Bug 100908 - asan clobberes register asm variables
Summary: asan clobberes register asm variables
Status: UNCONFIRMED
Alias: None
Product: gcc
Classification: Unclassified
Component: sanitizer (show other bugs)
Version: 12.0
: P3 enhancement
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords: documentation, inline-asm, wrong-code
Depends on:
Blocks:
 
Reported: 2021-06-04 17:57 UTC by Andreas Krebbel
Modified: 2024-03-30 22:00 UTC (History)
5 users (show)

See Also:
Host:
Target:
Build:
Known to work:
Known to fail:
Last reconfirmed:


Attachments
Testcase (221 bytes, text/plain)
2021-06-04 17:57 UTC, Andreas Krebbel
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Krebbel 2021-06-04 17:57:34 UTC
Created attachment 50933 [details]
Testcase

Compiling the testcase with either:
gcc -O3 t1.c -o t -fsanitize=address --param asan-instrumentation-with-call-threshold=0
or
gcc -O3 t1.c -o t -fsanitize=kernel-address -lasan

aborts because dereferencing y triggers the address sanitizer to
introduce a function call.

That a function call might clobber registers assigned with register asm
is a documented limitation of the register asm construct:
https://gcc.gnu.org/onlinedocs/gcc/Local-Register-Variables.html

However, in combination with the address sanitizer this becomes even
less obvious making even the most experienced kernel developers trip
over it:
https://lkml.org/lkml/2020/10/23/908

For IBM Z quite a few cases like this have been reported to me. Here just
one I could find quickly:
https://lore.kernel.org/patchwork/patch/1413907/


Btw. clang appears to handle this more gracefully and preserves the
value of the variable around function calls. The attached testcase
works fine with clang.


I think it would be much better to find a solution which allows to
directly name hard registers as inline assembly constraints.  I'll
post an RFC on the mailing list.
Comment 1 Andreas Krebbel 2021-06-04 18:11:47 UTC
https://gcc.gnu.org/pipermail/gcc/2021-June/236269.html
Comment 2 Drea Pinski 2021-06-04 18:25:42 UTC
(In reply to Andreas Krebbel from comment #1)
> https://gcc.gnu.org/pipermail/gcc/2021-June/236269.html

Yes this will help solve the limitations which are already mentioned in the manual:
Warning: In the above example, be aware that a register (for example r0) can be call-clobbered by subsequent code, including function calls and library calls for arithmetic operators on other variables (for example the initialization of p2). In this case, use temporary variables for expressions between the register assignments: