* Re: initify plugin crashes on arm allmodconfig
2017-02-01 15:10 ` PaX Team
@ 2017-02-01 15:26 ` Arnd Bergmann
2017-02-01 16:07 ` PaX Team
0 siblings, 1 reply; 6+ messages in thread
From: Arnd Bergmann @ 2017-02-01 15:26 UTC (permalink / raw)
To: pageexec
Cc: Kees Cook, Emese Revfy, linux-kernel, Josh Triplett,
yamada.masahiro, minipli, linux, catalin.marinas, linux,
david.brown, benh, tglx, akpm, jlayton, sam, kernel-hardening
[-- Attachment #1: Type: text/plain, Size: 3207 bytes --]
On Wednesday, February 1, 2017 4:10:03 PM CET PaX Team wrote:
> On 1 Feb 2017 at 14:52, Arnd Bergmann wrote:
>
> > On my ARM test builds (using a recent gcc-7 snapshot), allmodconfig failed with a compiler
> > crash, I have managed to minimize the test case to this:
> >
> > /home/arnd/cross-gcc/bin/arm-linux-gnueabi-gcc-7.0.1 -O2 -Wall -fplugin=/home/arnd/arm-soc/build/tmp/scripts/gcc-plugins/initify_plugin.so -DINITIFY_PLUGIN
> > -fplugin-arg-initify_plugin-search_init_exit_functions -fno-inline-functions-called-once -S atmel_lcdfb.i arm-linux-gnueabi-gcc-7.0.1: internal compiler error: Segmentation fault (program cc1)
> >
> [...]
> >
> > While trying to reproduce it, one time I ended up killing the gcc task when it
> > used more than 80 gigabytes (!) of memory after around six minutes of compiling
> > the same file (drivers/video/fbdev/atmel_lcdfb.c), but other times it just crashed
> > as above using various ARM cross compilers (4.9.3, 5.3, 6.1.1).
>
> i tried to reproduce it with 5.4 and 6.3 to no avail (arm64->arm cross compiler)
> so some more information will be needed. first, which plugin version did you try?
> second, if you build your own gcc, can you configure one with this additional
> option:
The plugin version is from today's next-20170201 version, and that is the
only version I've seen so far. Unfortunately I could not reproduce on
plain linux-next but only on my working tree, which contains countless
other patches.
I took some snapshots during the creduce run, the attached file is not fully
reduced but for me this version crashes on gcc-4.9.3, 5.3.1, 6.1.1, and 7.0.1.
I think the 4.9.3 build still had checks enabled, this is the output I get there:
arm-linux-gnueabi-gcc-4.9.3: internal compiler error: Segmentation fault (program cc1)
0x40c0c6 execute
/home/arnd/git/gcc/gcc/gcc.c:2854
0x40c464 do_spec_1
/home/arnd/git/gcc/gcc/gcc.c:4658
0x40edc0 process_brace_body
/home/arnd/git/gcc/gcc/gcc.c:5941
0x40edc0 handle_braces
/home/arnd/git/gcc/gcc/gcc.c:5855
0x40d16e do_spec_1
/home/arnd/git/gcc/gcc/gcc.c:5312
0x40edc0 process_brace_body
/home/arnd/git/gcc/gcc/gcc.c:5941
0x40edc0 handle_braces
/home/arnd/git/gcc/gcc/gcc.c:5855
0x40d16e do_spec_1
/home/arnd/git/gcc/gcc/gcc.c:5312
0x40d0d3 do_spec_1
/home/arnd/git/gcc/gcc/gcc.c:5427
0x40edc0 process_brace_body
/home/arnd/git/gcc/gcc/gcc.c:5941
0x40edc0 handle_braces
/home/arnd/git/gcc/gcc/gcc.c:5855
0x40d16e do_spec_1
/home/arnd/git/gcc/gcc/gcc.c:5312
0x40edc0 process_brace_body
/home/arnd/git/gcc/gcc/gcc.c:5941
0x40edc0 handle_braces
/home/arnd/git/gcc/gcc/gcc.c:5855
0x40d16e do_spec_1
/home/arnd/git/gcc/gcc/gcc.c:5312
0x40edc0 process_brace_body
/home/arnd/git/gcc/gcc/gcc.c:5941
0x40edc0 handle_braces
/home/arnd/git/gcc/gcc/gcc.c:5855
0x40d16e do_spec_1
/home/arnd/git/gcc/gcc/gcc.c:5312
0x40edc0 process_brace_body
/home/arnd/git/gcc/gcc/gcc.c:5941
0x40edc0 handle_braces
/home/arnd/git/gcc/gcc/gcc.c:5855
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
If you can't reproduce with the version below, I'll dig in further.
