Bug#1027456: gcc-10: gcc segfaults when compiling drivers/media/pci/cx18/cx18-i2c.c in Linux kernel 6.1.2

[Fabien R]

I see the same symptom with kernel 6.0.16

[Mauro Meloni]

Post by Fabien R
I see the same symptom with kernel 6.0.16

I've been able to replicate it with the following Dockerfile and script:

```
FROM debian:bullseye
ARG KERNEL_VERSION=6.1.2

RUN apt update && apt install --no-install-recommends -y ca-certificates
wget xz-utils

WORKDIR /app
RUN wget -nc --progress=dot:giga "
https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-${KERNEL_VERSION}.tar.xz"
RUN tar xaf "linux-${KERNEL_VERSION}.tar.xz" --checkpoint=.5000

RUN apt install -y --no-install-recommends build-essential make kmod cpio \
dpkg-dev libc6-dev libelf-dev libssl-dev time fakeroot bc bison flex
lz4 \
rsync sbsigntool zstd python3-minimal

# get debian config (you should update this if required)
# see
https://packages.debian.org/experimental/amd64/linux-config-6.1/download
RUN wget -nc
http://ftp.us.debian.org/debian/pool/main/l/linux/linux-config-6.1_6.1.2-1~exp1_amd64.deb
&& \
dpkg -i linux-config-*_amd64.deb

WORKDIR "/app/linux-${KERNEL_VERSION}"

# uncompress debian config over the default one
RUN /bin/bash -c "unxz < /usr/src/linux-config-*/config.amd64_none_amd64.xz

Post by Fabien R
.config"

RUN sed -i 's/ANDROID_BINDER_IPC=m/ANDROID_BINDER_IPC=n/' .config

RUN make olddefconfig
CMD make -j2 bindeb-pkg
```

Then

```
#!/bin/sh
docker build --memory="4g" -t kernel-gcc-test .
docker run --memory="4g" kernel-gcc-test
docker logs $(docker ps -lq) > stdout.log 2> stderr.log
```

Leaving aside my syntax errors and lack of refinement, hope this helps.

[Andrey Melnikov]

Same here but for other module.
gcc crash backtrace:

Reading symbols from x86_64-linux-gnu-gcc-10...

[40/49038]
(No debugging symbols found in x86_64-linux-gnu-gcc-10)
(gdb) set follow-fork-mode child
(gdb) run
Starting program: /usr/bin/x86_64-linux-gnu-gcc-10
-Wp,-MMD,drivers/media/pci/cobalt/.cobalt-i2c.o.d -nostdinc
-I/srv/vlxc/kernel/mainline-stable/arch/x86/include
-I./arch/x86/include/generated
-I/srv/vlxc/kernel/mainline-stable/include -I./include
-I/srv/vlxc/kernel/mainline-stable/arch/x86/include/uapi
-I./arch/x86/include/generated/uapi
-I/srv/vlxc/kernel/mainline-stable/include/uapi
-I./include/generated/uapi -include
/srv/vlxc/kernel/mainline-stable/include/linux/compiler-version.h
-include /srv/vlxc/kernel/mainline-stable/include/linux/kconfig.h
-include /srv/vlxc/kernel/mainline-stable/include/linux/compiler_types.h
-D__KERNEL__ -fmacro-prefix-map=/srv/vlxc/kernel/mainline-stable/=
-Wall -Wundef -Werror=strict-prototypes -Wno-trigraphs
-fno-strict-aliasing -fno-common -fshort-wchar -fno-PIE
-Werror=implicit-function-declaration -Werror=implicit-int
-Werror=return-type -Wno-format-security -std=gnu11 -mno-sse -mno-mmx
-mno-sse2 -mno-3dnow -mno-avx -fcf-protection=none -m64
-falign-jumps=1 -falign-loops=1 -mno-80387 -mno-fp-ret-in-387
-mpreferred-stack-boundary=3 -mskip-rax-setup -mtune=generic
-mno-red-zone -mcmodel=kernel -Wno-sign-compare
-fno-asynchronous-unwind-tables -mindirect-branch=thunk-extern
-mindirect-branch-register -mfunction-return=thunk-extern
-fno-jump-tables -fno-delete-null-pointer-checks -Wno-frame-address
-Wno-format-truncation -Wno-format-overflow
-Wno-address-of-packed-member -O2 -fno-allow-store-data-races
-Wframe-larger-than=1024 -fstack-protector-strong -Wno-main
-Wno-unused-but-set-variable -Wno-unused-const-variable
-fno-omit-frame-pointer -fno-optimize-sibling-calls
-fcf-protection=none -fno-stack-clash-protection -pg -mrecord-mcount
-mfentry -DCC_USING_FENTRY -fno-inline-functions-called-once
-Wdeclaration-after-statement -Wvla -Wno-pointer-sign
-Wcast-function-type -Wno-stringop-truncation -Wno-stringop-overflow
-Wno-restrict -Wno-maybe-uninitialized -Wno-alloc-size-larger-than
-Wimplicit-fallthrough=5 -fno-strict-overflow -fno-stack-check
-fconserve-stack -Werror=date-time -Werror=incompatible-pointer-types
-Werror=designated-init -Wno-packed-not-aligned -g -gdwarf-5
-fsanitize=bounds -fsanitize=shift -fsanitize=bool -fsanitize=enum -I
/srv/vlxc/kernel/mainline-stable/drivers/media/pci/cobalt -I
./drivers/media/pci/cobalt -DMODULE -DPKG_ABI=613
-DKBUILD_BASENAME=\"cobalt_i2c\" -DKBUILD_MODNAME=\"cobalt\"
-D__KBUILD_MODNAME=kmod_cobalt -c -o
drivers/media/pci/cobalt/cobalt-i2c.o
/srv/vlxc/kernel/mainline-stable/drivers/media/pci/cobalt/cobalt-i2c.c
[Attaching after process 1415123 vfork to child process 1415127]
[New inferior 2 (process 1415127)]
[Detaching vfork parent process 1415123 after child exec]
[Inferior 1 (process 1415123) detached]
process 1415127 is executing new program: /usr/lib/gcc/x86_64-linux-gnu/10/cc1

