build: merge branch 'th/fix-lto'

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/605

20 files changed, 120 insertions, 42 deletions

diff --git a/.gitignore b/.gitignore
index 919b1830c9..8c08337548 100644
--- a/.gitignore
+++ b/.gitignore
@@ -217,6 +217,7 @@ test-*.trs
 /po/remove-potcdate.sin
 
 /src/NetworkManager
+/src/NetworkManager-all-sym
 /src/NetworkManager.ver
 /src/devices/bluetooth/tests/nm-bt-test
 /src/devices/tests/test-acd
diff --git a/Makefile.am b/Makefile.am
index 5841cbe72a..9808c25478 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -2406,7 +2406,26 @@ $(src_libNetworkManagerTest_la_OBJECTS): $(libnm_core_lib_h_pub_mkenums)
 
 ###############################################################################
 
-src/NetworkManager.ver: src/libNetworkManager.la $(core_plugins)
+noinst_PROGRAMS += src/NetworkManager-all-sym
+
+src_NetworkManager_all_sym_CPPFLAGS = $(src_cppflags)
+
+src_NetworkManager_all_sym_SOURCES = \
+	src/main.c
+
+src_NetworkManager_all_sym_LDADD = \
+	src/libNetworkManager.la \
+	$(GLIB_LIBS) \
+	$(NULL)
+
+src_NetworkManager_all_sym_LDFLAGS = \
+	-rdynamic \
+	$(SANITIZER_EXEC_LDFLAGS) \
+	$(NULL)
+
+$(src_NetworkManager_all_sym_OBJECTS): $(libnm_core_lib_h_pub_mkenums)
+
+src/NetworkManager.ver: src/NetworkManager-all-sym $(core_plugins)
 	$(AM_V_GEN) NM="$(NM)" "$(srcdir)/tools/create-exports-NetworkManager.sh" --called-from-build "$(srcdir)"
 
 CLEANFILES += src/NetworkManager.ver
@@ -4934,6 +4953,7 @@ endif
 
 check-local-clients-tests-test-client: clients/cli/nmcli clients/tests/test-client.py
 	mkdir -p "$(builddir)/clients/tests/"
+	"$(builddir)/clients/cli/nmcli" --version
 	GI_TYPELIB_PATH="$(abs_builddir)/libnm$${GI_TYPELIB_PATH:+:$$GI_TYPELIB_PATH}" \
 	LD_LIBRARY_PATH="$(abs_builddir)/libnm/.libs$${LD_LIBRARY_PATH:+:$$LD_LIBRARY_PATH}" \
 	NM_TEST_CLIENT_BUILDDIR="$(abs_builddir)" \
diff --git a/clients/cloud-setup/nm-http-client.c b/clients/cloud-setup/nm-http-client.c
index a1f9586d28..d8496f91b1 100644
--- a/clients/cloud-setup/nm-http-client.c
+++ b/clients/cloud-setup/nm-http-client.c
@@ -458,8 +458,8 @@ _poll_get_probe_finish_fcn (GObject *source,
 	_nm_unused gs_unref_object GTask *task = poll_get_data->task; /* balance ref from _poll_get_probe_start_fcn() */
 	gboolean success;
 	gs_free_error GError *local_error = NULL;
-	long response_code;
 	gs_unref_bytes GBytes *response_data = NULL;
+	long response_code = -1;
 
 	success = nm_http_client_get_finish (g_task_get_source_object (poll_get_data->task),
 	                                     result,
diff --git a/configure.ac b/configure.ac
index 8c582f6b09..d6842670a2 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1223,7 +1223,10 @@ else
 fi
 AC_SUBST(NM_LOG_COMPILER, 'LOG_COMPILER = "$(top_srcdir)/tools/run-nm-test.sh" --called-from-make "$(abs_top_builddir)" "$(LIBTOOL)" "$(with_valgrind)" "'"$with_valgrind_suppressions"'" --launch-dbus=auto')
 
