tinycc-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Tinycc-devel] core dump because stack overwritten


From: Pursuer
Subject: Re: [Tinycc-devel] core dump because stack overwritten
Date: Wed, 23 Oct 2019 23:03:08 +0800

amend.
--------------------------
--- a/tccgen.c        2019-10-22 19:52:48.761977245 +0200
+++ b/tccgen.c  2019-10-23 11:18:14.871290060 +0200
@@ -2627,7 +2627,9 @@ static void gen_cvt_ftoi1(int t)
          gfunc_call(1);
          vpushi(0);
          vtop->r = REG_IRET;
+#if PTR_SIZE == 4 
          vtop->r2 = REG_LRET;
+#endif
      } else {
          gen_cvt_ftoi(t);
      }
--------------------------

------------------ Original ------------------
From: "Pursuer"<address@hidden>;
Date: Wed, Oct 23, 2019 10:26 PM
To: "tinycc-devel"<address@hidden>;
Subject: Re: [Tinycc-devel] core dump because stack overwritten


It seem to be a issue for all 64bit architectures.
I advise to use PTR_SIZE == 8, like below.
--------------------------
--- a/tccgen.c        2019-10-22 19:52:48.761977245 +0200
+++ b/tccgen.c  2019-10-23 11:18:14.871290060 +0200
@@ -2627,7 +2627,9 @@ static void gen_cvt_ftoi1(int t)
          gfunc_call(1);
          vpushi(0);
          vtop->r = REG_IRET;
+#if PTR_SIZE == 8 /* REG_LRET only for VT_QLONG */
          vtop->r2 = REG_LRET;
+#endif
      } else {
          gen_cvt_ftoi(t);
      }
--------------------------
Windows calling convention is different from System V, This may be the reason why test case happend to work on Windows. But this bug can be shown by another way.

void test(unsigned long long a,unsigned long long c);
int main(int argc,char *argv[]){
long long a;
test((unsigned long long)a/1.0,(unsigned long long)a/1.0);
return 0;
}

compile and then disassemble it.
 
22:   f3 0f 7e 0d 00 00 00    movq   0x0(%rip),%xmm1        # 2a <main+0x2a>
29:   00
2a:   f2 0f 5e c1             divsd  %xmm1,%xmm0
2e:   66 49 0f 7e c2          movq   %xmm0,%r10
33:   4c 89 d1                mov    %r10,%rcx
36:   e8 00 00 00 00          callq  3b <main+0x3b>
3b:   48 8b 4d f8             mov    -0x8(%rbp),%rcx
3f:   49 89 ca                mov    %rcx,%r10
42:   48 89 45 f0             mov    %rax,-0x10(%rbp)
46:   48 89 55 f8             mov    %rdx,-0x8(%rbp)             ### RDX should not be saved
4a:   4c 89 d1                mov    %r10,%rcx
4d:   e8 00 00 00 00          callq  52 <main+0x52>

tcc should have saved only RAX(the return value of __fixunsdfdi). But in fact RDX is also saved.

------------------ Original ------------------
From: "Christian Jullien"<address@hidden>;
Date: Wed, Oct 23, 2019 05:50 PM
To: "tinycc-devel"<address@hidden>;"jullien"<address@hidden>;
Cc: "'Herman ten Brugge'"<address@hidden>;
Subject: Re: [Tinycc-devel] core dump because stack overwritten

Again I've no idea of the best patch to apply, but two remarks:

* First, 106_pthread.c fails on Windows because of:
Test: 106_pthread...
--- 106_pthread.expect  2019-10-22 20:47:55.982574300 +0200
+++ 106_pthread.output  2019-10-23 11:40:46.742218000 +0200
@@ -1 +1,2 @@
-ok
+In file included from 106_pthread.c:2:
+106_pthread.c:2: error: include file 'pthread.h' not found
You should run this test only on Linux systems

* Your new patch test TCC_TARGET_X86_64, how do you explain that with or without this patch your test case looks to work on Windows x64 and produces "42 42"?


