This is the mail archive of the gcc-bugs@gcc.gnu.org mailing list for the GCC project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

[Bug c/77964] New: [7 Regression] Linux kernel firmware loader miscompiled


https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77964

            Bug ID: 77964
           Summary: [7 Regression] Linux kernel firmware loader
                    miscompiled
           Product: gcc
           Version: 7.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: trippels at gcc dot gnu.org
  Target Milestone: ---

Created attachment 39803
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=39803&action=edit
unreduced testcase

A Linux kernel build with gcc trunk crashes early during boot.
It happens during loading of builtin firmware.

RIP points to strcmp() in fw_get_builtin_firmware() on a bogus address.

markus@x4 linux % scripts/faddr2line ./vmlinux _request_firmware+0xa8
_request_firmware+0xa8/0xff:
fw_get_builtin_firmware at drivers/base/firmware_class.c:55
 (inlined by) _request_firmware_prepare at drivers/base/firmware_class.c:1066
 (inlined by) _request_firmware at drivers/base/firmware_class.c:1149


drivers/base/firmware_class.c:
  49 static bool fw_get_builtin_firmware(struct firmware *fw, const char *name, 
  50                                     void *buf, size_t size)                
  51 {                                                                          
  52         struct builtin_fw *b_fw;                                           
  53                                                                            
  54         for (b_fw = __start_builtin_fw; b_fw != __end_builtin_fw; b_fw++)
{                                                                               
  55                 if (strcmp(name, b_fw->name) == 0) {                       
  56                         fw->size = b_fw->size;                             
  57                         fw->data = b_fw->data;                             
  58                                                                            
  59                         if (buf && fw->size <= size)                       
  60                                 memcpy(buf, fw->data, fw->size);           
  61                         return true;                                       
  62                 }                                                          
  63         }                                                                  
  64                                                                            
  65         return false;                                                      
  66 }

I have attached the firmware_class.i file.
The kernel crashes for -O1 -O2 and -Os. Strangely -O3 is fine.

Haven't looked deeper yet, but maybe someone sees what is going on?

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]