Polly segfaults on kernel C code

[Gelbpunkt]

Hi there, I am still somewhat of a newbie when it comes to LLVM bug reports so please bear with me. I tried to provide as much information as I can.

I am trying to compile a 4.14 Linux kernel source (repository found here). Ever since a while ago, the compiler segfaults when trying to build it.

The compilers I am comparing here are two clang trunk builds from September 7th 2022 (I'll refer to this as clang-working) and one from October 19th 2022 (I'll refer to this as clang-broken). I have tried versions prior to October 19th already and those were broken too, but I don't have the resources to bisect this at the moment. I built these two clangs with ClangBuiltLinux's tc-build, with PGO, thin LTO and BOLT instrumentation.

The kernel source I have uses Polly via -mllvm -polly -mllvm -polly-run-dce -mllvm -polly-run-inliner -mllvm -polly-ast-use-context -mllvm -polly-detect-keep-going -mllvm -polly-vectorizer=stripmine -mllvm -polly-invariant-load-hoisting.

clang-broken segfaults when compiling dp_catalog.c.

I've taken the arguments from the crash information and reduced the generated C file with all the includes.

Full arguments for reproduction (kernel source is in /src, outdir was /src/out, /build/toolchain was clang-broken):

/build/toolchain/bin/clang-16 \
-cc1 \
-triple aarch64-unknown-linux-gnu \
-emit-llvm-bc \
-flto=full \
-flto-unit \
-disable-free \
-clear-ast-before-backend \
-disable-llvm-verifier \
-discard-value-names \
-main-file-name dp_catalog.c \
-mrelocation-model static \
-fno-delete-null-pointer-checks \
-mframe-pointer=non-leaf \
-relaxed-aliasing \
-fno-optimize-sibling-calls \
-fmath-errno \
-ffp-contract=on \
-fno-rounding-math \
-mconstructor-aliases \
-target-cpu generic \
-target-feature +neon \
-target-feature +v8a \
-target-feature +reserve-x18 \
-no-implicit-float \
-target-abi aapcs \
-mllvm \
-aarch64-enable-global-merge=false \
-mllvm \
-treat-scalable-fixed-error-as-warning \
-debugger-tuning=gdb \
-ffunction-sections \
-fdata-sections \
-fcoverage-compilation-dir=/src/out \
-nostdsysteminc \
-nobuiltininc \
-D __KERNEL__ \
-D KASAN_SHADOW_SCALE_SHIFT=3 \
-D CONFIG_AS_LSE=1 \
-D CONFIG_VDSO32=1 \
-D KASAN_SHADOW_SCALE_SHIFT=3 \
-D CC_HAVE_ASM_GOTO \
-D KBUILD_BASENAME="dp_catalog" \
-D KBUILD_MODNAME="msm_drm" \
-fmacro-prefix-map=/src/= \
-O3 \
-Wall \
-Wundef \
-Wstrict-prototypes \
-Wno-trigraphs \
-Werror-implicit-function-declaration \
-Wno-format-security \
-Werror=unknown-warning-option \
-Wno-misleading-indentation \
-Wno-bool-operation \
-Wno-unsequenced \
-Wno-asm-operand-widths \
-Wno-frame-address \
-Wno-int-in-bool-context \
-Wno-address-of-packed-member \
-Wno-format-invalid-specifier \
-Wno-gnu \
-Wno-duplicate-decl-specifier \
-Wno-tautological-constant-out-of-range-compare \
-Wno-sometimes-uninitialized \
-Wno-tautological-compare \
-Wno-unused-but-set-variable \
-Wno-unused-const-variable \
-Wdeclaration-after-statement \
-Wno-pointer-sign \
-Wno-array-bounds \
-Werror=implicit-int \
-Werror=strict-prototypes \
-Werror=date-time \
-Werror=incompatible-pointer-types \
-Wno-initializer-overrides \
-Wno-unused-value \
-Wno-format \
-Wno-sign-compare \
-Wno-format-zero-length \
-Wno-uninitialized \
-Wno-pointer-to-enum-cast \
-Wno-unaligned-access \
-Wno-pointer-to-int-cast \
-std=gnu89 \
-fdebug-compilation-dir=/src/out \
-ferror-limit 19 \
-fvisibility=default \
-fsanitize=cfi-derived-cast,cfi-icall,cfi-unrelated-cast,cfi-nvcall,cfi-vcall,shadow-call-stack \
-fsanitize-trap=cfi-derived-cast,cfi-icall,cfi-unrelated-cast,cfi-nvcall,cfi-vcall \
-fsanitize-system-ignorelist=/build/toolchain/lib/clang/16.0.0/share/cfi_ignorelist.txt \
-fno-sanitize-memory-param-retval \
-fsanitize-cfi-cross-dso \
-fwrapv \
-stack-protector 2 \
-fno-builtin \
-fno-signed-char \
-fwchar-type=short \
-fno-signed-wchar \
-fgnuc-version=4.2.1 \
-fcolor-diagnostics \
-vectorize-loops \
-vectorize-slp \
-mllvm \
-polly \
-mllvm \
-polly-run-dce \
-mllvm \
-polly-run-inliner \
-mllvm \
-polly-ast-use-context \
-mllvm \
-polly-detect-keep-going \
-mllvm \
-polly-vectorizer=stripmine \
-mllvm \
-polly-invariant-load-hoisting \
-fsplit-lto-unit \
-faddrsig \
-x c dp_catalog.c

