Debian Bug report logs - #624743
gcc-4.6 -D_FORTIFY_SOURCE=2 miscompiles exim4

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Andreas Metzler <ametzler@downhill.at.eu.org>

To: submit@bugs.debian.org

Subject: gcc-4.6 -D_FORTIFY_SOURCE=2 miscompiles exim4

Date: Sun, 1 May 2011 09:26:52 +0200

[Message part 1 (text/plain, inline)]

Package: gcc-4.6
Version: 4.6.0-6
Severity: important
Blocks: 624696

The upgrade to gcc-4.6 broke exim4:
------------------------------------------
(SID)ametzler@argenau:/tmp/EXIM4/exim-4.75$ fakeroot debian/rules clean; \
 debian/rules extradaemonpackages='' build ; echo XXXXXXXXXXXXXXXXXXXX ; \
./build-tree/build-exim4-daemon-light/exim -C /dev/null -be '${if bool{0}{yes}{no}} X ${if !bool{0}{yes}{no}}'
[...]
touch build-indep-stamp
XXXXXXXXXXXXXXXXXXXX
Segmentation fault
------------------------------------------

Exim is using hardening-wrapper. I have played with the different
DEB_BUILD_HARDENING_* options, the part that breaks is
-D_FORTIFY_SOURCE=2. With
export DEB_BUILD_HARDENING_FORTIFY=0
I (seem to) get a working exim binary.

The c-file that actually breaks is drtables.c:

gdb exim
GNU gdb (GDB) 7.2-debian
[...]
Reading symbols from /tmp/EXIM4/exim-4.75/build-tree/build-exim4-daemon-light/exim...done.
(gdb) run -C /dev/null -be '${if bool{0}{yes}{no}}'
Starting program: /tmp/EXIM4/exim-4.75/build-tree/build-exim4-daemon-light/exim -C /dev/null -be '${if bool{0}{yes}{no}}'
[Thread debugging using libthread_db enabled]

Program received signal SIGSEGV, Segmentation fault.
0xf7f5a838 in add_lookup_to_list () at drtables.c:381
381           && (Ustrcmp(lookup_list[pos]->name, info->name) <= 0)) {
(gdb) bt
#0  0xf7f5a838 in add_lookup_to_list () at drtables.c:381
#1  init_lookup_list () at drtables.c:615
#2  0xf7f3fdd3 in main (argc=5, cargv=0xffffd744) at exim.c:3588
(gdb)


If I recompile drtables.c without -D_FORTIFY_SOURCE=2 and relink exim
the segfault goes away.

cu andreas


-- System Information:
Debian Release: wheezy/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: i386 (x86_64)

Kernel: Linux 2.6.32-5-amd64 (SMP w/2 CPU cores)
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Shell: /bin/sh linked to /bin/dash

Versions of packages gcc-4.6 depends on:
ii  binutils              2.21.51.20110421-2 The GNU assembler, linker and bina
ii  cpp-4.6               4.6.0-6            The GNU C preprocessor
ii  gcc-4.6-base          4.6.0-6            The GNU Compiler Collection (base

[buildlog.hardening-just-FORTIFY (text/plain, attachment)]

Message #10 received at 624743@bugs.debian.org (full text, mbox, reply):

From: Kees Cook <kees@debian.org>

To: 624743@bugs.debian.org, Andreas Metzler <ametzler@downhill.at.eu.org>

Subject: cannot reproduce

Date: Thu, 5 May 2011 05:53:03 -0700

Hi! Thanks for this report. I can't reproduce this segfault. I tried the
builds both amd64 and i386, and both build fine with 4.6.0-6 for me. Do you
have any minimal reproducers that might show this more specifically?

Thanks!

-Kees

-- 
Kees Cook                                            @debian.org

Message #15 received at 624743@bugs.debian.org (full text, mbox, reply):

From: Andreas Metzler <ametzler@downhill.at.eu.org>

To: Kees Cook <kees@debian.org>, 624743@bugs.debian.org

Subject: Re: Bug#624743: cannot reproduce

Date: Fri, 6 May 2011 20:16:49 +0200

On 2011-05-05 Kees Cook <kees@debian.org> wrote:
> Hi! Thanks for this report. I can't reproduce this segfault. I tried the
> builds both amd64 and i386, and both build fine with 4.6.0-6 for me. Do you
> have any minimal reproducers that might show this more specifically?

Sadly I cannot reproduce this anymore either. Some of the since
upgraded build-deps must have changed.

cu andreas

Message #20 received at 624743@bugs.debian.org (full text, mbox, reply):

From: Samuel Thibault <sthibault@debian.org>

To: Andreas Metzler <ametzler@downhill.at.eu.org>, 624743@bugs.debian.org

Cc: Kees Cook <kees@debian.org>, debian-hurd@lists.debian.org, bug-hurd@gnu.org

Subject: Re: Bug#624743: cannot reproduce

Date: Mon, 23 May 2011 23:59:27 +0200

found 624743 4.6.0-8
thanks

Hello,

hurd-i386 is also hit by the bug.

Andreas Metzler, le Fri 06 May 2011 20:16:49 +0200, a écrit :
> On 2011-05-05 Kees Cook <kees@debian.org> wrote:
> > Hi! Thanks for this report. I can't reproduce this segfault. I tried the
> > builds both amd64 and i386, and both build fine with 4.6.0-6 for me. Do you
> > have any minimal reproducers that might show this more specifically?
> 
> Sadly I cannot reproduce this anymore either. Some of the since
> upgraded build-deps must have changed.

I can reproduce it with gcc-4.6 4.6.0-8, but only by using valgrind: in
debian/minimaltest, prepend valgrind to the line

$2 -C "$top/exim4.conf" -bV

valgrind will then warn:

==29180== Source and destination overlap in memcpy(0x6fad4e8, 0x6fad4e0, 88)
==29180==    at 0x4C25F6A: memcpy (mc_replace_strmem.c:497)
==29180==    by 0x13B5D9: init_lookup_list (string3.h:59)
==29180==    by 0x11FF6E: main (exim.c:3615)

which is the same backtrace reported here. Disassembling
init_lookup_list shows this:

   0x00000000000335cb <+459>:	cltq   
   0x00000000000335cd <+461>:	lea    0x0(,%rax,8),%rdx
   0x00000000000335d5 <+469>:	callq  0x153a8 <memcpy@plt>
   0x00000000000335da <+474>:	mov    %rbx,%rcx
   0x00000000000335dd <+477>:	add    0x2b6fac(%rip),%rcx        # 0x2ea590 <lookup_list>
   0x00000000000335e4 <+484>:	mov    0x18(%rsp),%rdx

i.e. a memcpy call. l * 0x00000000000335d5 points at

59	  return __builtin___memmove_chk (__dest, __src, __len, __bos0 (__dest));

which is actually a memmove call, not a memcpy call!  The memmove call
comes from the add_lookup_to_list() inline.  By replacing it with
__builtin_memmove() to avoid the _chk version, I don't get any valgrind
issue any more.

It looks like gcc-4.6 is here erroneously optimizing
__builtin___memmove_chk into a memcpy call!

Samuel

Message #27 received at 624743@bugs.debian.org (full text, mbox, reply):

From: Thomas Schwinge <thomas@schwinge.name>

To: Samuel Thibault <sthibault@debian.org>, Andreas Metzler <ametzler@downhill.at.eu.org>, 624743@bugs.debian.org

Cc: Kees Cook <kees@debian.org>, debian-hurd@lists.debian.org, bug-hurd@gnu.org, srs@kth.se

Subject: Re: Bug#624743: cannot reproduce

Date: Tue, 24 May 2011 11:32:40 +0200

[Message part 1 (text/plain, inline)]

Hallo!

On Mon, 23 May 2011 23:59:27 +0200, Samuel Thibault <sthibault@debian.org> wrote:
> [exim4 SEGFAULT with fortifying options]

> It looks like gcc-4.6 is here erroneously optimizing
> __builtin___memmove_chk into a memcpy call!

This is not a GCC bug (<http://gcc.gnu.org/PR46863>), but it is a glibc
header bug (<http://bugs.debian.org/619963>).

After fixing the bits/string3.h header of my 2.11.2-13 glibc package
according to
<http://sourceware.org/git/?p=glibc.git;a=commitdiff;h=42acbb92c861e97a6e1293ea853db88342a1bf53>,
the error is gone.  This fix should already be in the Debian 2.13
packages.


We need to tell <control@bugs.debian.org> about these findings; is this
correct?

reassign 619963 eglibc
reassign 624743 eglibc
forcemerge 619963 624743


Grüße,
 Thomas

[Message part 2 (application/pgp-signature, inline)]

Send a report that this bug log contains spam.