Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Regression] Stack pointer corruption on ARMv7 #52723

Closed
vit9696 opened this issue Dec 15, 2021 · 11 comments
Closed

[Regression] Stack pointer corruption on ARMv7 #52723

vit9696 opened this issue Dec 15, 2021 · 11 comments

Comments

@vit9696
Copy link

vit9696 commented Dec 15, 2021

There is a stack pointer corruption regression in LLVM 13 causing stack leak (at least) with ASAN enabled when targeting cortex-a9.

The issue is reproducible with the code below:

void puts(const char *format);

void func(int a1, int a2, int* a3, int* a4, int* a5)
{
  (void)a1;
  (void)a2;
  (void)a3;
  (void)a4;
  (void)a5;
  puts("Hello");
}

int func2(void) {
  return 0;
}

void test(void) {
  static int a;
  int e;
  int c;
  int d;
  int b = 0;

  for (;;)
  {
    if (func2() == 0)
    {
      func(a, b, &c, &d, &e);
    }
  }
}

It can also be viewed online. The arguments to compile are as follows:

clang -o error.o -c -target arm-gnu-linux-eabi -mcpu=cortex-a9 -fsanitize=address error.c

The problematic part is the loop in the test function. When func is called, LLVM does not adjust the stack back, causing fast stack overflow:

.LBB2_5:                                @ %for.cond
       ...
       sub     sp, sp, #8
       str     r12, [sp]
       bl      func
.LBB2_7:                                @ %if.end
       b       .LBB2_5

LLVM 12.0.1 does not have this issue. The issue is present in main and is caused by d88f96d. Differential: https://reviews.llvm.org/D102613.

Reverting the patch resolves the problem, but I am not well familiar with that part of LLVM to drive the change.

CC @tstellar, this should be a blocker for 13.0.1 as it is a regression.
CC @TNorthover, @ornata, could you provide any information on a proper fix?

0001-Revert-ARM-support-mandatory-tail-calls-for-tailcc-s.patch.zip

@vit9696
Copy link
Author

vit9696 commented Dec 15, 2021

Referencing #51489.

@tstellar tstellar added this to the LLVM 13.0.1 release milestone Dec 15, 2021
@tstellar
Copy link
Collaborator

@TNorthover Should we revert d88f96d this on the release/13.x branch?

@TNorthover
Copy link
Contributor

Oh dear. If it reverts cleanly that's probably the sensible choice. Swift is the only project that really cares about the feature and it has its own branching.

I'll hang onto this issue to sort out a proper fix when I get back to work.

@vit9696
Copy link
Author

vit9696 commented Jan 5, 2022

Thanks Tim! The good side of it is that we have reverted it for a about a month now (with the patch above) and so far spotted no issues. We only use C and very little C++ though.

@TNorthover
Copy link
Contributor

The arguments for ADJCALLSTACKUP had changed but FastISel (& GISel) hadn't got the message. Patch up for review now: https://reviews.llvm.org/D116805

@tstellar
Copy link
Collaborator

tstellar commented Jan 7, 2022

The arguments for ADJCALLSTACKUP had changed but FastISel (& GISel) hadn't got the message. Patch up for review now: https://reviews.llvm.org/D116805

Some test cases fail when I try to build with the attached patch to revert. Would it be better to backport https://reviews.llvm.org/D116805 instead?

@vit9696
Copy link
Author

vit9696 commented Jan 10, 2022

We will test https://reviews.llvm.org/D116805 on 13.0.0 branch against this issue tomorrow or so.

@tstellar
Copy link
Collaborator

@vit9696 OK, I want to tag the release on Wednesday at the latest, so the sooner you can test and ACK the patch, the better.

@vit9696
Copy link
Author

vit9696 commented Jan 11, 2022

Done, as long as the tests pass, I believe it is a much better approach than reverting.

@TNorthover
Copy link
Contributor

Should be fixed on main now by 0b5b35f.

@tstellar
Copy link
Collaborator

Merged: eaeb7dc

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

4 participants