netdev - Re: Linux-5.4: bpf: test_core_reloc_arrays.o: Segmentation fault with llc -march=bpf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 24 Oct 2019 18:04:10 +0200
From:   Ilya Leoshkevich <iii@...ux.ibm.com>
To:     Prabhakar Kushwaha <prabhakar.pkin@...il.com>
Cc:     Yonghong Song <yhs@...com>, ast@...nel.org, daniel@...earbox.net,
        netdev@...r.kernel.org, linux-kselftest@...r.kernel.org
Subject: Re: Linux-5.4: bpf: test_core_reloc_arrays.o: Segmentation fault with
 llc -march=bpf

> Am 23.10.2019 um 03:35 schrieb Prabhakar Kushwaha <prabhakar.pkin@...il.com>:
> 
> 
> Adding other mailing list, folks...
> 
> Hi All,
> 
> I am trying to build kselftest on Linux-5.4 on ubuntu 18.04. I installed
> LLVM-9.0.0 and Clang-9.0.0 from below links after following steps from
> [1] because of discussion [2]
> 
> https://releases.llvm.org/9.0.0/llvm-9.0.0.src.tar.xz
> https://releases.llvm.org/9.0.0/clang-tools-extra-9.0.0.src.tar.xz
> https://releases.llvm.org/9.0.0/cfe-9.0.0.src.tar.xz
> 
> Now, i am trying with llc -march=bpf, with this segmentation fault is
> coming as below:
> 
> gcc -g -Wall -O2 -I../../../include/uapi -I../../../lib
> -I../../../lib/bpf -I../../../../include/generated -DHAVE_GENHDR
> -I../../../include -Dbpf_prog_load=bpf_prog_test_load
> -Dbpf_load_program=bpf_test_load_program    test_flow_dissector.c
> /usr/src/tovards/linux/tools/testing/selftests/bpf/test_stub.o
> /usr/src/tovards/linux/tools/testing/selftests/bpf/libbpf.a -lcap -lelf
> -lrt -lpthread -o
> /usr/src/tovards/linux/tools/testing/selftests/bpf/test_flow_dissector
> gcc -g -Wall -O2 -I../../../include/uapi -I../../../lib
> -I../../../lib/bpf -I../../../../include/generated -DHAVE_GENHDR
> -I../../../include -Dbpf_prog_load=bpf_prog_test_load
> -Dbpf_load_program=bpf_test_load_program
> test_tcp_check_syncookie_user.c
> /usr/src/tovards/linux/tools/testing/selftests/bpf/test_stub.o
> /usr/src/tovards/linux/tools/testing/selftests/bpf/libbpf.a -lcap -lelf
> -lrt -lpthread -o
> /usr/src/tovards/linux/tools/testing/selftests/bpf/test_tcp_check_syncookie_user
> gcc -g -Wall -O2 -I../../../include/uapi -I../../../lib
> -I../../../lib/bpf -I../../../../include/generated -DHAVE_GENHDR
> -I../../../include -Dbpf_prog_load=bpf_prog_test_load
> -Dbpf_load_program=bpf_test_load_program    test_lirc_mode2_user.c
> /usr/src/tovards/linux/tools/testing/selftests/bpf/test_stub.o
> /usr/src/tovards/linux/tools/testing/selftests/bpf/libbpf.a -lcap -lelf
> -lrt -lpthread -o
> /usr/src/tovards/linux/tools/testing/selftests/bpf/test_lirc_mode2_user
> (clang -I. -I./include/uapi -I../../../include/uapi
> -I/usr/src/tovards/linux/tools/testing/selftests/bpf/../usr/include
> -D__TARGET_ARCH_arm64 -g -idirafter /usr/local/include -idirafter
> /usr/local/lib/clang/9.0.0/include -idirafter
> /usr/include/aarch64-linux-gnu -idirafter /usr/include
> -Wno-compare-distinct-pointer-types -O2 -target bpf -emit-llvm \
> -c progs/test_core_reloc_arrays.c -o - || echo "clang failed") | \
> llc -march=bpf -mcpu=probe  -filetype=obj -o
> /usr/src/tovards/linux/tools/testing/selftests/bpf/test_core_reloc_arrays.o
> Stack dump:
> 0. Program arguments: llc -march=bpf -mcpu=probe -filetype=obj -o
> /usr/src/tovards/linux/tools/testing/selftests/bpf/test_core_reloc_arrays.o
> 1. Running pass 'Function Pass Manager' on module '<stdin>'.
> 2. Running pass 'BPF Assembly Printer' on function '@...t_core_arrays'
> #0 0x0000aaaac618db08 llvm::sys::PrintStackTrace(llvm::raw_ostream&)
> (/usr/local/bin/llc+0x152eb08)
> Segmentation fault

Hi,

FWIW I can confirm that this is happening on s390 too with llvm-project
commit 950b800c451f.

Here is the reduced sample that triggers this (with -march=bpf
-mattr=+alu32):

struct b {
  int e;
} c;
int f() {
  return __builtin_preserve_field_info(c.e, 0);
}

This is compiled into:

0B      bb.0 (%ir-block.0):
16B       %0:gpr = LD_imm64 @"b:0:0$0:0"
32B       $w0 = COPY %0:gpr, debug-location !17; 1-E.c:5:3
48B       RET implicit killed $w0, debug-location !17; 1-E.c:5:3

and then BPFInstrInfo::copyPhysReg chokes on COPY, since $w0 and %0 are
in different register classes.

I'm currently bisecting, and also checking whether supporting asymmetric
copies (like X86 does in CopyToFromAsymmetricReg) would resolve that.

Best regards,
Ilya