Arnd
[-- Attachment #2: atmel_lcdfb.i.4 --]
[-- Type: text/plain, Size: 15204 bytes --]
enum { false };
extern int __this_module;
struct list_head {
struct list_head *next, *prev;
};
struct resource;
extern struct resource *__request_region(void);
extern void lockdep_init_map(int *key);
typedef void *work_func_t;
struct work_struct {
work_func_t func;
};
typedef int pm_message_t;
struct device {
void *driver_data;
int *of_node;
};
static inline __attribute__((no_instrument_function)) void *
dev_get_drvdata(const struct device *dev) {
return dev->driver_data;
}
extern __attribute__((format(printf, 2, 3))) void
dev_err(const struct device *dev, const char *fmt, ...);
struct platform_device_id {
char name[20];
unsigned long driver_data;
};
struct platform_device {
struct device dev;
const struct platform_device_id *id_entry;
};
struct platform_driver {
int (*remove)(struct platform_device *);
int (*suspend)(struct platform_device *, pm_message_t state);
int (*resume)(struct platform_device *);
const struct platform_device_id *id_table;
};
extern int __platform_driver_probe(struct platform_driver *driver,
int(struct platform_device *), int *module);
static inline __attribute__((no_instrument_function)) void
__raw_writel(unsigned int val, volatile void *addr) {}
unsigned int __raw_readl_val;
static inline __attribute__((no_instrument_function)) unsigned int
__raw_readl(const volatile void *addr) {
return __raw_readl_val;
}
enum irqreturn { IRQ_HANDLED };
typedef enum irqreturn (*irq_handler_t)(int, void *);
static inline __attribute__((no_instrument_function)) int
__attribute__((warn_unused_result)) request_irq(irq_handler_t handler) {
return 0;
}
extern int *of_parse_phandle(const int *np);
int *of_property_read_u32_child;
int of_property_read_u32_num = 0;
static inline __attribute__((no_instrument_function)) int
of_property_read_u32(unsigned int *out_value) {
for (of_property_read_u32_child = 0; 0 != 0; of_property_read_u32_child = 0)
of_property_read_u32_num++;
return 0;
}
struct fb_fix_screeninfo {};
struct fb_bitfield {
unsigned int offset;
};
struct fb_var_screeninfo {
unsigned int bits_per_pixel;
struct fb_bitfield red;
struct fb_bitfield green;
struct fb_bitfield blue;
unsigned int pixclock;
unsigned int vsync_len;
};
enum { FB_BLANK_UNBLANK, FB_BLANK_NORMAL, FB_BLANK_POWERDOWN };
struct backlight_properties;
struct fb_info;
struct backlight_ops {
int (*update_status)(struct backlight_properties *);
int (*get_brightness)(struct backlight_properties *);
};
extern struct backlight_properties *
backlight_device_register(const struct backlight_ops *ops);
struct fb_ops {
int *owner;
int (*fb_check_var)(struct fb_var_screeninfo *var, struct fb_info *info);
int (*fb_set_par)(struct fb_info *info);
int (*fb_setcolreg)(unsigned regno, unsigned red, unsigned green,
