if alignb > ASAN_RED_ZONE_SIZE and offset[0] is not multiple of alignb. (base_align_bias - base_offset) may not aligned to alignb, and caused segement fault.
Bootstrapped and regtested on x86_64-linux-gnu{-m32,}. Ok for trunk and backport to GCC13? gcc/ChangeLog: PR sanitizer/110027 * cfgexpand.cc (expand_stack_vars): Align frame offset to MAX (alignb, ASAN_RED_ZONE_SIZE). gcc/testsuite/ChangeLog: * g++.dg/asan/pr110027.C: New test. --- gcc/cfgexpand.cc | 2 +- gcc/testsuite/g++.dg/asan/pr110027.C | 20 ++++++++++++++++++++ 2 files changed, 21 insertions(+), 1 deletion(-) create mode 100644 gcc/testsuite/g++.dg/asan/pr110027.C diff --git a/gcc/cfgexpand.cc b/gcc/cfgexpand.cc index 0de299c62e3..92062378d8e 100644 --- a/gcc/cfgexpand.cc +++ b/gcc/cfgexpand.cc @@ -1214,7 +1214,7 @@ expand_stack_vars (bool (*pred) (size_t), class stack_vars_data *data) { if (data->asan_vec.is_empty ()) { - align_frame_offset (ASAN_RED_ZONE_SIZE); + align_frame_offset (MAX (alignb, ASAN_RED_ZONE_SIZE)); prev_offset = frame_offset.to_constant (); } prev_offset = align_base (prev_offset, diff --git a/gcc/testsuite/g++.dg/asan/pr110027.C b/gcc/testsuite/g++.dg/asan/pr110027.C new file mode 100644 index 00000000000..0067781bc89 --- /dev/null +++ b/gcc/testsuite/g++.dg/asan/pr110027.C @@ -0,0 +1,20 @@ +/* PR sanitizer/110027 */ +/* { dg-do run } */ +/* { dg-require-effective-target avx512f_runtime } */ +/* { dg-options "-std=gnu++23 -mavx512f -fsanitize=address -O0 -g -fstack-protector-strong" } */ + +#include <cstddef> +#include <cstdint> + +template <ptrdiff_t W, typename T> +using Vec [[gnu::vector_size(W * sizeof(T))]] = T; + +auto foo() { + Vec<8, int64_t> ret{}; + return ret; +} + +int main() { + foo(); + return 0; +} -- 2.31.1