-AM_PATH_PYTHON([], [], [PYTHON=python])
+AM_PATH_PYTHON([3], [], [PYTHON=])
+if test -z "$PYTHON"; then
+	AM_PATH_PYTHON([], [], [PYTHON=python])
+fi
 AC_SUBST(PYTHON, [$PYTHON])
 AC_DEFINE_UNQUOTED(TEST_NM_PYTHON, "$PYTHON", [Define python path for test binary])
 
diff --git a/contrib/fedora/rpm/NetworkManager.spec b/contrib/fedora/rpm/NetworkManager.spec
index 637e71f5fb..fada458d6a 100644
--- a/contrib/fedora/rpm/NetworkManager.spec
+++ b/contrib/fedora/rpm/NetworkManager.spec
@@ -59,7 +59,11 @@
 %bcond_without regen_docs
 %bcond_with    debug
 %bcond_with    test
+%if 0%{?fedora} >= 33
+%bcond_without lto
+%else
 %bcond_with    lto
+%endif
 %bcond_with    sanitizer
 %if 0%{?fedora}
 %bcond_without connectivity_fedora
@@ -134,6 +138,11 @@
 %global ebpf_enabled "no"
 %endif
 
+# Fedora 33 enables LTO by default by setting CFLAGS="-flto -ffat-lto-objects".
+# However, we also require "-flto -flto-partition=none", so disable Fedora's
+# default and use our configure option --with-lto instead.
+%define _lto_cflags %{nil}
+
 ###############################################################################
 
 Name: NetworkManager
diff --git a/libnm-core/nm-keyfile/nm-keyfile-utils.c b/libnm-core/nm-keyfile/nm-keyfile-utils.c
index 0e88609fd0..ddf01309ac 100644
--- a/libnm-core/nm-keyfile/nm-keyfile-utils.c
+++ b/libnm-core/nm-keyfile/nm-keyfile-utils.c
@@ -144,12 +144,12 @@ nm_keyfile_plugin_kf_get_integer_list_uint (GKeyFile *key_file,
 	gs_free guint *int_values = NULL;
 	gsize i, num_ints;
 
+	NM_SET_OUT (out_length, 0);
+
 	g_return_val_if_fail (key_file != NULL, NULL);
 	g_return_val_if_fail (group_name != NULL, NULL);
 	g_return_val_if_fail (key != NULL, NULL);
 
-	NM_SET_OUT (out_length, 0);
-
 	values = nm_keyfile_plugin_kf_get_string_list (key_file, group_name, key, &num_ints, &key_file_error);
 
 	if (key_file_error)
diff --git a/libnm-core/nm-keyfile/nm-keyfile.c b/libnm-core/nm-keyfile/nm-keyfile.c
index 47798d42b5..c1fcae3d28 100644
--- a/libnm-core/nm-keyfile/nm-keyfile.c
+++ b/libnm-core/nm-keyfile/nm-keyfile.c
@@ -2294,9 +2294,9 @@ wired_s390_options_writer_full (KeyfileWriterInfo *info,
 
 	n = nm_setting_wired_get_num_s390_options (s_wired);
 	for (i = 0; i < n; i++) {
+		gs_free char *key_to_free = NULL;
 		const char *opt_key;
 		const char *opt_val;
-		gs_free char *key_to_free = NULL;
 
 		nm_setting_wired_get_s390_option (s_wired, i, &opt_key, &opt_val);
 		nm_keyfile_plugin_kf_set_string (info->keyfile,
diff --git a/libnm-core/nm-setting-bridge.c b/libnm-core/nm-setting-bridge.c
index 02ad4f010c..8c6aaf57c0 100644
--- a/libnm-core/nm-setting-bridge.c
+++ b/libnm-core/nm-setting-bridge.c
@@ -269,6 +269,13 @@ nm_bridge_vlan_get_vid_range (const NMBridgeVlan *vlan,
                               guint16 *vid_start,
                               guint16 *vid_end)
 {
+	/* with LTO and optimization, the compiler complains that the
+	 * output variables are not initialized. In practice, the function
+	 * only sets the output on success. But make the compiler happy.
+	 */
+	NM_SET_OUT (vid_start, 0);
+	NM_SET_OUT (vid_end, 0);
+
 	g_return_val_if_fail (NM_IS_BRIDGE_VLAN (vlan, TRUE), 0);
 
