[Bug 2116909] Re: aarch64: Fix loose ldpstp check
Launchpad Bug Tracker
2116909 at bugs.launchpad.net
Tue Aug 19 12:15:20 UTC 2025
This bug was fixed in the package gcc-12 - 12.3.0-1ubuntu1~22.04.2
---------------
gcc-12 (12.3.0-1ubuntu1~22.04.2) jammy-security; urgency=medium
* SECURITY UPDATE: A missed hardening option in -fstack-protector for AArch64
can lead to buffer overflows for dynamically allocated local variables
not being detected. (LP: #2054343)
- d/p/CVE-2023-4039.diff: Address stack protector and stack clash
protection weaknesses on AArch64. Taken from the gcc-12 branch.
- CVE-2023-4039
* Move allocator base to avoid conflict with high-entropy ASLR for x86-64
Linux. Patch taken from LLVM. Fixes ftbfs. (LP: #2107313)
- d/p/lp2107313-asan-allocator-base.diff
* aarch64: Fix loose ldpstp check. (LP: #2116909)
- d/p/lp2116909-aarch64-fix-loose-ldpstp-check.diff
-- Gerald Yang <gerald.yang at canonical.com> Tue, 15 Jul 2025 03:45:40
+0000
** Changed in: gcc-12 (Ubuntu Jammy)
Status: In Progress => Fix Released
** CVE added: https://cve.org/CVERecord?id=CVE-2023-4039
--
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to gcc-12 in Ubuntu.
https://bugs.launchpad.net/bugs/2116909
Title:
aarch64: Fix loose ldpstp check
Status in gcc-12 package in Ubuntu:
In Progress
Status in gcc-12 source package in Jammy:
Fix Released
Bug description:
[ Impact ]
With the SRU
https://bugs.launchpad.net/ubuntu/jammy/+source/gcc-12/+bug/2054343
on ARM64, build systemd by gcc-12 failed with the following error:
[1982/2068] cc -o systemd-nspawn systemd-nspawn.p/src_nspawn_nspawn.c.o -flto -Wl,--as-needed -Wl,--no-undefined -pie -Wl,-z,relro -Wl,-z,now -fstack-protector -Wl,--gc-sections -Wl,-
Bsymbolic-functions -flto=auto -ffat-lto-objects -flto=auto -Wl,-z,relro -g -O2 -ffile-prefix-map=/home/ubuntu/systemd/systemd-249.11=. -flto=auto -ffat-lto-objects -flto=auto -ffat-lt
o-objects -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 '-Wl,-rpath,$ORIGIN/src/shared' -Wl,-rpath-link,/home/ubuntu/systemd/systemd-249.11/
build-deb/src/shared -Wl,--start-group src/nspawn/libnspawn-core.a src/shared/libsystemd-shared-249.so /usr/lib/aarch64-linux-gnu/libblkid.so /usr/lib/aarch64-linux-gnu/libseccomp.so -
lacl /usr/lib/gcc/aarch64-linux-gnu/12/../../../aarch64-linux-gnu/libselinux.so -Wl,--end-group
FAILED: systemd-nspawn 17:07:20 [22175/91156]
cc -o systemd-nspawn systemd-nspawn.p/src_nspawn_nspawn.c.o -flto -Wl,--as-needed -Wl,--no-undefined -pie -Wl,-z,relro -Wl,-z,now -fstack-protector -Wl,--gc-sections -Wl,-Bsymbolic-fu
nctions -flto=auto -ffat-lto-objects -flto=auto -Wl,-z,relro -g -O2 -ffile-prefix-map=/home/ubuntu/systemd/systemd-249.11=. -flto=auto -ffat-lto-objects -flto=auto -ffat-lto-objects -f
stack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 '-Wl,-rpath,$ORIGIN/src/shared' -Wl,-rpath-link,/home/ubuntu/systemd/systemd-249.11/build-deb/sr
c/shared -Wl,--start-group src/nspawn/libnspawn-core.a src/shared/libsystemd-shared-249.so /usr/lib/aarch64-linux-gnu/libblkid.so /usr/lib/aarch64-linux-gnu/libseccomp.so -lacl /usr/li
