[Bug ld/25940] ld.bfd, clang’s ubsan, shared libraries, and virtual tables do not work together

[dilyan.palauzov at aegee dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=25940

--- Comment #3 from dilyan.palauzov at aegee dot org <dilyan.palauzov at aegee 
dot org> ---
libubsan comes from gcc: after compiling and installig clang/llvm, no libubsan
is installed.  So it is not possible to link with the wrong libubsan, when
using clang, as no such linking is supposed to be done.

I have installed the LLVMgold.so plugin for clang 10 under
${libdir}/bfd-plugins and I created one more file, e.cpp:
  #include <stdio.h>
  #include <stdbool.h>
  #include <string>

  struct x {
    std::string x;
  };

  struct z : virtual x {
    z() {
      bool b = 99;
      printf("a %i\n", b);
    }
  };

  extern "C" {
    void y();
  }

  void y() {
    const z x1 = z();
  }

It differs from z.cpp only in:
e.cpp:   const z x1 = z();
z.cpp:   const x x1 = z();

The implication of this difference is, that after compiling e.cpp and z.cpp
into a DSO with
clang++ -fsanitize=address,undefined -shared -fpic -o libz.so z.cpp
clang++ -fsanitize=address,undefined -shared -fpic -o libe.so e.cpp
and then comparing the output of "nm -CDP libz.so" with "nm -CDP libe.so",
only in libz.so:
__asan_report_load8 U
__asan_stack_malloc_2 U
__ubsan_handle_dynamic_type_cache_miss U
__ubsan_vptr_type_cache U
Only in libe.so
__asan_stack_malloc_1 U
and other differences, not related to sanitizers.

Then I call:
  #!/usr/local/bin/bash
  for i in e z; do
    for linker in bfd lld gold; do
      for sanitizer in address undefined "address,undefined"; do
        echo "input $i clang linker $linker sanitizer $sanitizer"
        rm lib$i.so b -f
        clang++  -fsanitize=$sanitizer -fuse-ld=$linker -shared -fpic -o
lib$i.so $i.cpp \
        && clang -fsanitize=$sanitizer -fuse-ld=$linker -L. -l$i b.c -o b &&
LD_LIBRARY_PATH=. ./b
        echo "input $i gcc   linker $linker sanitizer $sanitizer"
        rm lib$i.so b -f
        g++      -fsanitize=$sanitizer -fuse-ld=$linker -shared -fpic -o
lib$i.so $i.cpp \
        && gcc   -fsanitize=$sanitizer -fuse-ld=$linker -L. -l$i b.c -o b &&
LD_LIBRARY_PATH=. ./b
      done
    done
  done

The gcc and llvm linker plugins under libdir/bfd-plugins play no role for the
output, which is:

input e clang linker bfd sanitizer address
a 1
input e gcc   linker bfd sanitizer address
a 1
input e clang linker bfd sanitizer undefined
a 1
input e gcc   linker bfd sanitizer undefined
a 1
input e clang linker bfd sanitizer address,undefined
a 1
input e gcc   linker bfd sanitizer address,undefined
a 1
input e clang linker lld sanitizer address
a 1
input e gcc   linker lld sanitizer address
a 1
input e clang linker lld sanitizer undefined
a 1
input e gcc   linker lld sanitizer undefined
a 1
input e clang linker lld sanitizer address,undefined
a 1
input e gcc   linker lld sanitizer address,undefined
a 1
input e clang linker gold sanitizer address
/usr/local/bin/ld.gold: warning: Cannot export local symbol
'__asan_extra_spill_area'
a 1
input e gcc   linker gold sanitizer address
a 1
input e clang linker gold sanitizer undefined
a 1
input e gcc   linker gold sanitizer undefined
a 1
input e clang linker gold sanitizer address,undefined
/usr/local/bin/ld.gold: warning: Cannot export local symbol
'__asan_extra_spill_area'
a 1
input e gcc   linker gold sanitizer address,undefined
a 1
input z clang linker bfd sanitizer address
a 1
input z gcc   linker bfd sanitizer address
a 1
input z clang linker bfd sanitizer undefined
/usr/local/bin/ld.bfd: ./libz.so: undefined reference to
`__ubsan_vptr_type_cache'
/usr/local/bin/ld.bfd: ./libz.so: undefined reference to
`__ubsan_handle_dynamic_type_cache_miss'
clang-10: error: linker command failed with exit code 1 (use -v to see
invocation)
input z gcc   linker bfd sanitizer undefined
a 1
input z clang linker bfd sanitizer address,undefined
/usr/local/bin/ld.bfd: ./libz.so: undefined reference to
`__ubsan_vptr_type_cache'
/usr/local/bin/ld.bfd: ./libz.so: undefined reference to
`__ubsan_handle_dynamic_type_cache_miss'
clang-10: error: linker command failed with exit code 1 (use -v to see
invocation)
input z gcc   linker bfd sanitizer address,undefined
a 1
input z clang linker lld sanitizer address
a 1
input z gcc   linker lld sanitizer address
a 1
input z clang linker lld sanitizer undefined
./b: symbol lookup error: ./libz.so: undefined symbol: __ubsan_vptr_type_cache
input z gcc   linker lld sanitizer undefined
a 1
input z clang linker lld sanitizer address,undefined
./b: symbol lookup error: ./libz.so: undefined symbol: __ubsan_vptr_type_cache
input z gcc   linker lld sanitizer address,undefined
a 1
input z clang linker gold sanitizer address
/usr/local/bin/ld.gold: warning: Cannot export local symbol
'__asan_extra_spill_area'
a 1
input z gcc   linker gold sanitizer address
a 1
input z clang linker gold sanitizer undefined
./b: symbol lookup error: ./libz.so: undefined symbol: __ubsan_vptr_type_cache
input z gcc   linker gold sanitizer undefined
a 1
input z clang linker gold sanitizer address,undefined
/usr/local/bin/ld.gold: warning: Cannot export local symbol
'__asan_extra_spill_area'
./b: symbol lookup error: ./libz.so: undefined symbol: __ubsan_vptr_type_cache
input z gcc   linker gold sanitizer address,undefined
a 1

Thus, without the type conversions 'const x x1 = z();' the only problem is the
GOLD report “/usr/local/bin/ld.gold: warning: Cannot export local symbol
'__asan_extra_spill_area'".

What does this mean?

GCC is always clear.

With the type conversion “const x x1 = z();" and clang and undefined (with or
without address):

With gold is reported “./b: symbol lookup error: ./libz.so: undefined symbol:
__ubsan_vptr_type_cache” at execution time.

With lld is reported “./b: symbol lookup error: ./libz.so: undefined symbol:
__ubsan_vptr_type_cache” at execution time.

With bfd is reported “
/usr/local/bin/ld.bfd: ./libz.so: undefined reference to
`__ubsan_vptr_type_cache'
/usr/local/bin/ld.bfd: ./libz.so: undefined reference to
`__ubsan_handle_dynamic_type_cache_miss'
clang-10: error: linker command failed with exit code 1 (use -v to see
invocation)” at link time.

To be honest, I think this is a problem with clang, as with the same parameters
gcc works, and gold and lld misbehave in supressing errors, but I am not 100%
sure, as I do not understand ELF.  So where is the problem exactly?

-- 
You are receiving this mail because:
You are on the CC list for the bug.