 	NM_SET_OUT (vid_start, vlan->vid_start);
diff --git a/libnm-core/nm-setting-wired.c b/libnm-core/nm-setting-wired.c
index ab13d88a40..8b0f255860 100644
--- a/libnm-core/nm-setting-wired.c
+++ b/libnm-core/nm-setting-wired.c
@@ -490,6 +490,13 @@ nm_setting_wired_get_s390_option (NMSettingWired *setting,
 {
 	NMSettingWiredPrivate *priv;
 
+	/* with LTO and optimization, the compiler complains that the
+	 * output variables are not initialized. In practice, the function
+	 * only sets the output on success. But make the compiler happy.
+	 */
+	NM_SET_OUT (out_key,   NULL);
+	NM_SET_OUT (out_value, NULL);
+
 	g_return_val_if_fail (NM_IS_SETTING_WIRED (setting), FALSE);
 
 	priv = NM_SETTING_WIRED_GET_PRIVATE (setting);
diff --git a/libnm-core/nm-setting-wireguard.c b/libnm-core/nm-setting-wireguard.c
index 00e37a1f21..5bbbb18587 100644
--- a/libnm-core/nm-setting-wireguard.c
+++ b/libnm-core/nm-setting-wireguard.c
@@ -592,13 +592,16 @@ nm_wireguard_peer_get_allowed_ip (const NMWireGuardPeer *self,
 {
 	const char *s;
 
+	/* With LTO, the compiler might warn about the g_return_val_if_fail()
+	 * code path not initializing the output argument. Workaround that by
+	 * always setting the out argument. */
+	NM_SET_OUT (out_is_valid, FALSE);
+
 	g_return_val_if_fail (NM_IS_WIREGUARD_PEER (self, TRUE), NULL);
 
 	if (   !self->allowed_ips
-	    || idx >= self->allowed_ips->len) {
-		NM_SET_OUT (out_is_valid, FALSE);
+	    || idx >= self->allowed_ips->len)
 		return NULL;
-	}
 
 	s = self->allowed_ips->pdata[idx];
 	NM_SET_OUT (out_is_valid, s[0] != ALLOWED_IP_INVALID_X);
diff --git a/m4/compiler_options.m4 b/m4/compiler_options.m4
index 9adc1f14c3..d390a90cf0 100644
--- a/m4/compiler_options.m4
+++ b/m4/compiler_options.m4
@@ -60,11 +60,20 @@ if test "$GCC" = "yes" -a "$set_more_warnings" != "no"; then
 
 	CFLAGS_MORE_WARNINGS="-Wall"
 
+	if test "x$enable_lto" = xyes; then
+		dnl With LTO and optimizations enabled, gcc 10.2.1-1.fc32 is really
+		dnl adamant to warn about correct uses of strncpy. Disable that warning.
+		_CFLAGS_MORE_WARNINGS_DISABLE_LTO="-Wno-stringop-overflow"
+	else
+		_CFLAGS_MORE_WARNINGS_DISABLE_LTO=
+	fi
+
 	if test "x$set_more_warnings" = xerror; then
 		CFLAGS_MORE_WARNINGS="$CFLAGS_MORE_WARNINGS -Werror"
 	fi
 
 	for option in \
+		      $_CFLAGS_MORE_WARNINGS_DISABLE_LTO \
 		      -Wextra \
 		      -Wdeclaration-after-statement \
 		      -Wfloat-equal \
diff --git a/shared/nm-glib-aux/nm-shared-utils.c b/shared/nm-glib-aux/nm-shared-utils.c
index 656bab9a54..f6a9b83c01 100644
--- a/shared/nm-glib-aux/nm-shared-utils.c
+++ b/shared/nm-glib-aux/nm-shared-utils.c
@@ -4209,7 +4209,10 @@ nm_utils_hexstr2bin_alloc (const char *hexstr,
 	guint8 *buffer;
 	gsize buffer_len, len;
 
