Bug 2499684 - miscompilation that leads to segfaults with Rust 1.97.0
Summary: miscompilation that leads to segfaults with Rust 1.97.0
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: llvm
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Tulio Magno Quites Machado Filho
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-13 14:39 UTC by Fabio Valentini
Modified: 2026-07-28 01:18 UTC (History)
15 users (show)

Fixed In Version: llvm-22.1.8-4.fc44 llvm-21.1.8-6.fc43
Clone Of:
Environment:
Last Closed: 2026-07-23 01:20:43 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github llvm llvm-project issues 208611 0 None closed [x86] Incorrect load combining causing OOB reads (and thus segfaults at runtime) 2026-07-13 15:08:45 UTC
Github llvm llvm-project pull 208683 0 None Merged [SDAG] Freeze condition in select of load fold 2026-07-13 15:08:45 UTC

Description Fabio Valentini 2026-07-13 14:39:37 UTC
Description of problem:

It looks like this LLVM miscompilation issue reported in Rust upstream affects Fedora too:
https://github.com/rust-lang/rust/issues/159035

From what I can tell, we need to backport the LLVM fix from upstream to the Fedora LLVM package even if Rust releases a 1.97.1 since that will (most likely) only include a fix in the Rust internal LLVM copy that our packages don't use.

See also discussion in https://rust-lang.zulipchat.com/#narrow/channel/131828-t-compiler/topic/Miscompilation.20in.201.2E97.2E0.20with.20new.20Option.3A.3ANone.20discriminant/with/609854820

Version-Release number of selected component (if applicable):
rust-1.97.0-1.fc44
llvm-22.1.8-1.fc44

(Verified on Fedora 44 with the Rust 1.97.0 update installed, but Rawhide has the same version numbers so it should be affected in the same way.)

How reproducible:
Always.

Steps to Reproduce:
1. Create sample project ("cargo new crashy") and replace "crashy/src/main.rs" with the reproducer code snippet from the upstream report.
2. Run "cd crashy && cargo run --release".

Actual results:
Segfault.

Expected results:
No Segfault.

Additional info:
N/A

Comment 1 Josh Stone 2026-07-13 15:04:18 UTC
I am not surprised that we are affected, but have you directly experienced issues in real code?

Comment 2 Fabio Valentini 2026-07-13 15:40:18 UTC
"real" code? That is hard to say yet ...

koschei hasn't yet rebuilt all packages with Rust 1.97.0 in rawhide - and it would only catch issues in crates that run tests and where tests actually run the problematic code paths.

So far, I see only one package that newly fails to build with Rust 1.97.0, and it looks like that is only due to it expecting a specific enum discriminant representation:
https://koschei.fedoraproject.org/package/rust-tracing-core?collection=f45

---- metadata::tests::level_filter_reprs stdout ----
thread 'metadata::tests::level_filter_reprs' (332) panicked at src/metadata.rs:1119:13:
assertion `left == right` failed: repr changed for LevelFilter::OFF
  left: 5
 right: 18446744073709551615

And this looks more like a bug in tracing-core's side.

Comment 3 Josh Stone 2026-07-13 15:58:40 UTC
RE tracing-core -- FWIW that is related to the Rust change that also revealed the LLVM bug, but in this case tracing-core is making an unfounded assumption. It has `struct LevelFilter(Option<Level>)`, and `const OFF = LevelFilter(None)`. The test has a mapping array that includes (LevelFilter::OFF, LevelInner::Error as usize + 1), which is assuming that `None` fills the niche in the next greater value not used by Level. This was never guaranteed, and Rust 1.97 started to prefer wrapping the other way, choosing -1 for None in this case.

Comment 4 Tulio Magno Quites Machado Filho 2026-07-13 18:13:14 UTC
I proposed a backport to this issue for Rawhide at https://src.fedoraproject.org/rpms/llvm/pull-request/620

Comment 5 Fedora Update System 2026-07-21 09:26:24 UTC
FEDORA-2026-597e8f9de1 (llvm-22.1.8-4.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-597e8f9de1

Comment 6 Fedora Update System 2026-07-22 01:43:10 UTC
FEDORA-2026-597e8f9de1 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-597e8f9de1`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-597e8f9de1

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2026-07-23 01:20:43 UTC
FEDORA-2026-597e8f9de1 (llvm-22.1.8-4.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 8 Fedora Update System 2026-07-23 13:01:19 UTC
FEDORA-2026-e617677805 (llvm-21.1.8-6.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-e617677805

Comment 9 Fedora Update System 2026-07-24 01:51:45 UTC
FEDORA-2026-e617677805 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-e617677805`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-e617677805

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 10 Fedora Update System 2026-07-28 01:18:50 UTC
FEDORA-2026-e617677805 (llvm-21.1.8-6.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.