<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - [x86] Tail merging two variadic calls produces incorrect CFI"
href="https://bugs.llvm.org/show_bug.cgi?id=49130">49130</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>[x86] Tail merging two variadic calls produces incorrect CFI
</td>
</tr>
<tr>
<th>Product</th>
<td>libraries
</td>
</tr>
<tr>
<th>Version</th>
<td>trunk
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Backend: X86
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>rnk@google.com
</td>
</tr>
<tr>
<th>CC</th>
<td>craig.topper@gmail.com, llvm-bugs@lists.llvm.org, llvm-dev@redking.me.uk, pengfei.wang@intel.com, spatel+llvm@rotateright.com
</td>
</tr></table>
<p>
<div>
<pre>This comes up in the Linux kernel, as reported here:
<a href="https://github.com/ClangBuiltLinux/linux/issues/612">https://github.com/ClangBuiltLinux/linux/issues/612</a>
<a href="https://lkml.org/lkml/2019/7/16/759">https://lkml.org/lkml/2019/7/16/759</a>
Consider:
$ cat t.c
int a, b;
void mypanic(int, ...) __attribute__((noreturn));
void imbalanced() {
if (a)
mypanic(0, 0, 0, 0, 0, 0, a);
if (b)
mypanic(0, 0, 0, 0, 0, 0, a, 0);
}
$ clang -Os t.c -S -o -
.text
.file "t.c"
.globl imbalanced # -- Begin function imbalanced
.type imbalanced,@function
imbalanced: # @imbalanced
.cfi_startproc
# %bb.0: # %entry
pushq %rax
.cfi_def_cfa_offset 16
movl a(%rip), %r10d
testl %r10d, %r10d
jne .LBB0_3
# %bb.1: # %if.end
cmpl $0, b(%rip)
jne .LBB0_5
# %bb.2: # %if.end3
popq %rax
.cfi_def_cfa_offset 8
retq
.LBB0_3: # %if.then
.cfi_def_cfa_offset 16
subq $8, %rsp
.cfi_adjust_cfa_offset 8
xorl %edi, %edi
xorl %esi, %esi
xorl %edx, %edx
xorl %ecx, %ecx
xorl %r8d, %r8d
xorl %r9d, %r9d
xorl %eax, %eax
jmp .LBB0_4
.LBB0_5: # %if.then2
.cfi_def_cfa_offset 16
xorl %r10d, %r10d
xorl %edi, %edi
xorl %esi, %esi
xorl %edx, %edx
xorl %ecx, %ecx
xorl %r8d, %r8d
xorl %r9d, %r9d
xorl %eax, %eax
pushq %r10
.cfi_adjust_cfa_offset 8
.LBB0_4: # %if.then
pushq %r10
.cfi_adjust_cfa_offset 8
callq mypanic
.Lfunc_end0:
.size imbalanced, .Lfunc_end0-imbalanced
.cfi_endproc
# -- End function
What we have here is two calls to mypanic, one with 7 args, one with 8. One
call does two pushes, and the other does one. If you interpret the .cfi_*
directives as written, they are only correct if the program executes the second
'if' branch, not the first. If the program executes the first 'if' and attempts
to unwind the stack, the wrong return address will be used.
Perhaps the CFI inserter pass could fix this by adding the full cfa offset to
each .cfi_adjust_cfa_offset instruction, or by adding some kind of no-op marker
instruction to the end of the MBB that encodes the cfa. This would prevent tail
merging from considering these blocks to be identical.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>