<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><span class="vcard"><a class="email" href="mailto:peter@lekensteyn.nl" title="Peter Wu <peter@lekensteyn.nl>"> <span class="fn">Peter Wu</span></a>
</span> changed
<a class="bz_bug_link
bz_status_REOPENED "
title="REOPENED - LLD + -fsanitize=address segfaults in scandir."
href="https://bugs.llvm.org/show_bug.cgi?id=37303">bug 37303</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">CC</td>
<td>
</td>
<td>peter@lekensteyn.nl
</td>
</tr>
<tr>
<td style="text-align:right;">Status</td>
<td>RESOLVED
</td>
<td>REOPENED
</td>
</tr>
<tr>
<td style="text-align:right;">Resolution</td>
<td>WORKSFORME
</td>
<td>---
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_REOPENED "
title="REOPENED - LLD + -fsanitize=address segfaults in scandir."
href="https://bugs.llvm.org/show_bug.cgi?id=37303#c7">Comment # 7</a>
on <a class="bz_bug_link
bz_status_REOPENED "
title="REOPENED - LLD + -fsanitize=address segfaults in scandir."
href="https://bugs.llvm.org/show_bug.cgi?id=37303">bug 37303</a>
from <span class="vcard"><a class="email" href="mailto:peter@lekensteyn.nl" title="Peter Wu <peter@lekensteyn.nl>"> <span class="fn">Peter Wu</span></a>
</span></b>
<pre>Re-opening as I am still able to reproduce the issue with lld from trunk, but
using an *older* compiler-rt.
Initially reproduced with lld 7.0.1-1 on Arch Linux x86_64, it indeed crashed
in the scandir interceptor of compiler-rt. Whether the object file was compiled
with GCC/clang did not make a difference.
-fuse-ld=gold and -fuse-ld=bfd (binutils 2.31.1-4) works, -fuse-ld=lld produces
broken binaries (as does -fuse-ld=/path/to/trunk/ld.lld).
# Broken with 7.0.1, works on trunk:
clang -fsanitize=address repro.o && ./a.out
# Broken with both 7.0.1 and trunk clang+lld (but using compiler-rt 7.0.1)
clang -fuse-ld=lld /usr/lib/clang/7.0.1/lib/linux/libclang_rt.asan-x86_64.a
-ldl -pthread -lrt -lm repro.o && ./a.out
(Note: the above command with -fuse-ld=bfd seems to ignore the static library,
use "clang -v" to see the link command and replace the
libclang_rt.asan-x86_64.a and --dynamic-list=... paths and change ld.lld ->
ld.bfd or ld.gold for testing.)
Disassembly of __interceptor_scandir64.part.126 for a working (bfd-linked)
binary:
add85: ff 15 05 7b 0c 00 callq *0xc7b05(%rip) # 175890
<_ZN14__interception11real_strlenE>
add8b: 4c 8d 60 01 lea 0x1(%rax),%r12
add8f: 48 89 d8 mov %rbx,%rax
add92: 4c 01 e0 add %r12,%rax
add95: 0f 82 5d 03 00 00 jb ae0f8
<__interceptor_scandir64.part.126+0x398>
add9b: 4c 89 e6 mov %r12,%rsi
add9e: 48 89 df mov %rbx,%rdi
adda1: e8 9a a0 f8 ff callq 37e40
<_ZN6__asanL29QuickCheckForUnpoisonedRegionEmm>
adda6: 84 c0 test %al,%al
adda8: 0f 84 b2 02 00 00 je ae060
<__interceptor_scandir64.part.126+0x300>
addae: 66 66 66 66 64 48 8b data16 data16 data16 data16 mov
%fs:0x0,%rax
addb5: 04 25 00 00 00 00
addbb: 48 8d 0d ee 98 f8 ff lea -0x76712(%rip),%rcx #
376b0
<_ZL24wrapped_scandir64_comparPPKN11__sanitizer20__sanitizer_dirent64ES3_>
Disassembly of __interceptor_scandir64.part.126 for a broken (lld-linked)
binary:
e4d35: ff 15 d5 40 09 00 callq *0x940d5(%rip) # 178e10
<_ZN14__interception11real_strlenE>
e4d3b: 4c 8d 60 01 lea 0x1(%rax),%r12
e4d3f: 48 89 d8 mov %rbx,%rax
e4d42: 4c 01 e0 add %r12,%rax
e4d45: 0f 82 5d 03 00 00 jb e50a8
<__interceptor_scandir64.part.126+0x398>
e4d4b: 4c 89 e6 mov %r12,%rsi
e4d4e: 48 89 df mov %rbx,%rdi
e4d51: e8 9a a0 f8 ff callq 6edf0
<_ZN6__asanL29QuickCheckForUnpoisonedRegionEmm>
e4d56: 84 c0 test %al,%al
e4d58: 0f 84 b2 02 00 00 je e5010
<__interceptor_scandir64.part.126+0x300>
e4d5e: 66 66 66 64 48 8b 04 data16 data16 data16 mov %fs:0x0,%rax
e4d65: 25 00 00 00 00
e4d6a: 00 48 8d add %cl,-0x73(%rax)
e4d6d: 0d ee 98 f8 ff or $0xfff898ee,%eax
The "data16" instruction looks wrong, the "add %cl,-0x73(%rax)" is the one that
corrupts RAX and causes a crash down the line.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>