This is the mail archive of the
mailing list for the GDB project.
FYI: gdbserver crash due to: [pushed] [PATCH V7 0/8] Intel(R) MPX register support
- From: Joel Brobecker <brobecker at adacore dot com>
- To: "Tedeschi, Walfred" <walfred dot tedeschi at intel dot com>
- Cc: Tom Tromey <tromey at redhat dot com>, Pedro Alves <palves at redhat dot com>, Yao Qi <yao at codesourcery dot com>, "Mark Kettenis (mark dot kettenis at xs4all dot nl)" <mark dot kettenis at xs4all dot nl>, "gdb-patches at sourceware dot org" <gdb-patches at sourceware dot org>
- Date: Mon, 25 Nov 2013 16:17:57 +0400
- Subject: FYI: gdbserver crash due to: [pushed] [PATCH V7 0/8] Intel(R) MPX register support
- Authentication-results: sourceware.org; auth=none
- References: <AC542571535E904D8E8ADAE745D60B191B1D8BC7 at IRSMSX104 dot ger dot corp dot intel dot com> <528E62B3 dot 7080005 at redhat dot com> <AC542571535E904D8E8ADAE745D60B191B1D9C3D at IRSMSX104 dot ger dot corp dot intel dot com> <87siuocq7e dot fsf at fleche dot redhat dot com> <AC542571535E904D8E8ADAE745D60B191B1DACC6 at IRSMSX104 dot ger dot corp dot intel dot com>
Just letting you guys know that I'm seeing a gdbserver crash
due to this bug, and that I am investigation - so that we don't
duplicate efforts. It's code that's completely new to me, so
I might take time figuring out what's wrong, hence the heads up.
FTR, I am on GNU/Linux Ubuntu 13.04 x86_64-linux.
% gdbserver :4444 simple_main
And then, start GDB elsewhere:
% gdb simple_main
(gdb) target remote :4444
GDBserver crashes as follow:
memory clobbered past end of allocated block
 + 26259 abort (core dumped) /[...]/gdbserver :4444 simple_main
I think one needs to be in development mode in order to see the problem.
Also FTR, here are my notes so far:
| In linux-low.c:regsets_store_inferior_registers:
| buf = xmalloc (regset->size); <<<- size is 576
| ... and then calls:
| regset->fill_function (regcache, buf);
| This goes to x86_fill_xstateregset, which is just a wrapper calling
| i387_cache_to_xsave. In i387_cache_to_xsave, we have:
| struct i387_xsave *fp = (struct i387_xsave *) buf;
| This is where things get dicey because:
| sizeof (struct i387_xsave) = 1040
| The first buffer overrun starts at:
| if ((clear_bv & I386_XSTATE_AVX))
| for (i = 0; i < num_xmm_registers; i++)
| memset (((char *) &fp->ymmh_space) + i * 16, 0, 16);
| And indeed, when looking at ymmh_space's offset, it's ... 576!
Now, I'll start looking at the discrepancy between regset-size
and sizeof (struct i387_xsave).
PS: Anyone else seeing this? Since the patch was applied several days
ago, I would have thought that someone else might have hit that...