-	g_return_val_if_fail (hexstr, NULL);
+	if (G_UNLIKELY (!hexstr)) {
+		NM_SET_OUT (out_len, 0);
+		g_return_val_if_fail (hexstr, NULL);
+	}
 
 	nm_assert (required_len > 0 || out_len);
 
diff --git a/src/dhcp/nm-dhcp-systemd.c b/src/dhcp/nm-dhcp-systemd.c
index 792dc19a3c..737faad937 100644
--- a/src/dhcp/nm-dhcp-systemd.c
+++ b/src/dhcp/nm-dhcp-systemd.c
@@ -107,7 +107,7 @@ lease_to_ip4_config (NMDedupMultiIndex *multi_idx,
 	guint32 rebinding;
 	gs_free nm_sd_dhcp_option *private_options = NULL;
 
-	g_return_val_if_fail (lease != NULL, NULL);
+	nm_assert (lease != NULL);
 
 	if (sd_dhcp_lease_get_address (lease, &a_address) < 0) {
 		nm_utils_error_set_literal (error, NM_UTILS_ERROR_UNKNOWN, "could not get address from lease");
@@ -481,9 +481,9 @@ bound4_handle (NMDhcpSystemd *self, gboolean extended)
 {
 	NMDhcpSystemdPrivate *priv = NM_DHCP_SYSTEMD_GET_PRIVATE (self);
 	const char *iface = nm_dhcp_client_get_iface (NM_DHCP_CLIENT (self));
-	sd_dhcp_lease *lease;
 	gs_unref_object NMIP4Config *ip4_config = NULL;
 	gs_unref_hashtable GHashTable *options = NULL;
+	sd_dhcp_lease *lease = NULL;
 	GError *error = NULL;
 
 	if (   sd_dhcp_client_get_lease (priv->client4, &lease) < 0
@@ -744,7 +744,7 @@ lease_to_ip6_config (NMDedupMultiIndex *multi_idx,
 	nm_auto_free_gstring GString *str = NULL;
 	int num, i;
 
-	g_return_val_if_fail (lease, NULL);
+	nm_assert (lease);
 
 	ip6_config = nm_ip6_config_new (multi_idx, ifindex);
 
@@ -830,7 +830,7 @@ bound6_handle (NMDhcpSystemd *self)
 	gs_unref_hashtable GHashTable *options = NULL;
 	gs_free_error GError *error = NULL;
 	NMPlatformIP6Address prefix = { 0 };
-	sd_dhcp6_lease *lease;
+	sd_dhcp6_lease *lease = NULL;
 
 	if (   sd_dhcp6_client_get_lease (priv->client6, &lease) < 0
 	    || !lease) {
diff --git a/src/meson.build b/src/meson.build
index b2ea2ba0a1..5fc03d8d59 100644
--- a/src/meson.build
+++ b/src/meson.build
@@ -267,8 +267,8 @@ symbol_map_name = 'NetworkManager.ver'
 # add dependencies with link_whole, only supported in meson >= 0.46.
 # Create an executable with full symbols that we use in place of the
 # library to enumerate the symbols.
-network_manager_sym = executable(
-  'nm-full-symbols',
+network_manager_all_sym = executable(
+  'NetworkManager-all-sym',
   'main.c',
   dependencies: nm_deps,
   c_args: daemon_c_flags,
@@ -280,7 +280,7 @@ network_manager_sym = executable(
 ver_script = custom_target(
   symbol_map_name,
   output: symbol_map_name,
-  depends: [network_manager_sym, core_plugins],
+  depends: [network_manager_all_sym, core_plugins],
   command: [create_exports_networkmanager, '--called-from-build', source_root],
 )
 
