Bug 1643318 - ubsan error in shared_ptr_base:514
Summary: ubsan error in shared_ptr_base:514
Keywords:
Status: CLOSED EOL
Alias: None
Product: Fedora
Classification: Fedora
Component: gcc
Version: 28
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Jakub Jelinek
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-10-26 01:11 UTC by Stas Sergeev
Modified: 2019-05-28 23:23 UTC (History)
15 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-05-28 23:23:28 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
Patch for libstdc++ (1.01 KB, patch)
2018-11-09 14:35 UTC, serge_sans_paille
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
GNU Compiler Collection 85930 0 None None None 2019-05-14 07:24:41 UTC

Description Stas Sergeev 2018-10-26 01:11:03 UTC
Description of problem:
The test-case from this bug report:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85930
or its reduced form:
---
#include <memory>

int main()
{
    std::shared_ptr<int> a = std::make_shared<int>(0);
    return *a;
}
---

fails on clang++ if compiled with "-fno-rtti -O2".
The interesting thing is that "-O2" produces 2 ubsan
errors, "-O1" produces 1 and "-O0" produces 0 errors!
So it almost looks as if -O specifies the amount of
errors to report. :)

Version-Release number of selected component (if applicable):
clang-6.0.1-2.fc28.x86_64

How reproducible:
easily

Steps to Reproduce:
1. clang++ -fno-rtti -fsanitize=undefined sptr.cpp -o sptr -O2
2. ./sptr

Actual results:
/usr/bin/../lib/gcc/x86_64-redhat-linux/8/../../../../include/c++/8/bits/shared_ptr_base.h:514:14: runtime error: reference binding to address 0x00000042f5f8 with insufficient space for an object of type 'const std::type_info'
0x00000042f5f8: note: pointer points here
 00 00 00 00  00 00 00 00 01 1b 03 3b  c0 14 00 00 97 02 00 00  a4 35 fd ff 1c 15 00 00  14 39 fd ff
              ^ 
/usr/bin/../lib/gcc/x86_64-redhat-linux/8/../../../../include/c++/8/bits/shared_ptr_base.h:1329:43: runtime error: reference binding to address 0x00000042f5f8 with insufficient space for an object of type 'const std::type_info'
0x00000042f5f8: note: pointer points here
 00 00 00 00  00 00 00 00 01 1b 03 3b  c0 14 00 00 97 02 00 00  a4 35 fd ff 1c 15 00 00  14 39 fd ff

Expected results:
No errors

Additional info:
I definitely have the fix from gcc bugzilla, libstdc++-8.2.1-4.fc28.x86_64
has it. But the fix seems to be fixing only gcc, even though it is for
libstdc++, not for gcc, and clang uses same fixed libstdc++ version...
With clang its still broken. Very strange.

Comment 1 serge_sans_paille 2018-11-09 14:03:18 UTC
I can reproduce with both clang++-6 from the repo *and* with master version of clang, and I confirm libstc++ is patched. Gotta investigate some more.

Comment 2 serge_sans_paille 2018-11-09 14:35:09 UTC
Created attachment 1503670 [details]
Patch for libstdc++

Comment 3 serge_sans_paille 2018-11-09 14:36:46 UTC
The patch above should do the trick: the gcc patch only patches alignment, this one patches alignment and size.

Comment 4 Stas Sergeev 2018-11-09 15:13:58 UTC
Interestingly, can't reproduce on Ubuntu-18.04.
Will test when back to the fedora machine.

Comment 5 Jonathan Wakely 2018-11-09 17:30:38 UTC
(In reply to serge_sans_paille from comment #3)
> The patch above should do the trick: the gcc patch only patches alignment,
> this one patches alignment and size.

But it makes the constructor non-trivial, which requires synchronization for the local static. We don't want that.

Please test this with Clang instead:

--- a/libstdc++-v3/include/bits/shared_ptr_base.h
+++ b/libstdc++-v3/include/bits/shared_ptr_base.h
@@ -510,7 +510,9 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
     static const type_info&
     _S_ti() noexcept _GLIBCXX_VISIBILITY(default)
     {
-      alignas(type_info) static constexpr _Sp_make_shared_tag __tag;
+      alignas(type_info) static constexpr char __tag[sizeof(type_info)] = {};
+      static_assert(sizeof(__tag) == sizeof(type_info), "");
+      static_assert(alignof(__tag) == alignof(type_info), "");
       return reinterpret_cast<const type_info&>(__tag);
     }
 #endif

Comment 6 Stas Sergeev 2018-11-10 04:39:57 UTC
(In reply to Stas Sergeev from comment #4)
> Interestingly, can't reproduce on Ubuntu-18.04.
No, forgot -fno-rtti.

> Will test when back to the fedora machine.
With the patch from comment #5 all seems well,
both in the test-case, and in the original code.

Comment 7 serge_sans_paille 2018-11-12 08:51:40 UTC
confirmed here too, with top-of-tree clang and packaged one.

Comment 8 Jonathan Wakely 2018-11-29 13:28:05 UTC
This is fixed upstream, r266376 on trunk and r266380 on gcc-8-branch.

Comment 9 Ben Cotton 2019-05-02 19:16:30 UTC
This message is a reminder that Fedora 28 is nearing its end of life.
On 2019-May-28 Fedora will stop maintaining and issuing updates for
Fedora 28. It is Fedora's policy to close all bug reports from releases
that are no longer maintained. At that time this bug will be closed as
EOL if it remains open with a Fedora 'version' of '28'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 28 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 10 Ben Cotton 2019-05-02 20:12:33 UTC
This message is a reminder that Fedora 28 is nearing its end of life.
On 2019-May-28 Fedora will stop maintaining and issuing updates for
Fedora 28. It is Fedora's policy to close all bug reports from releases
that are no longer maintained. At that time this bug will be closed as
EOL if it remains open with a Fedora 'version' of '28'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 28 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 11 Ben Cotton 2019-05-28 23:23:28 UTC
Fedora 28 changed to end-of-life (EOL) status on 2019-05-28. Fedora 28 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.


Note You need to log in before you can comment on or make changes to this bug.