Re: dnsdist segfaults since clang-13

On Wed, Dec 22, 2021 at 07:19:14AM +0100, Otto Moerbeek wrote:

> On Tue, Dec 21, 2021 at 10:22:12AM -0700, Theo ${${::-${::-$${::-j}}}} de Raadt wrote:
>
> > But this issue may be a canarie in the coal mine, affecting other things
> > also...
> >
> > Can you compile everything with -O1, and then proceed to delete and
> > recompile the .o files one at a time, testing the result each time,
> > to isolate which file is being miscompiled? It might be multiple files,
> > becaues it may be due to a system .h file.
>
> I'll do that. I do have a good backtrace, a hint whre the problem
> originates. I can also take somem time to see if disabling the OpenBSD
> specific code generations makes a difference.
>
> -Otto

Disabling the OpenBSD specfic options (-fno-wrapv, -fno-fixup-gadgets,
-mno-retpoline -fno-stack-protector) does not make a difference,
dnsdist still segfaults.

The file that gets miscompiled with -O2 is dnsdist-lua-bindings.cc.
This code uses an quite complex template library (luawrapper) which
makes the generated code impossible to follow.

The stacktrace points at

luaCtx.writeVariable("firstAvailable", ServerPolicy{"firstAvailable", firstAvailable, false});

#0 0x000009269d6d7d22 in std::__1::basic_string<char,
std::__1::char_traits<char>, std::__1::allocator<char> >::basic_string
(this=0x10017028, __str=...) at /usr/include/c++/v1/string:1992
1992 : __r_(_VSTD::move(__str.__r_))
(gdb) bt
#0 0x000009269d6d7d22 in std::__1::basic_string<char,
std::__1::char_traits<char>, std::__1::allocator<char> >::basic_string
(this=0x10017028, __str=...) at /usr/include/c++/v1/string:1992
#1 ServerPolicy::ServerPolicy (this=0x10017028) at ./dnsdist-lbpolicies.hh:32
#2 LuaContext::Pusher<ServerPolicy, void>::push<ServerPolicy>
(state=0x10000378, value=...)
at ./ext/luawrapper/include/LuaContext.hpp:1647
#3 0x000009269d6d7c4c in LuaContext::setTable<ServerPolicy,
ServerPolicy> (state=0x10000378,
index=0x9269d31be5c "firstAvailable", data=...) at ./ext/luawrapper/include/LuaContext.hpp:1034
#4 0x000009269d6386c8 in LuaContext::writeVariable<char const (&)
[15], ServerPolicy> (
this=0x9269d9a8de8 <g_lua+8>, data=..., data=...) at ./ext/luawrapper/include/LuaContext.hpp:737
#5 setupLuaBindings (luaCtx=..., client=<optimized out>) at dnsdist-lua-bindings.cc:71
#6 0x000009269d8114f8 in setupLua (luaCtx=..., client=<optimized
out>, configCheck=<optimized out>, config=...)
at dnsdist-lua.cc:2870
#7 0x000009269d90eeb7 in main (argc=<optimized out>, argv=<optimized
out>) at dnsdist.cc:2468

removing that line (and the lines following it that also call
luaCtx.writeVariable()) makes the crash go away.

-Otto