-----Original Message-----
From: Tinycc-devel [mailto:tinycc-devel-bounces+eligis=address@hidden] On Behalf Of Herman ten Brugge via Tinycc-devel
Sent: Wednesday, October 23, 2019 11:23
To: address@hidden; address@hidden
Cc: Herman ten Brugge
Subject: Re: [Tinycc-devel] core dump because stack overwritten

How about this patch:

--------------------------
--- a/tccgen.c        2019-10-22 19:52:48.761977245 +0200
+++ b/tccgen.c  2019-10-23 11:18:14.871290060 +0200
@@ -2627,7 +2627,9 @@ static void gen_cvt_ftoi1(int t)
          gfunc_call(1);
          vpushi(0);
          vtop->r = REG_IRET;
+#if !defined(TCC_TARGET_X86_64) /* REG_LRET only for VT_QLONG */
          vtop->r2 = REG_LRET;
+#endif
      } else {
          gen_cvt_ftoi(t);
      }
--------------------------
According to https://en.wikipedia.org/wiki/X86_calling_conventions the
x86_64 only uses rax for 64 bits returns.

     Herman


On 2019-10-23 07:20, Christian Jullien wrote:
> I confirm your test case fails on Linux x64. It looks your patch pay attention to PTR_SIZE == 4 (i.e. it now enters if only with 32bit processor).
> However, w.o. the patch I can't reproduce the core dump on aarch64 Linux nor with Windows x64 which are also a 64bit processors. They both correctly display "42 42"
> No core dumps does not mean it works, memory may be corrupted somewhere else.
>
> Either your patch is only required for Linux x64 or there is something to investigate more carefully.
>
> I can only test on different platforms but I'm unable to give you further advices.
>
> M2c
>
> C.
>
> -----Original Message-----
> From: Tinycc-devel [mailto:tinycc-devel-bounces+eligis=address@hidden] On Behalf Of Herman ten Brugge via Tinycc-devel
> Sent: Tuesday, October 22, 2019 22:15
> To: address@hidden
> Cc: Herman ten Brugge
> Subject: [Tinycc-devel] core dump because stack overwritten
>
> I have a small testcase:
>
> --------------
> #include <stdio.h>
> #include <stdlib.h>
> #include <inttypes.h>
>
> int
> main(void)
> {
>     struct tst_struct { uint64_t cnt; } *tst =
>       (struct tst_struct *) malloc (sizeof (struct tst_struct));
>
>     tst->cnt = 42;
>     printf ("%" PRIu64 " %" PRIu64 "\n", tst->cnt, (uint64_t) (tst->cnt /
> 1.0));
>     return 0;
> }
> ----------------
> when I compile this with tcc and run it I get a core dump. The problem
> is that the stack is overwritten.
> I have a fix.
>
> ------------------------
> --- a/tccgen.c  2019-10-22 19:52:48.761977245 +0200
> +++ b/tccgen.c  2019-10-22 22:08:08.465825842 +0200
> @@ -1203,7 +1203,7 @@ ST_FUNC void save_reg_upstack(int r, int
>                    }
>    #endif
>                    /* special long long case */
> -                if ((p->r2 & VT_VALMASK) < VT_CONST) {
> +                if (PTR_SIZE == 4 && (p->r2 & VT_VALMASK) < VT_CONST) {
>                        sv.c.i += PTR_SIZE;
>                        store(p->r2, &sv);
>                    }
> ---------------------
> But am not sure if this is the correct fix. The code generator is quite
> complex.
>
>       Herman
>
>
> _______________________________________________
> Tinycc-devel mailing list
> address@hidden
> https://lists.nongnu.org/mailman/listinfo/tinycc-devel
>


_______________________________________________
Tinycc-devel mailing list
address@hidden
https://lists.nongnu.org/mailman/listinfo/tinycc-devel


_______________________________________________
Tinycc-devel mailing list
address@hidden
https://lists.nongnu.org/mailman/listinfo/tinycc-devel

reply via email to

[Prev in Thread] Current Thread [Next in Thread]