Thread 2.1 "cc1" received signal SIGSEGV, Segmentation fault.
[Switching to process 1415127]
0x0000000001145884 in
set_min_and_max_values_for_integral_type(tree_node*, int, signop) ()
(gdb) bt
#0 0x0000000001145884 in
set_min_and_max_values_for_integral_type(tree_node*, int, signop) ()
#1 0x0000000001145a45 in fixup_signed_type(tree_node*) ()
#2 0x0000000000d699df in build_nonstandard_integer_type(unsigned long, int) ()
#3 0x0000000000fa43fa in ?? ()
#4 0x0000000000f3215e in walk_non_aliased_vuses(ao_ref*, tree_node*,
bool, void* (*)(ao_ref*, tree_node*, void*), void* (*)(ao_ref*,
tree_node*, void*, translate_flags*), tree_node* (*)(tree_node*),
unsigned int&, void*) ()
#5 0x0000000000f29fc9 in vn_reference_lookup(tree_node*, tree_node*,
vn_lookup_kind, vn_reference_s**, bool, tree_node**, tree_node*) ()
#6 0x0000000000f25b5c in ?? ()
#7 0x0000000000f24971 in ?? ()
#8 0x0000000000f20952 in ?? ()
#9 0x00000000011e8801 in ?? ()
#10 0x0000000000da0213 in execute_one_pass(opt_pass*) ()
#11 0x0000000000de9a55 in execute_pass_list(function*, opt_pass*) ()
#12 0x0000000000db8342 in do_per_function_toporder(void (*)(function*,
void*), void*) ()
#13 0x000000000117824e in execute_ipa_pass_list(opt_pass*) ()
#14 0x00000000011772a6 in symbol_table::compile() ()
#15 0x0000000001175783 in symbol_table::finalize_compilation_unit() ()
#16 0x000000000115f26f in ?? ()
#17 0x000000000112f2ca in toplev::main(int, char**) ()
#18 0x000000000112e6cc in main ()

[Andrey Melnikov]

JFYI: PR tree-optimization/99824
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99824 fix segfaults when
building kernel.

[Matthias Klose]

Version: 10.1.0-1

Fixed.

[Thomas Lamprecht]

Post by Matthias Klose
Version: 10.1.0-1
Fixed.

As this happens with version 10.2.1-6 I'm confused about how 10.1.0-1 could
contain the fix?

FWIW, even though this is a GCC bug I bisected it in the Linux kernel with
good=6.1.0 and bad=6.1.2 and found the following commit as trigger for GCC
10.2. Reverting it fixes compilation here on GCC 10.2.1-6

commit ed88147bfb4e7cd009cb33c7395a45d52f296bcc
Author: Kees Cook <***@chromium.org>
Date: Tue Oct 25 16:05:18 2022 -0700

fortify: Do not cast to "unsigned char"

[ Upstream commit e9a40e1585d792751d3a122392695e5a53032809 ]

Do not cast to "unsigned char", as this needlessly creates type problems
when attempting builds without -Wno-pointer-sign[1]. The intent of the
cast is to drop possible "const" types.

[1] https://lore.kernel.org/lkml/CAHk-=wgz3Uba8w7kdXhsqR1qvfemYL+***@mail.gmail.com/

Suggested-by: Linus Torvalds <***@linux-foundation.org>
Fixes: 3009f891bb9f ("fortify: Allow strlen() and strnlen() to pass compile-time known lengths")
Cc: linux-***@vger.kernel.org
Signed-off-by: Kees Cook <***@chromium.org>
Signed-off-by: Sasha Levin <***@kernel.org>

diff --git a/include/linux/fortify-string.h b/include/linux/fortify-string.h
index 1067a8450826..5001a11258e4 100644
--- a/include/linux/fortify-string.h
+++ b/include/linux/fortify-string.h
@@ -18,7 +18,7 @@ void __write_overflow_field(size_t avail, size_t wanted) __compiletime_warning("

#define __compiletime_strlen(p) \
({ \
- unsigned char *__p = (unsigned char *)(p); \
+ char *__p = (char *)(p); \
size_t __ret = SIZE_MAX; \
size_t __p_size = __member_size(p); \
if (__p_size != SIZE_MAX && \

[Dianne Skoll]

Sorry,

Unless I'm reading this wrong, the solution is to downgrade gcc from
10.2.1-6 to 10.1.0-1?

Regards,

Dianne.

[Salvatore Bonaccorso]

Control: notfixed -1 10.1.0-1
Control: fixed -1 10.2.1-24

Hi,

Post by Dianne Skoll
Sorry,
Unless I'm reading this wrong, the solution is to downgrade gcc from
10.2.1-6 to 10.1.0-1?

Maybe a typo in the version? It should be fixed with 10.2.1-24 which
contains the PR tree-optimization/99824 change.

Cf. https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99824#c16

But this would as well need a fix in bullseye's gcc-10 ideally via a
point release.

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99824#c13 contains a
minimal testcase.

Regards,
Salvatore