FYI: gdbserver crash due to: [pushed] [PATCH V7 0/8] Intel(R) MPX register support

Joel Brobecker
2013-11-25T12:18:11Z

Hello,

Just letting you guys know that I'm seeing a gdbserver crash
due to this bug, and that I am investigation - so that we don't
duplicate efforts. It's code that's completely new to me, so
I might take time figuring out what's wrong, hence the heads up.

FTR, I am on GNU/Linux Ubuntu 13.04 x86_64-linux.

To reproduce:

% gdbserver :4444 simple_main

And then, start GDB elsewhere:

% gdb simple_main
(gdb) target remote :4444
(gdb) cont

GDBserver crashes as follow:

memory clobbered past end of allocated block
[1] + 26259 abort (core dumped) /[...]/gdbserver :4444 simple_main

I think one needs to be in development mode in order to see the problem.

Also FTR, here are my notes so far:

| In linux-low.c:regsets_store_inferior_registers:
|
| buf = xmalloc (regset->size); <<<- size is 576
|
| ... and then calls:
|
| regset->fill_function (regcache, buf);
|
| This goes to x86_fill_xstateregset, which is just a wrapper calling
| i387_cache_to_xsave. In i387_cache_to_xsave, we have:
|
| struct i387_xsave *fp = (struct i387_xsave *) buf;
|
| This is where things get dicey because:
|
| sizeof (struct i387_xsave) = 1040
|
| The first buffer overrun starts at:
|
| if ((clear_bv & I386_XSTATE_AVX))
| for (i = 0; i < num_xmm_registers; i++)
| memset (((char *) &fp->ymmh_space[0]) + i * 16, 0, 16);
|
| And indeed, when looking at ymmh_space's offset, it's ... 576!

Now, I'll start looking at the discrepancy between regset-size
and sizeof (struct i387_xsave).

--
Joel

PS: Anyone else seeing this? Since the patch was applied several days
ago, I would have thought that someone else might have hit that...