RE: gdbserver crash due to: [pushed] [PATCH V7 0/8] Intel(R) MPX register support

["Tedeschi, Walfred" <walfred.tedeschi@intel.com>]

Hi All,

I have found the root cause already: It is related to the i386-xstate.h size macro.
Just about to send a fix.

Thanks and regards,
-Fred

-----Original Message-----
From: Joel Brobecker [mailto:brobecker@adacore.com] 
Sent: Monday, November 25, 2013 1:18 PM
To: Tedeschi, Walfred
Cc: Tom Tromey; Pedro Alves; Yao Qi; Mark Kettenis (mark.kettenis@xs4all.nl); gdb-patches@sourceware.org
Subject: FYI: gdbserver crash due to: [pushed] [PATCH V7 0/8] Intel(R) MPX register support

Hello,

Just letting you guys know that I'm seeing a gdbserver crash due to this bug, and that I am investigation - so that we don't duplicate efforts. It's code that's completely new to me, so I might take time figuring out what's wrong, hence the heads up.

FTR, I am on GNU/Linux Ubuntu 13.04 x86_64-linux.

To reproduce:

   % gdbserver :4444 simple_main

And then, start GDB elsewhere:

   % gdb simple_main
   (gdb) target remote :4444
   (gdb) cont

GDBserver crashes as follow:

    memory clobbered past end of allocated block
    [1]  + 26259 abort (core dumped)  /[...]/gdbserver :4444 simple_main

I think one needs to be in development mode in order to see the problem.

Also FTR, here are my notes so far:

| In linux-low.c:regsets_store_inferior_registers:
|
|       buf = xmalloc (regset->size);  <<<- size is 576
|
| ... and then calls:
|
|           regset->fill_function (regcache, buf);
|
| This goes to x86_fill_xstateregset, which is just a wrapper calling 
| i387_cache_to_xsave. In i387_cache_to_xsave, we have:
|
|   struct i387_xsave *fp = (struct i387_xsave *) buf;
|
| This is where things get dicey because:
|
|     sizeof (struct i387_xsave) = 1040
|
| The first buffer overrun starts at:
|
|       if ((clear_bv & I386_XSTATE_AVX))
|         for (i = 0; i < num_xmm_registers; i++)
|           memset (((char *) &fp->ymmh_space[0]) + i * 16, 0, 16);
|
| And indeed, when looking at ymmh_space's offset, it's ... 576!

Now, I'll start looking at the discrepancy between regset-size and sizeof (struct i387_xsave).

--
Joel

PS: Anyone else seeing this? Since the patch was applied several days
    ago, I would have thought that someone else might have hit that...
Intel GmbH
Dornacher Strasse 1
85622 Feldkirchen/Muenchen, Deutschland
Sitz der Gesellschaft: Feldkirchen bei Muenchen
Geschaeftsfuehrer: Christian Lamprechter, Hannes Schwaderer, Douglas Lusk
Registergericht: Muenchen HRB 47456
Ust.-IdNr./VAT Registration No.: DE129385895
Citibank Frankfurt a.M. (BLZ 502 109 00) 600119052