https://gcc.gnu.org/bugzilla/show_bug.cgi?id=128375
Bug ID: 128375
Summary: ICE in hwasan_emit_prologue with
-fsanitize=memtag-stack on targets without memory
tagging (x86_64, riscv64, loongarch64, aarch64
-mabi=ilp32)
Product: gcc
Version: 16.2.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: sanitizer
Assignee: unassigned at gcc dot gnu.org
Reporter: 220245569 at seu dot edu.cn
CC: 220255623 at seu dot edu.cn, dodji at gcc dot gnu.org,
dvyukov at gcc dot gnu.org, jakub at gcc dot gnu.org,
jianhao.xu at seu dot edu.cn, kcc at gcc dot gnu.org
Target Milestone: ---
Target: x86_64-*-* riscv64-*-* loongarch64-*-* aarch64-*-*
Reproducer
----------
$ cat trigger.c
extern int sink (int);
int probe (int n)
{
volatile int buf[8];
for (int i = 0; i < 8; i++)
buf[i] = n + i;
return sink (buf[n & 7]);
}
Compile flag: x86_64-linux-gnu-gcc -O1 -fsanitize=memtag-stack -S trigger.c
$ x86_64-linux-gnu-gcc -O1 -fsanitize=memtag-stack -S trigger.c
during RTL pass: expand
trigger.c:3:5: internal compiler error: in hwasan_emit_prologue, at
asan.cc:4810
0x2a0a236 hwasan_emit_prologue() # gcc_assert
(targetm.have_compose_tag ())
0x1e637db expand_used_vars(bitmap_head*) # cfgexpand.cc:2714
# riscv64-linux-gnu-gcc / loongarch64-linux-gnu-gcc: same ICE at asan.cc:4810
$ aarch64-linux-gnu-gcc -O2 -march=armv9-a+memtag -mabi=ilp32
-fsanitize=memtag-stack -S trigger.c
trigger.c:3:5: internal compiler error: in expand_insn, at optabs.cc:8518
0x23f51ed hwasan_emit_prologue() # asan.cc:4818, ptr_mode operands
with Pmode != ptr_mode
# controls: aarch64 LP64 + memtag-stack compiles; x86_64 -fsanitize=hwaddress
compiles
# (LAM enabled); aarch64 -mabi=ilp32 -fsanitize=hwaddress -> "not
supported for this target" warning
Root cause
----------
toplev.cc:1727-1733 checks targetm.memtag.can_tag_addresses () only for
SANITIZE_HWADDRESS and drops it with "'-fsanitize=hwaddress' is not supported
for this target". SANITIZE_MEMTAG_STACK has no such check (the only target
check is aarch64's TARGET_MEMTAG, aarch64.cc:19690), so hwassist stack
instrumentation runs on targets without compose_tag/tag_memory patterns and
on AArch64 ILP32, where aarch64_can_tag_addresses () (aarch64.cc:26455)
already returns false.
Suggested Fix
-------------
Extend the toplev.cc check to SANITIZE_MEMTAG_STACK: if
!targetm.memtag.can_tag_addresses (), warn "'-fsanitize=memtag-stack' is not
supported for this target" and clear the bit, as done for hwaddress.
