Re: [PATCH 16/24] build-sys: cfi_debug and safe_stack are not compatible

["Daniel P. Berrangé" <berrange@redhat.com>]

On Fri, Sep 19, 2025 at 05:33:10PM +0400, marcandre.lureau@redhat.com wrote:
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
> 
> It fails to link on fedora >= 41:
> /usr/bin/ld: /usr/bin/../lib/clang/20/lib/x86_64-redhat-linux-gnu/libclang_rt.safestack.a(safestack.cpp.o): in function `__sanitizer_internal_memcpy':
> (.text.__sanitizer_internal_memcpy+0x0): multiple definition of `__sanitizer_internal_memcpy'; /usr/bin/../lib/clang/20/lib/x86_64-redhat-linux-gnu/libclang_rt.ubsan_standalone.a(sanitizer_libc.cpp.o):(.text.__sanitizer_internal_memcpy+0x0): first defined here
> /usr/bin/ld: /usr/bin/../lib/clang/20/lib/x86_64-redhat-linux-gnu/libclang_rt.safestack.a(safestack.cpp.o): in function `__sanitizer_internal_memmove':
> (.text.__sanitizer_internal_memmove+0x0): multiple definition of `__sanitizer_internal_memmove'; /usr/bin/../lib/clang/20/lib/x86_64-redhat-linux-gnu/libclang_rt.ubsan_standalone.a(sanitizer_libc.cpp.o):(.text.__sanitizer_internal_memmove+0x0): first defined here
> /usr/bin/ld: /usr/bin/../lib/clang/20/lib/x86_64-redhat-linux-gnu/libclang_rt.safestack.a(safestack.cpp.o): in function `__sanitizer_internal_memset':
> (.text.__sanitizer_internal_memset+0x0): multiple definition of `__sanitizer_internal_memset'; /usr/bin/../lib/clang/20/lib/x86_64-redhat-linux-gnu/libclang_rt.ubsan_standalone.a(sanitizer_libc.cpp.o):(.text.__sanitizer_internal_memset+0x0): first defined here
> 
> cfi_debug seems to pull ubsan which has conflicting symbols with safe_stack.

If this is caused by the switch of dockerfiles from Fedora 40 to 41,
then this commit should be ordered earlier in the series before that
switch so that we are bisectable.

Also if this is a regression in F41 it is probably worth a bug report
against clang in Fedora, that could be referenced in the commit msg.

> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>  meson.build                | 16 ++++++++++------
>  .gitlab-ci.d/buildtest.yml |  6 +++---
>  2 files changed, 13 insertions(+), 9 deletions(-)
> 
> diff --git a/meson.build b/meson.build
> index 6ade30f36a..856c8f1a85 100644
> --- a/meson.build
> +++ b/meson.build
> @@ -681,13 +681,17 @@ if get_option('cfi')
>      error('-fsanitize-cfi-icall-generalize-pointers is not supported by the compiler')
>    endif
>    if get_option('cfi_debug')
> -    if cc.compiles('int main () { return 0; }',
> -                   name: '-fno-sanitize-trap=cfi-icall',
> -                   args: ['-flto', '-fsanitize=cfi-icall',
> -                          '-fno-sanitize-trap=cfi-icall'] )
> -      cfi_flags += '-fno-sanitize-trap=cfi-icall'
> +    if get_option('safe_stack')
> +      error('cfi_debug is not compatible with safe_stack')

IIUC error() terminates meson execution, so it could just
have an 'endif' where and avoid re-indenting all the
following code.

>      else
> -      error('-fno-sanitize-trap=cfi-icall is not supported by the compiler')
> +      if cc.compiles('int main () { return 0; }',
> +                    name: '-fno-sanitize-trap=cfi-icall',
> +                    args: ['-flto', '-fsanitize=cfi-icall',
> +                            '-fno-sanitize-trap=cfi-icall'] )
> +        cfi_flags += '-fno-sanitize-trap=cfi-icall'
> +      else
> +        error('-fno-sanitize-trap=cfi-icall is not supported by the compiler')
> +      endif
>      endif
>    endif
>    add_global_arguments(cfi_flags, native: false, language: all_languages)
> diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
> index 8378b663b6..94d646c5a7 100644
> --- a/.gitlab-ci.d/buildtest.yml
> +++ b/.gitlab-ci.d/buildtest.yml
> @@ -479,7 +479,7 @@ build-cfi-aarch64:
>      LD_JOBS: 1
>      AR: llvm-ar
>      IMAGE: fedora
> -    CONFIGURE_ARGS: --cc=clang --cxx=clang++ --enable-cfi --enable-cfi-debug
> +    CONFIGURE_ARGS: --cc=clang --cxx=clang++ --enable-cfi
>        --enable-safe-stack --disable-slirp
>      TARGETS: aarch64-softmmu
>      MAKE_CHECK_ARGS: check-build
> @@ -517,7 +517,7 @@ build-cfi-ppc64-s390x:
>      LD_JOBS: 1
>      AR: llvm-ar
>      IMAGE: fedora
> -    CONFIGURE_ARGS: --cc=clang --cxx=clang++ --enable-cfi --enable-cfi-debug
> +    CONFIGURE_ARGS: --cc=clang --cxx=clang++ --enable-cfi
>        --enable-safe-stack --disable-slirp
>      TARGETS: ppc64-softmmu s390x-softmmu
>      MAKE_CHECK_ARGS: check-build
> @@ -555,7 +555,7 @@ build-cfi-x86_64:
>      LD_JOBS: 1
>      AR: llvm-ar
>      IMAGE: fedora
> -    CONFIGURE_ARGS: --cc=clang --cxx=clang++ --enable-cfi --enable-cfi-debug
> +    CONFIGURE_ARGS: --cc=clang --cxx=clang++ --enable-cfi
>        --enable-safe-stack --disable-slirp
>      TARGETS: x86_64-softmmu
>      MAKE_CHECK_ARGS: check-build
> -- 
> 2.51.0
> 

With regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|