From patchwork Thu Nov 30 21:20:46 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Simon Marchi X-Patchwork-Id: 81058 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 5EEFC3861829 for ; Thu, 30 Nov 2023 21:21:16 +0000 (GMT) X-Original-To: gdb-patches@sourceware.org Delivered-To: gdb-patches@sourceware.org Received: from simark.ca (simark.ca [158.69.221.121]) by sourceware.org (Postfix) with ESMTPS id 966F53858417 for ; Thu, 30 Nov 2023 21:21:01 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 966F53858417 Authentication-Results: sourceware.org; dmarc=fail (p=none dis=none) header.from=efficios.com Authentication-Results: sourceware.org; spf=fail smtp.mailfrom=efficios.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 966F53858417 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=158.69.221.121 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1701379263; cv=none; b=ji7h7cFQpseaWYeA4UQyzQKOOJdtxVXBbadPTkBcUMacKcgiyNFS4p3q4iC807wVVzRWAx7RcIO9D2AxlzQAMtNFmYmff3E/kybqFo4Q2hDoXAZO02kdCWktHQW27e4F00c2SFNP0jk91814oS6aEUhuQu8ZDs8/LHYPPJH31xs= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1701379263; c=relaxed/simple; bh=qDGm7BcQcjorEegveAIyD0MGbl32bZaJWyFeGbqGDW8=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=mGN+yXvPNdevpObWL1iS08/TFR15kBR6ICOBkqOuRLl7+f3zzu6CXs+3glIe7cGiWCnjmM4lA0k/1bldZ4BEpHOzBzH9zp9JtFCGCnYP4mfr2F2nlRGStJgjAeZ9b+kQmyV40K2EeaWw5CWCzF23OR85WVPn9l+gLsauLjKqdo8= ARC-Authentication-Results: i=1; server2.sourceware.org Received: from smarchi-efficios.internal.efficios.com (192-222-143-198.qc.cable.ebox.net [192.222.143.198]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by simark.ca (Postfix) with ESMTPSA id F26051E0C0; Thu, 30 Nov 2023 16:21:00 -0500 (EST) From: Simon Marchi To: gdb-patches@sourceware.org Cc: Luis Machado , John Baldwin , Simon Marchi Subject: [PATCH 1/2] gdb: return when exceeding buffer size in regcache::transfer_regset Date: Thu, 30 Nov 2023 16:20:46 -0500 Message-ID: <20231130212057.722990-2-simon.marchi@efficios.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231130212057.722990-1-simon.marchi@efficios.com> References: <20231130212057.722990-1-simon.marchi@efficios.com> MIME-Version: 1.0 X-Spam-Status: No, score=-3496.7 required=5.0 tests=BAYES_00, GIT_PATCH_0, KAM_DMARC_NONE, KAM_DMARC_STATUS, SPF_HELO_PASS, SPF_SOFTFAIL, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gdb-patches@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gdb-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gdb-patches-bounces+patchwork=sourceware.org@sourceware.org regcache::transfer_regset iterates over an array of regcache_map_entry, transferring the registers (between regcache and buffer) described by those entries. It stops either when it reaches the end of the regcache_map_entry array (marked by a null entry) or (it seems like the intent is) when it reaches the end of the buffer (in which case not all described registers are transferred). I said "seems like the intent is", because there appears to be a small bug. transfer_regset is made of two loops: foreach regcache_map_entry: foreach register described by the regcache_map_entry: if the register doesn't fit in the remainder of the buffer: break transfer register When stopping because we have reached the end of the buffer, the break only breaks out of the inner loop. This problem causes some failures when I run tests such as gdb.arch/aarch64-sme-core-3.exp (on AArch64 Linux, in qemu). This is partly due to aarch64_linux_iterate_over_regset_sections failing to add a null terminator in its regcache_map_entry array, but I think there is still a problem in transfer_regset. The sequence to the crash is: - The `regcache_map_entry za_regmap` object built in aarch64_linux_iterate_over_regset_sections does not have a null terminator. - When the target does not have a ZA register, aarch64_linux_collect_za_regset calls `regcache->collect_regset` with a size of 0 (it's actually pointless, but still it should work). - transfer_regset gets called with a buffer size of 0. - transfer_regset detects that the register to transfer wouldn't fit in 0 bytes, so it breaks out of the inner loop. - The outer loop tries to go read the next regcache_map_entry, but there isn't one, and we start reading garbage. Obviously, this would get fixed by making aarch64_linux_iterate_over_regset_sections use a null terminator (which is what the following patch does). But I think that when detecting that there is not enough buffer left for the current register, transfer_regset should return, not only break out of the inner loop. This is a kind of contrived scenario, but imagine we have these two regcache_map_entry objects: - 2 registers of 8 bytes - 2 registers of 4 bytes For some reason, the caller passes a buffer of 12 bytes. transfer_regset will detect that the second 8 byte register does not fit, and break out of the inner loop. However, it will then go try the next regcache_map_entry. It will see that it can fit one 4 byte register in the remaining buffer space, and transfer it from/to there. This is very likely not an expected behavior, we wouldn't expect to read/write this sequence of registers from/to the buffer. In this example, whether passing a 12 bytes buffer makes sense or whether it is a size computation bug in the