The file compiles fine with clang-working and with clang-broken after removing Polly parameters.

I reduced the file using cvise down to:

dp_catalog.c:

typedef int u32;
#if 0
#else
typedef long __kernel_size_t;
#endif
#define __compiletime_assert(condition, msg, prefix, suffix)                   \
  void prefix(void);                                                           \
  prefix()
#define _compiletime_assert(condition, msg, prefix, suffix)                    \
  __compiletime_assert(, , prefix, )
#define compiletime_assert(condition, msg)                                     \
  _compiletime_assert(, , __compiletime_assert_, )
#if 0
#else
#define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(, )
#endif
#define container_of(ptr, type, member)                                        \
  ({                                                                           \
    void *__mptr = ptr;                                                        \
    BUILD_BUG_ON_MSG(, );                                                      \
    __mptr;                                                                    \
  })
#if 1
enum { DP_STREAM_1, DP_STREAM_MAX };
struct dp_dsc_cfg_data {
  u32 pps_word_len;
  u32 parity_word;
  u32 parity_word_len
} dp_write_io_data;
struct dp_catalog_private {
  int dp_catalog;
  char exe_mode[]
};
struct dp_catalog *dp_catalog_panel_dsc_cfg_dp_catalog;
int strcmp(char *, char *);
void memcpy(void *, void *, __kernel_size_t);
#endif
#define dp_catalog_get_priv(x)                                                 \
  ({                                                                           \
    struct dp_catalog *dp_catalog = container_of(x, , );                       \
    container_of(dp_catalog_panel_dsc_cfg_dp_catalog, , );                     \
  })
void dp_catalog_panel_dsc_cfg(struct dp_dsc_cfg_data *panel) {
  struct dp_catalog_private *catalog;
  if (panel >= DP_STREAM_MAX)
    return;
  catalog = dp_catalog_get_priv(panel);
  catalog->exe_mode;
  for (; panel->parity_word_len;)
    strcmp(catalog->exe_mode, "");
  for (; panel->pps_word_len;) {
    u32 data = 0;
    if (strcmp(catalog->exe_mode, ""))
      memcpy(&dp_write_io_data, &data, 0);
  }
}

[llvmbot]

@llvm/issue-subscribers-polly

[Meinersbur]

Thank you for the report and the reproducer.

The problem is the -polly-detect-keep-going flag. It ignores some errors during SCoP verification and then "forgets" that these errors occurred.

I was working on a quick fix but the problem goes deeper. I may consider removing the flag entirely as its main purpose is to "just" print more error messages. But then it also revealed some other problems that should be fixed.

[Gelbpunkt]

Hi, just wanted to say the fix does indeed work perfectly and thanks for the quick patch!