FYI: gdbserver crash due to: [pushed] [PATCH V7 0/8] Intel(R) MPX register support

[Joel Brobecker <brobecker at adacore dot com>]

Hello,

Just letting you guys know that I'm seeing a gdbserver crash
due to this bug, and that I am investigation - so that we don't
duplicate efforts. It's code that's completely new to me, so
I might take time figuring out what's wrong, hence the heads up.

FTR, I am on GNU/Linux Ubuntu 13.04 x86_64-linux.

To reproduce:

   % gdbserver :4444 simple_main

And then, start GDB elsewhere:

   % gdb simple_main
   (gdb) target remote :4444
   (gdb) cont

GDBserver crashes as follow:

    memory clobbered past end of allocated block
    [1]  + 26259 abort (core dumped)  /[...]/gdbserver :4444 simple_main

I think one needs to be in development mode in order to see the problem.

Also FTR, here are my notes so far:

| In linux-low.c:regsets_store_inferior_registers:
|
|       buf = xmalloc (regset->size);  <<<- size is 576
|
| ... and then calls:
|
|           regset->fill_function (regcache, buf);
|
| This goes to x86_fill_xstateregset, which is just a wrapper calling
| i387_cache_to_xsave. In i387_cache_to_xsave, we have:
|
|   struct i387_xsave *fp = (struct i387_xsave *) buf;
|
| This is where things get dicey because:
|
|     sizeof (struct i387_xsave) = 1040
|
| The first buffer overrun starts at:
|
|       if ((clear_bv & I386_XSTATE_AVX))
|         for (i = 0; i < num_xmm_registers; i++)
|           memset (((char *) &fp->ymmh_space[0]) + i * 16, 0, 16);
|
| And indeed, when looking at ymmh_space's offset, it's ... 576!

Now, I'll start looking at the discrepancy between regset-size
and sizeof (struct i387_xsave).

-- 
Joel

PS: Anyone else seeing this? Since the patch was applied several days
    ago, I would have thought that someone else might have hit that...