regexp: *Regexp.String() sometimes faults on PPC on a nil *Regexp

[fasaxc]

Go version

go version go1.24.0 linux/amd64

Output of go env in your module/workspace:

AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='0'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE=''
GOARCH='ppc64le'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/go-cache'
GOCACHEPROG=''
GODEBUG=''
GOENV='/home/user/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3157633497=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/go/src/github.com/projectcalico/calico/go.mod'
GOMODCACHE='/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/go'
GOPPC64='power8'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/home/user/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='local'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.0'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

Running go run under qemu for PPC (so also possible that this is a qemu-specific bug), my code does

fmt.Sprint(value)

where value is an interface containing a *regexp.Regexp(nil).

What did you see happen?

On AMD64 this never seems to cause any problems. On PPC64LE (emulated via qemu), it works most of the time, but sometimes it hits a SIGSEGV fault, which doesn't get caught.

unexpected fault address 0xc000273110
fatal error: fault
[signal SIGSEGV: segmentation violation code=0x1 addr=0xc000273110 pc=0x186610]

goroutine 1 gp=0xc0000021c0 m=4 mp=0xc00038e008 [running]:
runtime.throw({0x185ecb2?, 0x12f668?})
	/usr/local/go/src/runtime/panic.go:1096 +0x34 fp=0xc000697630 sp=0xc0006975f0 pc=0x8f344
runtime.sigpanic()
	/usr/local/go/src/runtime/signal_unix.go:939 +0x254 fp=0xc0006976a0 sp=0xc000697630 pc=0x916c4
regexp.(*Regexp).String(0x29eb5a0?)
	/usr/local/go/src/regexp/regexp.go:104 fp=0xc0006976c0 sp=0xc0006976c0 pc=0x186610
fmt.(*pp).handleMethods(0xc0000d0340, 0x9a?)
	/usr/local/go/src/fmt/print.go:673 +0x33c fp=0xc0006978b0 sp=0xc0006976c0 pc=0x12f42c
fmt.(*pp).printArg(0xc0000d0340, {0x1824120, 0x0}, 0x76)
	/usr/local/go/src/fmt/print.go:756 +0x644 fp=0xc000697958 sp=0xc0006978b0 pc=0x12ff54
fmt.(*pp).doPrint(0xc0000d0340, {0xc000697d58?, 0x1, 0x80?})
	/usr/local/go/src/fmt/print.go:1208 +0x6c fp=0xc000697a10 sp=0xc000697958 pc=0x1336ec
fmt.Sprint({0xc000697d58, 0x1, 0x1})
	/usr/local/go/src/fmt/print.go:279 +0x5c fp=0xc000697a68 sp=0xc000697a10 pc=0x12ca3c
github.com/projectcalico/calico/felix/config.loadFelixParamMetadata({0x0, 0x0, 0x0})
	/go/src/github.com/projectcalico/calico/felix/config/metadata.go:324 +0x1a0 fp=0xc000697df8 sp=0xc000697a68 pc=0x13a6990
github.com/projectcalico/calico/felix/config.CombinedFieldInfo()
	/go/src/github.com/projectcalico/calico/felix/config/metadata.go:202 +0x34 fp=0xc000697eb0 sp=0xc000697df8 pc=0x13a5e14
main.main()
	/go/src/github.com/projectcalico/calico/felix/cmd/calico-felix-docgen/calico-felix-docgen.go:44 +0x70 fp=0xc000697f38 sp=0xc000697eb0 pc=0x13d09f0
runtime.main()
	/usr/local/go/src/runtime/proc.go:283 +0x2e8 fp=0xc000697fc0 sp=0xc000697f38 pc=0x57638
runtime.goexit({})
	/usr/local/go/src/runtime/asm_ppc64x.s:1022 +0x4 fp=0xc000697fc0 sp=0xc000697fc0 pc=0x96a84

What did you expect to see?

It'd be nice if the two platforms did the same thing in this case. Thought I'd raise it in case it was a more serious bug that this fault wasn't caught (there's a recover() in the formatting code but this gets detected as a fault, not a panic os it doesn't get caught by recover()).

If this is a live with, perhaps it'd be nice to make Regexp.String() explicitly tolerant to nil, that'd make it more convenient to deal with.

[fasaxc]

It doesn't seem to repro with a trivial program:

package main

import (
	"fmt"
	"regexp"
)

func main() {
	var nr *regexp.Regexp
	fmt.Println(nr)
}

[seankhliao]

it's possibly a qemu issue

[gabyhelp]

Related Issues

• runtime: encountered a SIGSEGV during 'go run' in go1.16beta1 #43284 (closed)
• Panic during Regexp.MatchString fuzzing #41073 (closed)
• text/template: panics encountered during function calls are hard to treat and debug #28242 (closed)
• SIGSEGV using regexp.MatchString() #26259 (closed)
• cmd/gc: go1.0.3 clean code crashes in scanblock() #5291 (closed)
• regexp: unexpected return pc for regexp.(*Regexp).tryBacktrack called #53989 (closed)
• go/reflect: Incorrect behavior on arm64 when using MakeFunc / Call #52788 (closed)
• cmd/compile: generic types implementing fmt.Stringer crash fmt.Printf #47740 (closed)
• runtime: weird panic while dumping non-pointer struct with wrapped error #38601
• runtime/checkptr: fatal error: checkptr: pointer arithmetic result points to invalid allocation #68415 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[seankhliao]

what sort of qemu setup is this? does it reproduce on real hardware?

[fasaxc]

We use qemu as part of our docker build pipeline to build non-native images via the binfmt mechanism. Unfortunately, I don't have any PPC hardware that I can test on. If anyone else has access to such hardware, the steps to repro are:

Check out this commit of our project: projectcalico/calico@9f4d893 Then:

cd felix
while make ARCH=ppc64le docs/config-params.json; do rm docs/config-params.json; done

The ARCH variable shouldn't be needed if building on native hardware. It doesn't repro every time; maybe one in 10.

I've got a workaround for this problem so I'll be checking that in soon.