Bug 598615

Summary: Changing register contents (such as $return) causes crash
Product: Red Hat Enterprise Linux 5 Reporter: Fabio Olive Leite <fleite>
Component: systemtapAssignee: Frank Ch. Eigler <fche>
Status: CLOSED ERRATA QA Contact: qe-baseos-tools-bugs
Severity: high Docs Contact:
Priority: high    
Version: 5.5CC: dsmith, mjw, pmuller, tao
Target Milestone: rcKeywords: ZStream
Target Release: ---   
Hardware: ia64   
OS: Linux   
Whiteboard:
Fixed In Version: systemtap-1.1-5.el5 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-01-13 22:36:41 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 617100    
Attachments:
Description Flags
Partner-verified patch
none
Test probe that changes $return
none
Test program to be used with the probe none

Description Fabio Olive Leite 2010-06-01 17:56:37 UTC 
Created attachment 418754 [details]
Partner-verified patch

Description of problem:

When probing into a system call's return point and changing $return, process state (or random memory) gets corrupted and the box crashes. This is because ia64_store_register() on runtime/regs-ia64.c does not return after changing registers within [r8-r11] (usual register for $return on ia64 is r8), but instead goes on and also tries to store a value somewhere else as if it was some other register, even doing stack unwinding.

Version-Release number of selected component (if applicable):

RHEL-5.5, systemtap-1.1-3.el5.

How reproducible:

I would say 50%. A partner had a 100% sure reproducer, tests in the Red Hat labs sometimes did crash and sometimes did not. In any case, the code change is obvious, so it is 100% sure it IS corrupting memory somewhere. Could just not be somewhere important enough to cause a crash (yet).

Steps to Reproduce:
1. Compile the attached foobar.c program into the foobar executable:
# gcc -o foobar foobar.c

2. Run foobar with stap loading the sys_write_return.stap:
# stap -vg sys_write_return.stap -c ./foobar
...
Foo!
write: Input/output error
...

Actual results:

3. $return (and something else) is changed and the system crashes very soon.

Expected results:

3. $return is changed and system keeps going.

Additional info:

Patch adds a return statement in runtime/regs-ia64.c after line 116:
http://sources.redhat.com/git/gitweb.cgi?p=systemtap.git;a=blob;f=runtime/regs-ia64.c;h=c78a757eb38fb25c5724bb62ec479aa3ad0f4389;hb=HEAD#l116
Comment 1 Fabio Olive Leite 2010-06-01 17:57:55 UTC 
Created attachment 418755 [details]
Test probe that changes $return
Comment 2 Fabio Olive Leite 2010-06-01 17:59:46 UTC 
Created attachment 418756 [details]
Test program to be used with the probe
Comment 4 Frank Ch. Eigler 2010-06-01 18:10:31 UTC 
patch in hand
Comment 10 David Smith 2010-06-14 18:30:13 UTC 
Fixed upstream in commit 9f2f086:

<http://sources.redhat.com/git/gitweb.cgi?p=systemtap.git;a=commitdiff;h=9f2f0866b0f8deb24de6e252c446ba24ae85a2ec>

This patch will need to be backported.
Comment 18 errata-xmlrpc 2011-01-13 22:36:41 UTC 
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHEA-2011-0037.html