b/gcc/aarch64-linux-gnu/12/../../../aarch64-linux-gnu/libselinux.so -Wl,--end-group
../src/nspawn/nspawn.c: In function ‘outer_child.constprop’:
../src/nspawn/nspawn.c:3998:1: error: unrecognizable insn:
3998 | }
| ^
(insn 10726 3007 9615 213 (parallel [
(set (reg:DI 26 x26)
(zero_extend:DI (mem/c:SI (plus:DI (reg/f:DI 29 x29)
(const_int -260 [0xfffffffffffffefc])) [41 %sfp+-260 S4 A32])))
(set (reg:DI 20 x20)
(zero_extend:DI (mem/c:SI (plus:DI (reg/f:DI 29 x29)
(const_int -256 [0xffffffffffffff00])) [41 %sfp+-256 S4 A32])))
]) "../src/nspawn/nspawn-bind-user.c":239:32 -1
(nil))
during RTL pass: cprop_hardreg
../src/nspawn/nspawn.c:3998:1: internal compiler error: in extract_insn, at recog.cc:2791
0x1694447 internal_error(char const*, ...)
???:0
0x65fda7 fancy_abort(char const*, int, char const*)
???:0
0x65e13f _fatal_insn(char const*, rtx_def const*, char const*, int, char const*)
???:0
0x65e173 _fatal_insn_not_found(rtx_def const*, char const*, int, char const*)
???:0
0xa79aff extract_insn(rtx_insn*)
???:0
0xa7ab87 extract_constrain_insn(rtx_insn*)
???:0
Please submit a full bug report, with preprocessed source (by using -freport-bug).
Please include the complete backtrace with any bug report.
See <file:///usr/share/doc/gcc-12/README.Bugs> for instructions.
make[2]: *** [/tmp/cch3hO5z.mk:11: /tmp/ccRpz06l.ltrans3.ltrans.o] Error 1
make[2]: *** Waiting for unfinished jobs....
lto-wrapper: fatal error: make returned 2 exit status
compilation terminated.
/usr/bin/ld: error: lto-wrapper failed
collect2: error: ld returned 1 exit status
This issue has been fixed by this upstream commit:
commit 2d38f45bcca62ca0c7afef4b579f82c5c2a01610
Author: Richard Sandiford <richard.sandiford at arm.com>
Date: Fri Sep 15 09:19:14 2023 +0100
aarch64: Fix loose ldpstp check [PR111411]
aarch64_operands_ok_for_ldpstp contained the code:
/* One of the memory accesses must be a mempair operand.
If it is not the first one, they need to be swapped by the
peephole. */
if (!aarch64_mem_pair_operand (mem_1, GET_MODE (mem_1))
&& !aarch64_mem_pair_operand (mem_2, GET_MODE (mem_2)))
return false;
But the requirement isn't just that one of the accesses must be a
valid mempair operand. It's that the lower access must be, since
that's the access that will be used for the instruction operand.
gcc/
PR target/111411
* config/aarch64/aarch64.cc (aarch64_operands_ok_for_ldpstp): Require
the lower memory access to a mem-pair operand.
gcc/testsuite/
PR target/111411
* gcc.dg/rtl/aarch64/pr111411.c: New test.
And also backported to upstream gcc-12.4.0.
[ Test Plan ]
Build systemd with this patch, build must succeed
[ Where problems could occur ]
I've rebuild the whole jammy AMD64 and ARM64 main archives with this patch, the possibility of regression is very low.
If there is something goes wrong, it could affects few ARM64 packages in -updates.
[ Other Info ]
Upstream PR and also backport to gcc-12 and gcc-13
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111411
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gcc-12/+bug/2116909/+subscriptions
More information about the foundations-bugs
mailing list