unsigned blue, unsigned transp, struct fb_info *info);
int (*fb_blank)(int blank, struct fb_info *info);
int (*fb_pan_display)(struct fb_var_screeninfo *var, struct fb_info *info);
};
struct fb_info {
struct fb_var_screeninfo var;
struct fb_fix_screeninfo fix;
struct list_head modelist;
struct device *device;
void *par;
};
extern struct fb_info *framebuffer_alloc(struct device *dev);
struct fb_modelist {
struct list_head list;
} arm_delay_ops;
int __attribute__((warn_unused_result)) regulator_enable(void);
struct atmel_lcdfb_pdata {
_Bool lcdcon_is_backlight;
_Bool lcdcon_pol_negative;
unsigned char lcd_wiring_mode;
unsigned int default_lcdcon2;
unsigned int default_dmacon;
void (*atmel_lcdfb_power_control)(struct atmel_lcdfb_pdata *pdata, int on);
struct list_head pwr_gpios;
};
struct atmel_lcdfb_config {
_Bool have_hozval;
_Bool have_intensity_bit;
};
struct atmel_lcdfb_info {
struct fb_info *info;
void *mmio;
struct work_struct task;
struct platform_device *pdev;
struct atmel_lcdfb_pdata pdata;
struct atmel_lcdfb_config *config;
int *reg_lcd;
};
struct atmel_lcdfb_power_ctrl_gpio {
struct list_head list;
};
static struct atmel_lcdfb_config at91sam9261_config;
static struct atmel_lcdfb_config at91sam9263_config;
static struct atmel_lcdfb_config at91sam9g10_config;
static struct atmel_lcdfb_config at91sam9g45_config;
static struct atmel_lcdfb_config at91sam9g45es_config;
static struct atmel_lcdfb_config at91sam9rl_config;
static struct atmel_lcdfb_config at32ap_config;
static const struct platform_device_id atmel_lcdfb_devtypes[] = {
{.name = "at91sam9261lcdfb",
.driver_data = (unsigned long)&at91sam9261_config},
{.name = "at91sam9263lcdfb",
.driver_data = (unsigned long)&at91sam9263_config},
{.name = "at91sam9g10lcdfb",
.driver_data = (unsigned long)&at91sam9g10_config},
{.name = "at91sam9g45lcdfb",
.driver_data = (unsigned long)&at91sam9g45_config},
{.name = "at91sam9g45eslcdfb",
.driver_data = (unsigned long)&at91sam9g45es_config},
{.name = "at91sam9rllcdfb",
.driver_data = (unsigned long)&at91sam9rl_config},
{.name = "at32aplcdfb", .driver_data = (unsigned long)&at32ap_config}};
struct platform_device *atmel_lcdfb_get_config_pdev;
static unsigned int contrast_ctr = 3 << 0 | 1 << 2 | 1 << 3;
static int atmel_bl_update_status(struct backlight_properties *b) { return 0; }
static int atmel_bl_get_brightness(struct backlight_properties *b) { return 0; }
static const struct backlight_ops atmel_lcdc_bl_ops = {
.update_status = atmel_bl_update_status,
.get_brightness = atmel_bl_get_brightness};
struct backlight_properties *init_backlight_bl;
struct atmel_lcdfb_info *init_contrast_sinfo;
int atmel_lcdfb_power_control_ret;
static inline __attribute__((no_instrument_function)) void
atmel_lcdfb_power_control(struct atmel_lcdfb_info *sinfo, int on) {
