Skip to content

Instantly share code, notes, and snippets.

@ayosec
Last active July 7, 2017 05:42
Show Gist options
  • Save ayosec/3954328e1a8802c9a1d64074e896d23d to your computer and use it in GitHub Desktop.
Save ayosec/3954328e1a8802c9a1d64074e896d23d to your computer and use it in GitHub Desktop.
LLVM Bug, BPF Target
# 1 "<built-in>"
# 1 "foo.c"
int do_request(long i) {
char buf[100];
int j;
for(j = 0; j < i; j++) {
buf[j] = 1;
}
return buf[j-1];
}
# Crash reproducer for clang version 4.0.1-1 (tags/RELEASE_401/final)
# Driver args: "-v" "-g" "-O3" "--target=bpf" "-c" "foo.c" "-o" "foo.o"
# Original command: "/usr/lib/llvm-4.0/bin/clang" "-cc1" "-triple" "bpf" "-emit-obj" "-disable-free" "-disable-llvm-verifier" "-discard-value-names" "-main-file-name" "foo.c" "-mrelocation-model" "static" "-mthread-model" "posix" "-mdisable-fp-elim" "-fmath-errno" "-masm-verbose" "-mconstructor-aliases" "-v" "-dwarf-column-info" "-debug-info-kind=limited" "-dwarf-version=4" "-debugger-tuning=gdb" "-coverage-notes-file" "/host/foo.gcno" "-resource-dir" "/usr/lib/llvm-4.0/bin/../lib/clang/4.0.1" "-O3" "-fdebug-compilation-dir" "/host" "-ferror-limit" "19" "-fmessage-length" "168" "-fobjc-runtime=gcc" "-fdiagnostics-show-option" "-fcolor-diagnostics" "-vectorize-loops" "-vectorize-slp" "-o" "foo.o" "-x" "c" "foo.c"
"/usr/lib/llvm-4.0/bin/clang" "-cc1" "-triple" "bpf" "-emit-obj" "-disable-free" "-disable-llvm-verifier" "-discard-value-names" "-main-file-name" "foo.c" "-mrelocation-model" "static" "-mthread-model" "posix" "-mdisable-fp-elim" "-fmath-errno" "-masm-verbose" "-mconstructor-aliases" "-v" "-dwarf-column-info" "-debug-info-kind=limited" "-dwarf-version=4" "-debugger-tuning=gdb" "-coverage-notes-file" "/host/foo.gcno" "-O3" "-ferror-limit" "19" "-fmessage-length" "168" "-fobjc-runtime=gcc" "-fdiagnostics-show-option" "-fcolor-diagnostics" "-vectorize-loops" "-vectorize-slp" "-x" "c" "foo-4e0928.c"
int do_request(long i) {
char buf[100];
int j;
for(j = 0; j < i; j++) {
buf[j] = 1;
}
return buf[j-1];
}
$ clang-4.0 -v -g -O3 -target bpf -c foo.c -o foo.o
clang version 4.0.1-1 (tags/RELEASE_401/final)
Target: bpf
Thread model: posix
InstalledDir: /usr/bin
"/usr/lib/llvm-4.0/bin/clang" -cc1 -triple bpf -emit-obj -disable-free -disable-llvm-verifier -discard-value-names -main-file-name foo.c -mrelocation-model static -mthread-model posix -mdisable-fp-elim -fmath-errno -masm-verbose -mconstructor-aliases -v -dwarf-column-info -debug-info-kind=limited -dwarf-version=4 -debugger-tuning=gdb -coverage-notes-file /host/foo.gcno -resource-dir /usr/lib/llvm-4.0/bin/../lib/clang/4.0.1 -O3 -fdebug-compilation-dir /host -ferror-limit 19 -fmessage-length 168 -fobjc-runtime=gcc -fdiagnostics-show-option -fcolor-diagnostics -vectorize-loops -vectorize-slp -o foo.o -x c foo.c
clang -cc1 version 4.0.1 based upon LLVM 4.0.1 default target x86_64-pc-linux-gnu
#include "..." search starts here:
#include <...> search starts here:
/usr/local/include
/usr/lib/llvm-4.0/bin/../lib/clang/4.0.1/include
/usr/include
End of search list.
fatal error: error in backend: Cannot select: 0x55a879843468: ch,glue = BPFISD::CALL 0x55a879843128, TargetExternalSymbol:i64'memset', Register:i64 %R1, Register:i64
%R2, Register:i64 %R3, 0x55a879843128:1
0x55a879842ff0: i64 = TargetExternalSymbol'memset'
0x55a8798437a8: i64 = Register %R1
0x55a879843538: i64 = Register %R2
0x55a879843330: i64 = Register %R3
0x55a879843128: ch,glue = CopyToReg 0x55a879843398, Register:i64 %R3, 0x55a8798432c8, 0x55a879843398:1
0x55a879843330: i64 = Register %R3
0x55a8798432c8: i64,ch = CopyFromReg 0x55a8797e5c30, Register:i64 %vreg2
0x55a8798436d8: i64 = Register %vreg2
0x55a879843398: ch,glue = CopyToReg 0x55a879843670, Register:i64 %R2, Constant:i64<1>, 0x55a879843670:1
0x55a879843538: i64 = Register %R2
0x55a879843400: i64 = Constant<1>
0x55a879843670: ch,glue = CopyToReg 0x55a879843058, Register:i64 %R1, FrameIndex:i64<0>
0x55a8798437a8: i64 = Register %R1
0x55a879843608: i64 = FrameIndex<0>
In function: do_request
clang: error: clang frontend command failed with exit code 70 (use -v to see invocation)
clang version 4.0.1-1 (tags/RELEASE_401/final)
Target: bpf
Thread model: posix
InstalledDir: /usr/bin
clang: note: diagnostic msg: PLEASE submit a bug report to http://llvm.org/bugs/ and include the crash backtrace, preprocessed source, and associated run script.
clang: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang: note: diagnostic msg: /tmp/foo-4e0928.c
clang: note: diagnostic msg: /tmp/foo-4e0928.sh
clang: note: diagnostic msg:
********************
@ayosec
Copy link
Author

ayosec commented Jul 7, 2017

It compiles with no optimizations.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment