This is the mail archive of the
gdb-patches@sourceware.org
mailing list for the GDB project.
RE: gdbserver crash due to: [pushed] [PATCH V7 0/8] Intel(R) MPX register support
- From: "Tedeschi, Walfred" <walfred dot tedeschi at intel dot com>
- To: Joel Brobecker <brobecker at adacore dot com>
- Cc: Tom Tromey <tromey at redhat dot com>, Pedro Alves <palves at redhat dot com>, Yao Qi <yao at codesourcery dot com>, "Mark Kettenis (mark dot kettenis at xs4all dot nl)" <mark dot kettenis at xs4all dot nl>, "gdb-patches at sourceware dot org" <gdb-patches at sourceware dot org>
- Date: Mon, 25 Nov 2013 12:19:42 +0000
- Subject: RE: gdbserver crash due to: [pushed] [PATCH V7 0/8] Intel(R) MPX register support
- Authentication-results: sourceware.org; auth=none
- References: <AC542571535E904D8E8ADAE745D60B191B1D8BC7 at IRSMSX104 dot ger dot corp dot intel dot com> <528E62B3 dot 7080005 at redhat dot com> <AC542571535E904D8E8ADAE745D60B191B1D9C3D at IRSMSX104 dot ger dot corp dot intel dot com> <87siuocq7e dot fsf at fleche dot redhat dot com> <AC542571535E904D8E8ADAE745D60B191B1DACC6 at IRSMSX104 dot ger dot corp dot intel dot com> <20131125121757 dot GB3114 at adacore dot com>
Hi All,
I have found the root cause already: It is related to the i386-xstate.h size macro.
Just about to send a fix.
Thanks and regards,
-Fred
-----Original Message-----
From: Joel Brobecker [mailto:brobecker@adacore.com]
Sent: Monday, November 25, 2013 1:18 PM
To: Tedeschi, Walfred
Cc: Tom Tromey; Pedro Alves; Yao Qi; Mark Kettenis (mark.kettenis@xs4all.nl); gdb-patches@sourceware.org
Subject: FYI: gdbserver crash due to: [pushed] [PATCH V7 0/8] Intel(R) MPX register support
Hello,
Just letting you guys know that I'm seeing a gdbserver crash due to this bug, and that I am investigation - so that we don't duplicate efforts. It's code that's completely new to me, so I might take time figuring out what's wrong, hence the heads up.
FTR, I am on GNU/Linux Ubuntu 13.04 x86_64-linux.
To reproduce:
% gdbserver :4444 simple_main
And then, start GDB elsewhere:
% gdb simple_main
(gdb) target remote :4444
(gdb) cont
GDBserver crashes as follow:
memory clobbered past end of allocated block
[1] + 26259 abort (core dumped) /[...]/gdbserver :4444 simple_main
I think one needs to be in development mode in order to see the problem.
Also FTR, here are my notes so far:
| In linux-low.c:regsets_store_inferior_registers:
|
| buf = xmalloc (regset->size); <<<- size is 576
|
| ... and then calls:
|
| regset->fill_function (regcache, buf);
|
| This goes to x86_fill_xstateregset, which is just a wrapper calling
| i387_cache_to_xsave. In i387_cache_to_xsave, we have:
|
| struct i387_xsave *fp = (struct i387_xsave *) buf;
|
| This is where things get dicey because:
|
| sizeof (struct i387_xsave) = 1040
|
| The first buffer overrun starts at:
|
| if ((clear_bv & I386_XSTATE_AVX))
| for (i = 0; i < num_xmm_registers; i++)
| memset (((char *) &fp->ymmh_space[0]) + i * 16, 0, 16);
|
| And indeed, when looking at ymmh_space's offset, it's ... 576!
Now, I'll start looking at the discrepancy between regset-size and sizeof (struct i387_xsave).
--
Joel
PS: Anyone else seeing this? Since the patch was applied several days
ago, I would have thought that someone else might have hit that...
Intel GmbH
Dornacher Strasse 1
85622 Feldkirchen/Muenchen, Deutschland
Sitz der Gesellschaft: Feldkirchen bei Muenchen
Geschaeftsfuehrer: Christian Lamprechter, Hannes Schwaderer, Douglas Lusk
Registergericht: Muenchen HRB 47456
Ust.-IdNr./VAT Registration No.: DE129385895
Citibank Frankfurt a.M. (BLZ 502 109 00) 600119052