diff --git a/src/nm-config-data.c b/src/nm-config-data.c
index 4169a36ea4..ea3aed470b 100644
--- a/src/nm-config-data.c
+++ b/src/nm-config-data.c
@@ -1361,6 +1361,8 @@ nm_config_data_get_device_config (const NMConfigData *self,
 	const MatchSectionInfo *connection_info;
 	char *value = NULL;
 
+	NM_SET_OUT (has_match, FALSE);
+
 	g_return_val_if_fail (self, NULL);
 	g_return_val_if_fail (property && *property, NULL);
 
diff --git a/src/nm-hostname-manager.c b/src/nm-hostname-manager.c
index f44e169e0d..86beffdfc0 100644
--- a/src/nm-hostname-manager.c
+++ b/src/nm-hostname-manager.c
@@ -11,6 +11,7 @@
 
 #if HAVE_SELINUX
 #include <selinux/selinux.h>
+#include <selinux/label.h>
 #endif
 
 #include "nm-libnm-core-intern/nm-common-macros.h"
@@ -345,8 +346,8 @@ nm_hostname_manager_write_hostname (NMHostnameManager *self, const char *hostnam
 	gs_unref_variant GVariant *var = NULL;
 	struct stat file_stat;
 #if HAVE_SELINUX
-	security_context_t se_ctx_prev = NULL, se_ctx = NULL;
-	mode_t st_mode = 0;
+	gboolean fcon_was_set = FALSE;
+	char *fcon_prev = NULL;
 #endif
 
 	g_return_val_if_fail (NM_IS_HOSTNAME_MANAGER (self), FALSE);
@@ -376,16 +377,6 @@ nm_hostname_manager_write_hostname (NMHostnameManager *self, const char *hostnam
 	    && (link_path = nm_utils_read_link_absolute (file, NULL)))
 		file = link_path;
 
-#if HAVE_SELINUX
-	/* Get default context for hostname file and set it for fscreate */
-	if (stat (file, &file_stat) == 0)
-		st_mode = file_stat.st_mode;
-	matchpathcon (file, st_mode, &se_ctx);
-	matchpathcon_fini ();
-	getfscreatecon (&se_ctx_prev);
-	setfscreatecon (se_ctx);
-#endif
-
 #if defined (HOSTNAME_PERSIST_GENTOO)
 	hostname_eol = g_strdup_printf ("#Generated by NetworkManager\n"
 	                                "hostname=\"%s\"\n", hostname);
@@ -393,13 +384,39 @@ nm_hostname_manager_write_hostname (NMHostnameManager *self, const char *hostnam
 	hostname_eol = g_strdup_printf ("%s\n", hostname);
 #endif
 
+#if HAVE_SELINUX
+	/* Get default context for hostname file and set it for fscreate */
+	{
+		struct selabel_handle *handle;
+
+		handle = selabel_open (SELABEL_CTX_FILE, NULL, 0);
+		if (handle) {
+			mode_t st_mode = 0;
+			char *fcon = NULL;
+
+			if (stat (file, &file_stat) == 0)
+				st_mode = file_stat.st_mode;
+
+			if (   (selabel_lookup (handle, &fcon, file, st_mode) == 0)
+			    && (getfscreatecon (&fcon_prev) == 0)) {
+				setfscreatecon (fcon);
+				fcon_was_set = TRUE;
+			}
+
+			selabel_close (handle);
+			freecon (fcon);
+		}
+	}
+#endif
+
 	ret = g_file_set_contents (file, hostname_eol, -1, &error);
 
