__stack_chk_guard and -fstack-protector-strong

[Hari_S_Intel]

I am building some sources on CentOS 6 with the following command 

/opt/intel/composer_xe_2016.2.181/bin/intel64/icc -o stream.o -c -Wall -Wformat -Wformat-security -Wparentheses -fstack-protector-strong -g -O0 -gcc-name=/opt/gcc-4.9.1/bin/gcc -gxx-name=/opt/gcc-4.9.1/bin/g++ -O3 -openmp -DSTREAM_ARRAY_SIZE=64000000 -opt-prefetch-distance=64,8 -opt-streaming-cache-evict=0 -opt-streaming-stores always -axMIC-AVX512 -DDEBUG -D_FORTIFY_SOURCE=2 /stream/src/stream.c -fPIE

CentOS 6 ships with GCC 4.4.7 by default, we need C++11 support, so we have installed gcc-4.9.1 in /opt/gcc-4.9.1 

When I look up symbols in stream.o with "nm", I see a __stack_chk_guard symbol in some machines, and the symbol is missing from the object file built on other machines.

The ICC version and GCC-4.9.1 are completely identical.

What in the machine environment could be producing the difference where an object file built in one machine has __stack_chk_guard and the object file built on another does not?

When the __stack_chk_guard is not found in the symbols, I am able to build the binary by simply executing - 

/opt/intel/composer_xe_2016.2.181/bin/intel64/icc -o stream -static-intel -Wl,-z,noexecstack -Wl,-z,now -Wl,-z,relro stream.o  -liomp5 -pie

However, if the __stack_chk_guard is indeed present, I am now forced to add a "-L/opt/gcc-4.9.1/lib64 -lssp" or I get "Undefined reference to __stack_chk_guard" errors all over the place.

[Melanie_B_Intel]

Not every function needs stack protector code.  There are some details here: https://lwn.net/Articles/584225/

Presumably for any given function it would get the same stack protector code no matter what machine you compile it on, since you have the same compilers and os everywhere.

If you have more questions, you may want to open a ticket on Intel Premier Support for this

--Melanie

[KitturGanesh]

Thanks Melanie.  
@Hari, please let us know if you need any further clarification. If you happen to file a ticket in Intel Premier Support (https://premier.intel.com) an issue will be filed with our developers and all our further questions will be responded and recorded there as well, appreciate much.
_Kittur
 

[Hari_S_Intel]

Melanie Blower (Intel) wrote:
Presumably for any given function it would get the same stack protector code no matter what machine you compile it on, since you have the same compilers and os everywhere.

One of our developers found that the presence of the "/usr/lib64/libc.a" file from the "glibc-static" RPM disables the __stack_chk_guard symbol from being generated. However, if the file is not present ("glibc-static" RPM is not installed), then the __stack_chk_guard symbol is present in the output. 

Here is a sample code -

#include <string.h>

int main(int argc, char * argv[])
{
    char buffer[16];
    strcpy(buffer, argv[0]);

    return 0;
}

And here is the compilations -

# icc -fstack-protector-strong -gcc-name=/opt/gcc-4.9.2/bin/gcc test.c
# nm a.out | grep __stack
U __stack_chk_fail@@GLIBC_2.4
00000000006040a0 B __stack_chk_guard@@LIBSSP_1.0

# yum install glibc-static
# icc -fstack-protector-strong -gcc-name=/opt/gcc-4.9.2/bin/gcc test.c
# nm a.out | grep __stack
U __stack_chk_fail@@GLIBC_2.4

Why is this happening?

Kittur Ganesh (Intel) wrote:
@Hari, please let us know if you need any further clarification. If you happen to file a ticket in Intel Premier Support (https://premier.intel.com) an issue will be filed with our developers and all our further questions will be responded and recorded there as well, appreciate much.

_Kittur

hi, I have explained the situation in further detail above. However, I have created a ticket as well.

Thank you

[KitturGanesh]

Great, thanks Hari. BTW, I've communicated via that issue you filed in IPS as well. I'll update this thread once the issue is resolved and will communicate through that issue in IPS accordingly, thanks.

_Kittur 

[Coleman__Michael]

Just encountered this issue myself.  Quite mystifying.  Any update on when it will be fixed?

Cheers,

Mike