struct atmel_lcdfb_pdata *pdata = &sinfo->pdata;
if (pdata->atmel_lcdfb_power_control)
pdata->atmel_lcdfb_power_control(pdata, on);
else if (on) {
atmel_lcdfb_power_control_ret = regulator_enable();
dev_err(&sinfo->pdev->dev, "lcd regulator enable failed %d\n",
atmel_lcdfb_power_control_ret);
}
}
static struct fb_fix_screeninfo atmel_lcdfb_fix
__attribute__((__section__(".init.data")));
struct atmel_lcdfb_info compute_hozval_sinfo;
unsigned long compute_hozval_xres;
static void atmel_lcdfb_start(struct atmel_lcdfb_info *sinfo) {
struct atmel_lcdfb_pdata *pdata = &sinfo->pdata;
__raw_writel(pdata->default_dmacon, sinfo->mmio + 0x1c);
}
unsigned int atmel_lcdfb_check_var___UNIQUE_ID_min2_15 = 1;
static int atmel_lcdfb_check_var(struct fb_var_screeninfo *var,
struct fb_info *info) {
const int *__trans_tmp_1;
struct device dev = *(info->device);
struct atmel_lcdfb_info *sinfo = info->par;
struct atmel_lcdfb_pdata pdata = sinfo->pdata;
{
{ __trans_tmp_1 = 0; }
dev_err(&dev, "needed value not specified\n");
}
do
;
while (0);
var->vsync_len = ({
unsigned int __UNIQUE_ID_min1_14 = var->vsync_len;
__UNIQUE_ID_min1_14 < atmel_lcdfb_check_var___UNIQUE_ID_min2_15;
});
switch (var->bits_per_pixel) {
case 1:
case 2:
case 4:
case 8:
var= 0;
if (pdata.lcd_wiring_mode == 1)
;
}
return 0;
}
static void atmel_lcdfb_reset(struct atmel_lcdfb_info *sinfo) {}
unsigned long atmel_lcdfb_set_par_value;
static int atmel_lcdfb_set_par(struct fb_info *info) {
unsigned long __trans_tmp_2;
struct atmel_lcdfb_info *sinfo = info->par;
struct atmel_lcdfb_pdata pdata = sinfo->pdata;
atmel_lcdfb_set_par_value = pdata.default_lcdcon2;
{ __trans_tmp_2 = compute_hozval_xres; }
return 0;
}
static int atmel_lcdfb_setcolreg(unsigned int regno, unsigned int red,
unsigned int green, unsigned int blue,
unsigned int transp, struct fb_info *info) {
struct atmel_lcdfb_info *sinfo = info->par;
struct atmel_lcdfb_pdata pdata = sinfo->pdata;
{
if (pdata.lcd_wiring_mode == 1)
;
}
return 1;
}
static int atmel_lcdfb_pan_display(struct fb_var_screeninfo *var,
struct fb_info *info) {
do
;
while (0);
return 0;
}
static int atmel_lcdfb_blank(int blank_mode, struct fb_info *info) {
struct atmel_lcdfb_info *sinfo = info->par;
switch (blank_mode) {
case FB_BLANK_UNBLANK:
case FB_BLANK_NORMAL:
atmel_lcdfb_start(sinfo);
}
return blank_mode == FB_BLANK_NORMAL ? 1 : 0;
}
static struct fb_ops atmel_lcdfb_ops = {.owner = &__this_module,
.fb_check_var = atmel_lcdfb_check_var,
.fb_set_par = atmel_lcdfb_set_par,
.fb_setcolreg = atmel_lcdfb_setcolreg,
.fb_blank = atmel_lcdfb_blank,
.fb_pan_display =
atmel_lcdfb_pan_display};
unsigned int atmel_lcdfb_interrupt_status;
static enum irqreturn atmel_lcdfb_interrupt(int irq, void *dev_id) {
struct fb_info *info = dev_id;