 #if HAVE_SELINUX
 	/* Restore previous context and cleanup */
-	setfscreatecon (se_ctx_prev);
-	freecon (se_ctx);
-	freecon (se_ctx_prev);
+	if (fcon_was_set)
+		setfscreatecon (fcon_prev);
+	if (fcon_prev)
+		freecon (fcon_prev);
 #endif
 
 	g_free (hostname_eol);
diff --git a/src/nm-ip4-config.c b/src/nm-ip4-config.c
index e71432c51f..2c1c5b6385 100644
--- a/src/nm-ip4-config.c
+++ b/src/nm-ip4-config.c
@@ -375,7 +375,7 @@ nm_ip4_config_lookup_routes (const NMIP4Config *self)
 void
 nm_ip_config_iter_ip4_route_init (NMDedupMultiIter *ipconf_iter, const NMIP4Config *self)
 {
-	g_return_if_fail (NM_IS_IP4_CONFIG (self));
+	nm_assert (NM_IS_IP4_CONFIG (self));
 	nm_dedup_multi_iter_init (ipconf_iter, nm_ip4_config_lookup_routes (self));
 }
 
diff --git a/src/settings/plugins/keyfile/nms-keyfile-reader.c b/src/settings/plugins/keyfile/nms-keyfile-reader.c
index 577709d84d..0e9ad5fa48 100644
--- a/src/settings/plugins/keyfile/nms-keyfile-reader.c
+++ b/src/settings/plugins/keyfile/nms-keyfile-reader.c
@@ -171,6 +171,7 @@ nms_keyfile_reader_from_file (const char *full_filename,
 	NM_SET_OUT (out_is_nm_generated, NM_TERNARY_DEFAULT);
 	NM_SET_OUT (out_is_volatile, NM_TERNARY_DEFAULT);
 	NM_SET_OUT (out_is_external, NM_TERNARY_DEFAULT);
+	NM_SET_OUT (out_shadowed_owned, NM_TERNARY_DEFAULT);
 
 	if (!nms_keyfile_utils_check_file_permissions (NMS_KEYFILE_FILETYPE_KEYFILE,
 	                                               full_filename,
diff --git a/tools/create-exports-NetworkManager.sh b/tools/create-exports-NetworkManager.sh
index 47061f9dda..f439bd3112 100755
--- a/tools/create-exports-NetworkManager.sh
+++ b/tools/create-exports-NetworkManager.sh
@@ -40,11 +40,7 @@ call_nm() {
 }
 
 get_symbols_nm () {
-    if [ -z "$from_meson" ]; then
-        base=./src/.libs/libNetworkManager.a
-    else
-        base=./src/nm-full-symbols
-    fi
+    base=./src/NetworkManager-all-sym
     call_nm "$base" |
         sed -n 's/^[tTDGRBS] //p' |
         _sort
diff --git a/tools/run-nm-test.sh b/tools/run-nm-test.sh
index 11c9e17a0b..4df3ab962f 100755
--- a/tools/run-nm-test.sh
+++ b/tools/run-nm-test.sh
@@ -96,12 +96,12 @@ else
         NMTST_USE_VALGRIND=0
     fi
 
-    if [ -n "${NMTST_LIBTOOL-:x}" ]; then
-        NMTST_LIBTOOL=(sh "$SCRIPT_PATH/../libtool" --mode=execute)
-    elif [ -n "${NMTST_LIBTOOL-x}" ]; then
+    if [ -z "${NMTST_LIBTOOL+x}" ]; then
+        NMTST_LIBTOOL=(sh "$SCRIPT_PATH/../libtool" "--mode=execute")
+    elif [ -z "$NMTST_LIBTOOL" ]; then
         NMTST_LIBTOOL=()
     else
-        NMTST_LIBTOOL=($NMTST_LIBTOOL --mode=execute)
+        NMTST_LIBTOOL=("$NMTST_LIBTOOL" "--mode=execute")
     fi
     unset TEST
     while test $# -gt 0; do