if alignb > ASAN_RED_ZONE_SIZE and offset[0] is not multiple of
alignb. (base_align_bias - base_offset) may not aligned to alignb, and
caused segement fault.

Bootstrapped and regtested on x86_64-linux-gnu{-m32,}.
Ok for trunk and backport to GCC13?

gcc/ChangeLog:

        PR sanitizer/110027
        * cfgexpand.cc (expand_stack_vars): Align frame offset to
        MAX (alignb, ASAN_RED_ZONE_SIZE).

gcc/testsuite/ChangeLog:

        * g++.dg/asan/pr110027.C: New test.
---
 gcc/cfgexpand.cc                     |  2 +-
 gcc/testsuite/g++.dg/asan/pr110027.C | 20 ++++++++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)
 create mode 100644 gcc/testsuite/g++.dg/asan/pr110027.C

diff --git a/gcc/cfgexpand.cc b/gcc/cfgexpand.cc
index 0de299c62e3..92062378d8e 100644
--- a/gcc/cfgexpand.cc
+++ b/gcc/cfgexpand.cc
@@ -1214,7 +1214,7 @@ expand_stack_vars (bool (*pred) (size_t), class 
stack_vars_data *data)
            {
              if (data->asan_vec.is_empty ())
                {
-                 align_frame_offset (ASAN_RED_ZONE_SIZE);
+                 align_frame_offset (MAX (alignb, ASAN_RED_ZONE_SIZE));
                  prev_offset = frame_offset.to_constant ();
                }
              prev_offset = align_base (prev_offset,
diff --git a/gcc/testsuite/g++.dg/asan/pr110027.C 
b/gcc/testsuite/g++.dg/asan/pr110027.C
new file mode 100644
index 00000000000..0067781bc89
--- /dev/null
+++ b/gcc/testsuite/g++.dg/asan/pr110027.C
@@ -0,0 +1,20 @@
+/* PR sanitizer/110027 */
+/* { dg-do run } */
+/* { dg-require-effective-target avx512f_runtime } */
+/* { dg-options "-std=gnu++23 -mavx512f -fsanitize=address -O0 -g 
-fstack-protector-strong" } */
+
+#include <cstddef>
+#include <cstdint>
+
+template <ptrdiff_t W, typename T>
+using Vec [[gnu::vector_size(W * sizeof(T))]] = T;
+
+auto foo() {
+  Vec<8, int64_t> ret{};
+  return ret;
+}
+
+int main() {
+  foo();
+  return 0;
+}
-- 
2.31.1

Reply via email to