caller, we don't know, but I think that exiting as soon as a register doesn't fit is the sane thing to do. Change-Id: Ia349627d2e5d281822ade92a8e7a4dea4f839e07 Reviewed-By: John Baldwin Reviewed-By: Luis Machado --- gdb/regcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gdb/regcache.c b/gdb/regcache.c index 9dc354ec2b3a..e46a0b58f505 100644 --- a/gdb/regcache.c +++ b/gdb/regcache.c @@ -1208,7 +1208,7 @@ regcache::transfer_regset (const struct regset *regset, int regbase, for (; count--; regno++, offs += slot_size) { if (offs + slot_size > size) - break; + return; transfer_regset_register (out_regcache, regno, in_buf, out_buf, slot_size, offs); From patchwork Thu Nov 30 21:20:47 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Simon Marchi X-Patchwork-Id: 81059 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 8B7D6385C6EE for ; Thu, 30 Nov 2023 21:21:18 +0000 (GMT) X-Original-To: gdb-patches@sourceware.org Delivered-To: gdb-patches@sourceware.org Received: from simark.ca (simark.ca [158.69.221.121]) by sourceware.org (Postfix) with ESMTPS id 4D1E538582A5 for ; Thu, 30 Nov 2023 21:21:03 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 4D1E538582A5 Authentication-Results: sourceware.org; dmarc=fail (p=none dis=none) header.from=efficios.com Authentication-Results: sourceware.org; spf=fail smtp.mailfrom=efficios.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 4D1E538582A5 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=158.69.221.121 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1701379264; cv=none; b=n4AdTbZPjY5elBz1CHfW8T4pE/SkTum6jKxipbc2O5weBGuOt7qXwrrY68s8bQJwidnIsQRkzyYLS07f3RwN+VOwH5uSO3yKIX2clJi4EiXX8zf+22Qzolc30uw01LqN5ywp2x7+vIf7EMghDWXcNoEK2eFep1MyVHn1F/pUvx4= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1701379264; c=relaxed/simple; bh=hDsnqhiA+HK+u/jF/e2MzikpRRVAUB1BKDHuw0iy36c=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=QeoPAdQpHLBGXk6udNRwe7ARxQ6sbKzEne2OPR/wsHte9namoPdYpF3InVeSiMxudODDWannRhfcojuART+7tC+HGtqfool7AuFsRCe8L0U00+83ZBCP2xyrzOWaWzlG+b64J6fZxyhZYPisFIAzdmny7l9M8mrcNKjyVRsCt2E= ARC-Authentication-Results: i=1; server2.sourceware.org Received: from smarchi-efficios.internal.efficios.com (192-222-143-198.qc.cable.ebox.net [192.222.143.198]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by simark.ca (Postfix) with ESMTPSA id BF9F11E091; Thu, 30 Nov 2023 16:21:02 -0500 (EST) From: Simon Marchi To: gdb-patches@sourceware.org Cc: Luis Machado , John Baldwin , Simon Marchi Subject: [PATCH 2/2] gdb: add missing regcache_map_entry array null terminators in aarch64-linux-tdep.c Date: Thu, 30 Nov 2023 16:20:47 -0500 Message-ID: <20231130212057.722990-3-simon.marchi@efficios.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231130212057.722990-1-simon.marchi@efficios.com> References: <20231130212057.722990-1-simon.marchi@efficios.com> MIME-Version: 1.0 X-Spam-Status: No, score=-3496.7 required=5.0 tests=BAYES_00, GIT_PATCH_0, KAM_DMARC_NONE, KAM_DMARC_STATUS, SPF_HELO_PASS, SPF_SOFTFAIL, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gdb-patches@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gdb-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gdb-patches-bounces+patchwork=sourceware.org@sourceware.org Fix two spots in aarch64-linux-tdep.c that build regcache_map_entry arrays without a null terminator. The null terminators are needed for regcache::transfer_regset to work properly. Some shower thoughts: I'm wondering: if a caller uses supply_regset/collect_regset with a regcache_map_entry array that describes exactly X bytes, and passes a buffer of X bytes, should a null terminator really be needed? regcache::transfer_regset could be written in a way that it exits as soon as the remaining buffer size reaches 0. Right now, even when it has consumed exactly the X bytes of the buffer, transfer_regset needs to read the following regcache_map_entry's count (expected to be 0) to realize it's done. If it exited its outer loop when `offs == size`, it would remove the need for the null terminator in this case. Shower thought #2: we could also bypass that by using array_view to pass regcache_map_entry arrays, removing the need for null terminators altogether, but that's a bigger change. Change-Id: I3224a314e1360b319438f32de8c81e70ab42e105 Reviewed-By: John Baldwin --- gdb/aarch64-linux-tdep.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/gdb/aarch64-linux-tdep.c b/gdb/aarch64-linux-tdep.c index cd99b33fed25..5be887a9c817 100644 --- a/gdb/aarch64-linux-tdep.c +++ b/gdb/aarch64-linux-tdep.c @@ -1497,7 +1497,9 @@ aarch64_linux_iterate_over_regset_sections (struct gdbarch *gdbarch, /* Create this on the fly in order to handle the ZA register size. */ const struct regcache_map_entry za_regmap[] = { - { 1, tdep->sme_za_regnum, (int) std::pow (sve_vl_from_vq (tdep->sme_svq), 2) } + { 1, tdep->sme_za_regnum, + (int) std::pow (sve_vl_from_vq (tdep->sme_svq), 2) }, + { 0 } }; const struct regset aarch64_linux_za_regset = @@ -1518,7 +1520,8 @@ aarch64_linux_iterate_over_regset_sections (struct gdbarch *gdbarch, { const struct regcache_map_entry zt_regmap[] = { - { 1, tdep->sme2_zt0_regnum, AARCH64_SME2_ZT0_SIZE } + { 1, tdep->sme2_zt0_regnum, AARCH64_SME2_ZT0_SIZE }, + { 0 } }; /* We set the register set size to REGSET_VARIABLE_SIZE here because