struct atmel_lcdfb_info *sinfo = info->par;
atmel_lcdfb_interrupt_status = __raw_readl(sinfo->mmio + 0x0854);
return IRQ_HANDLED;
}
static void atmel_lcdfb_task(void) {
struct atmel_lcdfb_info sinfo;
atmel_lcdfb_reset(&sinfo);
}
struct atmel_lcdfb_info atmel_lcdfb_init_fbinfo_sinfo;
static void atmel_lcdfb_start_clock(struct atmel_lcdfb_info *sinfo) {}
static void atmel_lcdfb_stop_clock(void) {}
static const char *atmel_lcdfb_wiring_modes[] = {[0] = "BRGRGB"};
int atmel_lcdfb_get_of_wiring_modes_i;
struct atmel_lcdfb_power_ctrl_gpio *atmel_lcdfb_power_control_gpio_og;
struct list_head atmel_lcdfb_power_control_gpio_og_1_0;
static void atmel_lcdfb_power_control_gpio(struct atmel_lcdfb_pdata *pdata,
int on) {
for (atmel_lcdfb_power_control_gpio_og = ({
const typeof(((typeof(*atmel_lcdfb_power_control_gpio_og) *)0)->list)
__mptr = *((&pdata->pwr_gpios)->next);
(typeof(*atmel_lcdfb_power_control_gpio_og) *)&__mptr -
__builtin_offsetof(typeof(*atmel_lcdfb_power_control_gpio_og),
list);
});
&atmel_lcdfb_power_control_gpio_og->list != &pdata->pwr_gpios;
atmel_lcdfb_power_control_gpio_og = ({
const typeof(((typeof(*atmel_lcdfb_power_control_gpio_og) *)0)->list)
__mptr = atmel_lcdfb_power_control_gpio_og_1_0;
(typeof(*atmel_lcdfb_power_control_gpio_og) *)&__mptr -
__builtin_offsetof(typeof(*atmel_lcdfb_power_control_gpio_og),
list);
}))
;
}
int *atmel_lcdfb_of_init_display_np;
int atmel_lcdfb_of_init_ret = 2;
int atmel_lcdfb_of_init_i;
int atmel_lcdfb_of_init_gpio;
struct atmel_lcdfb_info *atmel_lcdfb_of_init_sinfo;
static int atmel_lcdfb_of_init(void) {
int __trans_tmp_3;
struct fb_info *info = atmel_lcdfb_of_init_sinfo->info;
struct atmel_lcdfb_pdata *pdata = &atmel_lcdfb_of_init_sinfo->pdata;
struct fb_var_screeninfo var = info->var;
struct device dev = atmel_lcdfb_of_init_sinfo->pdev->dev;
int *np = dev.of_node;
atmel_lcdfb_of_init_display_np = of_parse_phandle(np);
atmel_lcdfb_of_init_ret = of_property_read_u32(&var.bits_per_pixel);
for (atmel_lcdfb_of_init_i = 0; 0 < 0; atmel_lcdfb_of_init_i++)
atmel_lcdfb_of_init_gpio = 0;
goto put_display_node;
pdata->atmel_lcdfb_power_control = atmel_lcdfb_power_control_gpio;
{
for (atmel_lcdfb_get_of_wiring_modes_i = 0;
0 < sizeof(atmel_lcdfb_wiring_modes) / sizeof sizeof(struct {});
atmel_lcdfb_get_of_wiring_modes_i++)
__trans_tmp_3 = 0;
}
put_display_node:
return atmel_lcdfb_of_init_ret;
}
struct fb_info *atmel_lcdfb_probe_info;
char *atmel_lcdfb_probe_info_5_0;
struct fb_ops atmel_lcdfb_probe_info_3;
struct atmel_lcdfb_info *atmel_lcdfb_probe_sinfo;
void *atmel_lcdfb_probe_sinfo_1;
struct fb_modelist *atmel_lcdfb_probe_modelist;
int atmel_lcdfb_probe_ret;
static int __attribute__((__section__(".init.text"))) __attribute__((__cold__))
__attribute__((no_instrument_function))
atmel_lcdfb_probe(struct platform_device *pdev) {
