From patchwork Thu Nov 30 21:20:46 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Simon Marchi X-Patchwork-Id: 81058 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 5EEFC3861829 for ; Thu, 30 Nov 2023 21:21:16 +0000 (GMT) X-Original-To: gdb-patches@sourceware.org Delivered-To: gdb-patches@sourceware.org Received: from simark.ca (simark.ca [158.69.221.121]) by sourceware.org (Postfix) with ESMTPS id 966F53858417 for ; Thu, 30 Nov 2023 21:21:01 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 966F53858417 Authentication-Results: sourceware.org; dmarc=fail (p=none dis=none) header.from=efficios.com Authentication-Results: sourceware.org; spf=fail smtp.mailfrom=efficios.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 966F53858417 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=158.69.221.121 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1701379263; cv=none; b=ji7h7cFQpseaWYeA4UQyzQKOOJdtxVXBbadPTkBcUMacKcgiyNFS4p3q4iC807wVVzRWAx7RcIO9D2AxlzQAMtNFmYmff3E/kybqFo4Q2hDoXAZO02kdCWktHQW27e4F00c2SFNP0jk91814oS6aEUhuQu8ZDs8/LHYPPJH31xs= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1701379263; c=relaxed/simple; bh=qDGm7BcQcjorEegveAIyD0MGbl32bZaJWyFeGbqGDW8=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=mGN+yXvPNdevpObWL1iS08/TFR15kBR6ICOBkqOuRLl7+f3zzu6CXs+3glIe7cGiWCnjmM4lA0k/1bldZ4BEpHOzBzH9zp9JtFCGCnYP4mfr2F2nlRGStJgjAeZ9b+kQmyV40K2EeaWw5CWCzF23OR85WVPn9l+gLsauLjKqdo8= ARC-Authentication-Results: i=1; server2.sourceware.org Received: from smarchi-efficios.internal.efficios.com (192-222-143-198.qc.cable.ebox.net [192.222.143.198]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by simark.ca (Postfix) with ESMTPSA id F26051E0C0; Thu, 30 Nov 2023 16:21:00 -0500 (EST) From: Simon Marchi To: gdb-patches@sourceware.org Cc: Luis Machado , John Baldwin , Simon Marchi Subject: [PATCH 1/2] gdb: return when exceeding buffer size in regcache::transfer_regset Date: Thu, 30 Nov 2023 16:20:46 -0500 Message-ID: <20231130212057.722990-2-simon.marchi@efficios.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231130212057.722990-1-simon.marchi@efficios.com> References: <20231130212057.722990-1-simon.marchi@efficios.com> MIME-Version: 1.0 X-Spam-Status: No, score=-3496.7 required=5.0 tests=BAYES_00, GIT_PATCH_0, KAM_DMARC_NONE, KAM_DMARC_STATUS, SPF_HELO_PASS, SPF_SOFTFAIL, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gdb-patches@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gdb-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gdb-patches-bounces+patchwork=sourceware.org@sourceware.org regcache::transfer_regset iterates over an array of regcache_map_entry, transferring the registers (between regcache and buffer) described by those entries. It stops either when it reaches the end of the regcache_map_entry array (marked by a null entry) or (it seems like the intent is) when it reaches the end of the buffer (in which case not all described registers are transferred). I said "seems like the intent is", because there appears to be a small bug. transfer_regset is made of two loops: foreach regcache_map_entry: foreach register described by the regcache_map_entry: if the register doesn't fit in the remainder of the buffer: break transfer register When stopping because we have reached the end of the buffer, the break only breaks out of the inner loop. This problem causes some failures when I run tests such as gdb.arch/aarch64-sme-core-3.exp (on AArch64 Linux, in qemu). This is partly due to aarch64_linux_iterate_over_regset_sections failing to add a null terminator in its regcache_map_entry array, but I think there is still a problem in transfer_regset. The sequence to the crash is: - The `regcache_map_entry za_regmap` object built in aarch64_linux_iterate_over_regset_sections does not have a null terminator. - When the target does not have a ZA register, aarch64_linux_collect_za_regset calls `regcache->collect_regset` with a size of 0 (it's actually pointless, but still it should work). - transfer_regset gets called with a buffer size of 0. - transfer_regset detects that the register to transfer wouldn't fit in 0 bytes, so it breaks out of the inner loop. - The outer loop tries to go read the next regcache_map_entry, but there isn't one, and we start reading garbage. Obviously, this would get fixed by making aarch64_linux_iterate_over_regset_sections use a null terminator (which is what the following patch does). But I think that when detecting that there is not enough buffer left for the current register, transfer_regset should return, not only break out of the inner loop. This is a kind of contrived scenario, but imagine we have these two regcache_map_entry objects: - 2 registers of 8 bytes - 2 registers of 4 bytes For some reason, the caller passes a buffer of 12 bytes. transfer_regset will detect that the second 8 byte register does not fit, and break out of the inner loop. However, it will then go try the next regcache_map_entry. It will see that it can fit one 4 byte register in the remaining buffer space, and transfer it from/to there. This is very likely not an expected behavior, we wouldn't expect to read/write this sequence of registers from/to the buffer. In this example, whether passing a 12 bytes buffer makes sense or whether it is a size computation bug in the caller, we don't know, but I think that exiting as soon as a register doesn't fit is the sane thing to do. Change-Id: Ia349627d2e5d281822ade92a8e7a4dea4f839e07 Reviewed-By: John Baldwin Reviewed-By: Luis Machado --- gdb/regcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gdb/regcache.c b/gdb/regcache.c index 9dc354ec2b3a..e46a0b58f505 100644 --- a/gdb/regcache.c +++ b/gdb/regcache.c @@ -1208,7 +1208,7 @@ regcache::transfer_regset (const struct regset *regset, int regbase, for (; count--; regno++, offs += slot_size) { if (offs + slot_size > size) - break; + return; transfer_regset_register (out_regcache, regno, in_buf, out_buf, slot_size, offs);