Bug 96828 - Wrong code generated with -fstack-protector and -msingle-pic-base
Summary: Wrong code generated with -fstack-protector and -msingle-pic-base
Status: UNCONFIRMED
Alias: None
Product: gcc
Classification: Unclassified
Component: target (show other bugs)
Version: 10.1.1
: P3 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords: fixed-but-no-testcase, wrong-code
Depends on:
Blocks:
 
Reported: 2020-08-28 03:13 UTC by Ilya Oleinik
Modified: 2025-01-23 04:15 UTC (History)
0 users

See Also:
Host:
Target: arm-eabi
Build:
Known to work: 8.3.1
Known to fail: 10.1.1, 9.2.1
Last reconfirmed:


Attachments
test case (79 bytes, text/plain)
2020-08-28 03:13 UTC, Ilya Oleinik
Details
patch (528 bytes, patch)
2020-10-02 04:17 UTC, Ilya Oleinik
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Ilya Oleinik 2020-08-28 03:13:44 UTC
Created attachment 49143 [details]
test case

$ arm-none-eabi-gcc -v
Using built-in specs.
COLLECT_GCC=./gcc/gcc-arm-none-eabi-10-2020-q2-preview/bin/arm-none-eabi-gcc
COLLECT_LTO_WRAPPER=/mnt/c/Users/Ilya/Desktop/bug/gcc/gcc-arm-none-eabi-10-2020-q2-preview/bin/../lib/gcc/arm-none-eabi/10.1.1/lto-wrapper
Target: arm-none-eabi
Configured with: /mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/src/gcc/configure --target=arm-none-eabi --prefix=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/install-native --libexecdir=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/install-native/lib --infodir=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/install-native/share/doc/gcc-arm-none-eabi/info --mandir=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/install-native/share/doc/gcc-arm-none-eabi/man --htmldir=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/install-native/share/doc/gcc-arm-none-eabi/html --pdfdir=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/install-native/share/doc/gcc-arm-none-eabi/pdf --enable-languages=c,c++ --enable-plugins --disable-decimal-float --disable-libffi --disable-libgomp --disable-libmudflap --disable-libquadmath --disable-libssp --disable-libstdcxx-pch --disable-nls --disable-shared --disable-threads --disable-tls --with-gnu-as --with-gnu-ld --with-newlib --with-headers=yes --with-python-dir=share/gcc-arm-none-eabi --with-sysroot=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/install-native/arm-none-eabi --build=x86_64-linux-gnu --host=x86_64-linux-gnu --with-gmp=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/build-native/host-libs/usr --with-mpfr=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/build-native/host-libs/usr --with-mpc=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/build-native/host-libs/usr --with-isl=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/build-native/host-libs/usr --with-libelf=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/build-native/host-libs/usr --with-host-libstdcxx='-static-libgcc -Wl,-Bstatic,-lstdc++,-Bdynamic -lm' --with-pkgversion='GNU Arm Embedded Toolchain 10-2020-q2-preview' --with-multilib-list=rmprofile,aprofile
Thread model: single
Supported LTO compression algorithms: zlib
gcc version 10.1.1 20200529 (release) (GNU Arm Embedded Toolchain 10-2020-q2-preview)

Compilation of the test case with options "arm-none-eabi-gcc -c bug.c -fstack-protector -fpie -mno-pic-data-is-text-relative -msingle-pic-base", uses wrong register for GOT access when storing and loading stack canary (variable access included to demonstrate correct behavior):

        push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	ldr	r3, .L4
        @ r2 is used instead of r9
	ldr	r3, [r2, r3]  
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3, #0
	ldr	r3, .L4+4
        @ correct behavior, r9 is used as base
	ldr	r3, [r9, r3]
	ldr	r3, [r3]
	ldr	r2, .L4
        @ r1 is used instead of r9
	ldr	r2, [r1, r2]
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	beq	.L3
	bl	__stack_chk_fail(PLT)
.L3:
	mov	r0, r3
	sub	sp, fp, #4
	pop	{fp, lr}
	bx	lr
Comment 1 Ilya Oleinik 2020-10-02 04:17:14 UTC
Created attachment 49296 [details]
patch
Comment 2 Ilya Oleinik 2020-10-02 04:23:24 UTC
Seems like PR85434 caused this issue.
This patch fixes it, however i'm not sure if mov instruction insertion is the right way of fixing armv6m inability to do a load from hiregs.