int __trans_tmp_6;
int __trans_tmp_5;
struct atmel_lcdfb_config *__trans_tmp_4;
if (atmel_lcdfb_probe_info)
goto out;
atmel_lcdfb_probe_ret = atmel_lcdfb_of_init();
if (atmel_lcdfb_probe_ret)
goto free_info;
else {
{
__trans_tmp_4 = (struct atmel_lcdfb_config *)
atmel_lcdfb_get_config_pdev->id_entry->driver_data;
}
}
atmel_lcdfb_probe_info_3 = atmel_lcdfb_ops;
atmel_lcdfb_probe_info->fix = atmel_lcdfb_fix;
if (0)
goto put_bus_clk;
atmel_lcdfb_probe_modelist = ({
const typeof(((struct fb_modelist *)0)->list) __mptr =
*((&atmel_lcdfb_probe_info->modelist)->next);
(struct fb_modelist *)&__mptr -
__builtin_offsetof(struct fb_modelist, list);
});
if (0) {
goto release_intmem;
} else {
{ __trans_tmp_5 = 0; }
}
if (0 < 0)
goto stop_clk;
if (__request_region())
goto free_fb;
if (atmel_lcdfb_probe_sinfo_1)
goto release_mem;
{
struct atmel_lcdfb_pdata pdata = init_contrast_sinfo->pdata;
contrast_ctr = 1 << 2;
if (pdata.lcdcon_is_backlight) {
{ init_backlight_bl = backlight_device_register(&atmel_lcdc_bl_ops); }
}
}
atmel_lcdfb_probe_ret = request_irq(atmel_lcdfb_interrupt);
if (atmel_lcdfb_probe_ret)
goto unmap_mmio;
do {
static int __key;
lockdep_init_map(&__key);
(&atmel_lcdfb_probe_sinfo->task)->func = atmel_lcdfb_task;
} while (0);
{
struct fb_info info = *(atmel_lcdfb_init_fbinfo_sinfo.info);
dev_err(info.device, "Alloc color map failed\n");
__trans_tmp_6 = 0;
}
if (0 < 0)
goto unregister_irqs;
if (0 < 0)
goto reset_drvdata;
atmel_lcdfb_power_control(atmel_lcdfb_probe_info->par, 1);
reset_drvdata:
unregister_irqs:
unmap_mmio:
release_mem:
free_fb:
release_intmem:
stop_clk:
atmel_lcdfb_stop_clock();
put_bus_clk:
free_info:
out:
do
;
while (0);
return 0;
}
static int __attribute__((__section__(".exit.text"))) __attribute__((__cold__))
__attribute__((no_instrument_function))
atmel_lcdfb_remove(struct platform_device *pdev) {
struct device dev = pdev->dev;
struct fb_info *info = dev_get_drvdata(&dev);
atmel_lcdfb_power_control(info->par, 0);
return 0;
}
struct fb_info atmel_lcdfb_suspend_info;
static int atmel_lcdfb_suspend(struct platform_device *pdev,
pm_message_t mesg) {
struct atmel_lcdfb_info *sinfo = atmel_lcdfb_suspend_info.par;
atmel_lcdfb_power_control(sinfo, 0);
return 0;
}
struct fb_info *atmel_lcdfb_resume_info = 0;
static int atmel_lcdfb_resume(struct platform_device *pdev) {
struct atmel_lcdfb_info *sinfo = atmel_lcdfb_resume_info->par;
atmel_lcdfb_start_clock(sinfo);
return 0;
}
static struct platform_driver atmel_lcdfb_driver = {
.remove = atmel_lcdfb_remove,
.suspend = atmel_lcdfb_suspend,
.resume = atmel_lcdfb_resume,
.id_table = atmel_lcdfb_devtypes};
void atmel_lcdfb_driver_init(void) {
__platform_driver_probe(&atmel_lcdfb_driver, atmel_lcdfb_probe,
&__this_module);
}
^ permalink raw reply [flat|nested] 6+ messages in thread