GCC 13.1.1 (Arch Linux) seems to mis-align __m512i vectors on the stack when
-fsanitize=address is enabled. repro.c (below in this Gist) is a minimized
repro. Compile it like this:
gcc repro.c -g -mavx512f -fsanitize=address
When I execute it I get the following:
$ ./a.out
AddressSanitizer:DEADLYSIGNAL
=================================================================
==19063==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x561c3e127292 bp 0x7ffc7738ae80 sp 0x7ffc7738ad80 T0)
==19063==The signal is caused by a READ memory access.
==19063==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used.
#0 0x561c3e127292 in main /tmp/69176654f1db1bb96077d6ff4141a022/repro.c:4
#1 0x7f632603984f (/usr/lib/libc.so.6+0x2384f) (BuildId: 2f005a79cd1a8e385972f5a102f16adba414d75e)
#2 0x7f6326039909 in __libc_start_main (/usr/lib/libc.so.6+0x23909) (BuildId: 2f005a79cd1a8e385972f5a102f16adba414d75e)
#3 0x561c3e1270b4 in _start (/tmp/69176654f1db1bb96077d6ff4141a022/a.out+0x10b4) (BuildId: 52c240ffdc5530ccfe7bce9ebcc122ac12c8c4e9)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /tmp/69176654f1db1bb96077d6ff4141a022/repro.c:4 in main
==19063==ABORTING
You can reproduce this in Docker, using the current version of archlinux:base-devel
$ docker run --interactive --tty --rm archlinux:base-devel-20230521.0.152478
[root@c40aaea08a51 /]# gcc --version
gcc (GCC) 13.1.1 20230429
...
[root@c40aaea08a51 /]# cat << END > repro.c
#include <immintrin.h>
int main() { __m512i v = _mm512_set1_epi32(0); return *((int *)&v); }
END
[root@c40aaea08a51 /]# gcc repro.c -g -mavx512f -fsanitize=address
[root@c40aaea08a51 /]# ./a.out
AddressSanitizer:DEADLYSIGNAL
...
Running a.out under GDB shows that the immediate cause of the crash is a
vmovdqa64 instruction with a misaligned argument:
(gdb) display /i $pc
3: x/i $pc
=> 0x555555555292 <main+265>: vmovdqa64 %zmm0,-0x80(%rcx)
(gdb) p $rcx % 64
$2 = 32
Looking at repro.s (below in this Gist), I think the misaligned value of
rcx comes from the return value of __asan_stack_malloc_1.
The real world code that originally triggered this bug is: https://github.com/BLAKE3-team/BLAKE3/blob/76f9339312e1d52632a1cfb9df285c01911d99ce/c/blake3_avx512.c#L1078
Filed here: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110027