[Bug breakpoints/24541] New: Incorrect evaluation of systemtap probes due to register being signed and probe expression assuming unsigned

[andrew.burgess at embecosm dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=24541

            Bug ID: 24541
           Summary: Incorrect evaluation of systemtap probes due to
                    register being signed and probe expression assuming
                    unsigned
           Product: gdb
           Version: HEAD
            Status: NEW
          Severity: normal
          Priority: P2
         Component: breakpoints
          Assignee: unassigned at sourceware dot org
          Reporter: andrew.burgess at embecosm dot com
  Target Milestone: ---

Created attachment 11768
  --> https://sourceware.org/bugzilla/attachment.cgi?id=11768&action=edit
Test case.

Grab the attached tar file, then:

  $ tar -xf probe-bug.tar.xz
  cd probe-bug
  make
  make check

The included test program does throw and catch some exceptions, and the gdb
script sets up a possible catch with 'catch throw blahblah'.  However,
'blahblah' doesn't match any of the exception types we throw or catch, so the
expectation is that GDB will not stop at any of the throws, and instead the
program will run to completion.

What I actually observe is the program stops at the 'throw' and GDB prints this
error:

  could not find minimal symbol for typeinfo address 0xffff8804

Unfortunately this bug relies on the specific address that happens to be in a
register, if the address doesn't have the "correct" bit set then the bug will
not trigger.

What has happened is that GDB stops at the SystemTap probe point for "throw",
it then tries to extract the arguments for this probe point.  For the
particular problem argument the systemtap expression as understood by gdb is:

            0  UNOP_CAST             Type @0x55ade9b8e430 (uint32_t)
            3    OP_REGISTER           Register $di

The value of $di register when we stop is this:

    (gdb) p/x $edi
    $1 = 0x8048804
    (gdb) p/x $di
    $2 = 0x8804

And, critically, the type of $di is:

    (gdb) ptype $di
    type = int16_t

What's happening then is when GDB evaluates the SystemTap expression it is
doing this:

    (gdb) p/x (unsigned int) $di
    $3 = 0xffff8804

Which gives us the '0xffff8804' problem value we see in the error.  However
what SystemTap is expecting is something more like this:

    (gdb) p/x (unsigned int) ((unsigned short) $di)
    $4 = 0x8804

Or to put it another way, SystemTap is assuming the register is unsigned.

It's not clear to me if the problem is
   (a) SystemTaps expressions are wrong, and should not assume the register is
signed / unsigned, 
   (b) GDB's register type is wrong, and we should change the registers to be
unsigned, or
   (c) GDB's expression evaluation is wrong, and we should somehow be special
casing SystemTap expressions to force registers unsigned in this case...

One final note, this bug is present on older and more recent versions of GDB
(current HEAD 9-May-2019) however, in current HEAD a completely different bug
will hit you first.  When GDB tries to print the error "could not find minimal
symbol for typeinfo address 0xffff8804" a terminal ownership bug will cause GDB
to receive SIGSTOP and go into the background.  I've included a GDB patch to
work around this issue inside the probe-bug.tar.xz tar file (see
probe-bug/sigstop-bug.patch).

-- 
You are receiving this mail because:
You are on the CC list for the bug.