Skip to contentSkip to conversation

configure: disable FORTIFY_SOURCE under clang

PATCH Applied John Snow 3 participants 3 messages Nov 3, 2015 – Nov 9, 2015

lore
Share & tools
lore

John Snow

author
#0 lore raw

PATCH v2 1/1 configure: disable FORTIFY_SOURCE under clang

Some versions of clang may have difficulty compiling glibc headers when -D_FORTIFY_SOURCE is used. For example, Clang++ 3.5.0-9.fc22 cannot compile glibc's stdio headers when -D_FORTIFY_SOURCE=2 is used. This manifests currently as build failures with clang and any arm target.

According to LLVM dev Richard Smith, clang does not target or support FORTIFY_SOURCE + glibc, and it should not be relied on. "It's still an unsupported combination, and while it might compile, some of the checks are unlikely to work because they require a frontend inliner to be useful"

See: http://lists.llvm.org/pipermail/cfe-dev/2015-November/045846.html

Conclusion: disable fortify-source if we appear to be using clang instead of testing for compile success or failure, which may be incidental or not indicative of proper support of the feature.

---
 configure | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)
configure +16 -1
index 7a1d08d..4d74fcc 100755
@@ -261,6 +261,7 @@ rdma=""
 gprof="no"
 debug_tcg="no"
 debug="no"
+fortify_source=""
 strip_opt="yes"
 tcg_interpreter="no"
 bigendian="no"
@@ -876,6 +877,7 @@ for opt do
       debug_tcg="yes"
       debug="yes"
       strip_opt="no"
+      fortify_source="no"
   ;;
   --enable-sparse) sparse="yes"
   ;;
@@ -4435,6 +4437,19 @@ if ! compile_object "-Werror"; then
     ccache_cpp2=yes
 fi
 
+#################################################
+# clang does not support glibc + FORTIFY_SOURCE.
+
+if test "$fortify_source" != "no"; then
+  if echo | $cc -dM -E - | grep __clang__ > /dev/null 2>&1 ; then
+    fortify_source="no";
+  elif echo | $cxx -dM -E - | grep __clang__ > /dev/null 2>&1 ; then
+    fortify_source="no";
+  else
+    fortify_source="yes"
+  fi
+fi
+
 ##########################################
 # End of CC checks
 # After here, no more $cc or $ld runs
@@ -4442,7 +4457,7 @@ fi
 if test "$gcov" = "yes" ; then
   CFLAGS="-fprofile-arcs -ftest-coverage -g $CFLAGS"
   LDFLAGS="-fprofile-arcs -ftest-coverage $LDFLAGS"
-elif test "$debug" = "no" ; then
+elif test "$fortify_source" = "yes" ; then
   CFLAGS="-O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 $CFLAGS"
 fi
 
Signature · 1 line
2.4.3
#1 lore raw
Quoted 64 lines · John Snow

Some versions of clang may have difficulty compiling glibc headers when -D_FORTIFY_SOURCE is used. For example, Clang++ 3.5.0-9.fc22 cannot compile glibc's stdio headers when -D_FORTIFY_SOURCE=2 is used. This manifests currently as build failures with clang and any arm target.

According to LLVM dev Richard Smith, clang does not target or support FORTIFY_SOURCE + glibc, and it should not be relied on. "It's still an unsupported combination, and while it might compile, some of the checks are unlikely to work because they require a frontend inliner to be useful"

See: http://lists.llvm.org/pipermail/cfe-dev/2015-November/045846.html

Conclusion: disable fortify-source if we appear to be using clang instead of testing for compile success or failure, which may be incidental or not indicative of proper support of the feature.

---
 configure | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)
configure +15 -0
index 7a1d08d..4d74fcc 100755
@@ -261,6 +261,7 @@ rdma=""
 gprof="no"
 debug_tcg="no"
 debug="no"
+fortify_source=""
 strip_opt="yes"
 tcg_interpreter="no"
 bigendian="no"
@@ -876,6 +877,7 @@ for opt do
       debug_tcg="yes"
       debug="yes"
       strip_opt="no"
+      fortify_source="no"
   ;;
   --enable-sparse) sparse="yes"
   ;;
@@ -4435,6 +4437,19 @@ if ! compile_object "-Werror"; then
     ccache_cpp2=yes
 fi
 
+#################################################
+# clang does not support glibc + FORTIFY_SOURCE.
+
+if test "$fortify_source" != "no"; then
+  if echo | $cc -dM -E - | grep __clang__ > /dev/null 2>&1 ; then
+    fortify_source="no";
+  elif echo | $cxx -dM -E - | grep __clang__ > /dev/null 2>&1 ; then
+    fortify_source="no";
+  else
+    fortify_source="yes"
+  fi
+fi
+
 ##########################################
 # End of CC checks
 # After here, no more $cc or $ld runs

configure fi · line 4463

Quoted 8 lines
configure +1 -1
@@ -4442,7 +4457,7 @@ fi
 if test "$gcov" = "yes" ; then
   CFLAGS="-fprofile-arcs -ftest-coverage -g $CFLAGS"
   LDFLAGS="-fprofile-arcs -ftest-coverage $LDFLAGS"
-elif test "$debug" = "no" ; then
+elif test "$fortify_source" = "yes" ; then
   CFLAGS="-O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 $CFLAGS"
 fi
 

Queued, thanks!

Paolo

#2 lore raw
In reply to John Snow
Quoted 21 lines · John Snow

Some versions of clang may have difficulty compiling glibc headers when -D_FORTIFY_SOURCE is used. For example, Clang++ 3.5.0-9.fc22 cannot compile glibc's stdio headers when -D_FORTIFY_SOURCE=2 is used. This manifests currently as build failures with clang and any arm target.

According to LLVM dev Richard Smith, clang does not target or support FORTIFY_SOURCE + glibc, and it should not be relied on. "It's still an unsupported combination, and while it might compile, some of the checks are unlikely to work because they require a frontend inliner to be useful"

See: http://lists.llvm.org/pipermail/cfe-dev/2015-November/045846.html

Conclusion: disable fortify-source if we appear to be using clang instead of testing for compile success or failure, which may be incidental or not indicative of proper support of the feature.

##########################################
# End of CC checks
# After here, no more $cc or $ld runs

configure fi · line 4462

Quoted 7 lines
configure +1 -1
@@ -4442,7 +4457,7 @@ fi
 if test "$gcov" = "yes" ; then
   CFLAGS="-fprofile-arcs -ftest-coverage -g $CFLAGS"
   LDFLAGS="-fprofile-arcs -ftest-coverage $LDFLAGS"
-elif test "$debug" = "no" ; then
+elif test "$fortify_source" = "yes" ; then
   CFLAGS="-O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 $CFLAGS"
 fi

This change means that a non-debug build with clang will no longer pass -O2 in the CFLAGS, so you get an unoptimized build...

You need to handle fortify_source=yes and debug=no separately.

thanks
-- PMM