Red Hat Bugzilla – Bug 598615
Changing register contents (such as $return) causes crash
Last modified: 2018-10-27 08:08:51 EDT
Created attachment 418754 [details]
Description of problem:
When probing into a system call's return point and changing $return, process state (or random memory) gets corrupted and the box crashes. This is because ia64_store_register() on runtime/regs-ia64.c does not return after changing registers within [r8-r11] (usual register for $return on ia64 is r8), but instead goes on and also tries to store a value somewhere else as if it was some other register, even doing stack unwinding.
Version-Release number of selected component (if applicable):
I would say 50%. A partner had a 100% sure reproducer, tests in the Red Hat labs sometimes did crash and sometimes did not. In any case, the code change is obvious, so it is 100% sure it IS corrupting memory somewhere. Could just not be somewhere important enough to cause a crash (yet).
Steps to Reproduce:
1. Compile the attached foobar.c program into the foobar executable:
# gcc -o foobar foobar.c
2. Run foobar with stap loading the sys_write_return.stap:
# stap -vg sys_write_return.stap -c ./foobar
write: Input/output error
3. $return (and something else) is changed and the system crashes very soon.
3. $return is changed and system keeps going.
Patch adds a return statement in runtime/regs-ia64.c after line 116:
Created attachment 418755 [details]
Test probe that changes $return
Created attachment 418756 [details]
Test program to be used with the probe
patch in hand
Fixed upstream in commit 9f2f086:
This patch will need to be backported.
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.