zaqaf
Os (fail): https://godbolt.org/z/38e6xc

-----

$ cat test.c
#include <stdio.h>

struct my_struct {
    unsigned long volatile x;
} __attribute__((aligned(128)));

static int k[5][6] = {};

static struct my_struct s1 = {0UL};

static struct my_struct s2 __attribute__((aligned(32))) = {0UL};

int main() {
    int i, j;
    for (i = 0; i < 5; i++) {
        for (j = 0; j < 6; j++) {
            printf("%d\n", k[i][j]);
        }
    }

    printf("%lu\n", s1.x);
    printf("%lu\n", s2.x);

    return 0;
}



$ gcc test.c -Wall -fsanitize=address -O0 -o g0.out 
# no any warning or error

$ gcc test.c -Wall -fsanitize=address -O2 -o g2.out 
# no any warning or error

$ ./g0.out
... # normal output

$ ./g2.out
=================================================================
==26165==ERROR: AddressSanitizer: global-buffer-overflow on address
0x55a5cf268184 at pc 0x55a5cf267201 bp 0x7ffd23b80f60 sp 0x7ffd23b80f50
READ of size 4 at 0x55a5cf268184 thread T0
    #0 0x55a5cf267200 in main
(/root/docker_share/csmith/gcc_self_10/g2.out+0x1200)
    #1 0x7efea78c10b2 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #2 0x55a5cf26726d in _start
(/root/docker_share/csmith/gcc_self_10/g2.out+0x126d)

0x55a5cf268184 is located 4 bytes inside of global variable 'k' defined in
'test.c:7:12' (0x55a5cf268180) of size 120
0x55a5cf268184 is located 4 bytes to the right of global variable 's2' defined
in 'test.c:11:25' (0x55a5cf268100) of size 128
SUMMARY: AddressSanitizer: global-buffer-overflow
(/root/docker_share/csmith/gcc_self_10/g2.out+0x1200) in main
Shadow bytes around the buggy address:
  0x0ab539e44fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ab539e44ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ab539e45000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ab539e45010: 04 f9 f9 f9 f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9
  0x0ab539e45020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0ab539e45030:[f9]f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 f9
  0x0ab539e45040: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ab539e45050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ab539e45060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ab539e45070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ab539e45080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc

^ permalink raw reply	[flat|nested] 8+ messages in thread
end of thread, other threads:[~2021-02-23 15:05 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-19 16:44 [Bug c/99168] New: inconsistent behavior on -O0 and -O2 with ASAN on zhan3299 at purdue dot edu
2021-02-19 16:57 ` [Bug c/99168] " zhan3299 at purdue dot edu
2021-02-22  9:45 ` [Bug sanitizer/99168] " marxin at gcc dot gnu.org
2021-02-22 15:07 ` marxin at gcc dot gnu.org
2021-02-22 16:13 ` zhan3299 at purdue dot edu
2021-02-22 16:44 ` marxin at gcc dot gnu.org
2021-02-23 15:03 ` cvs-commit at gcc dot gnu.org
2021-02-23 15:05 ` marxin at gcc dot gnu.org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).