Created attachment 418754 [details] Partner-verified patch Description of problem: When probing into a system call's return point and changing $return, process state (or random memory) gets corrupted and the box crashes. This is because ia64_store_register() on runtime/regs-ia64.c does not return after changing registers within [r8-r11] (usual register for $return on ia64 is r8), but instead goes on and also tries to store a value somewhere else as if it was some other register, even doing stack unwinding. Version-Release number of selected component (if applicable): RHEL-5.5, systemtap-1.1-3.el5. How reproducible: I would say 50%. A partner had a 100% sure reproducer, tests in the Red Hat labs sometimes did crash and sometimes did not. In any case, the code change is obvious, so it is 100% sure it IS corrupting memory somewhere. Could just not be somewhere important enough to cause a crash (yet). Steps to Reproduce: 1. Compile the attached foobar.c program into the foobar executable: # gcc -o foobar foobar.c 2. Run foobar with stap loading the sys_write_return.stap: # stap -vg sys_write_return.stap -c ./foobar ... Foo! write: Input/output error ... Actual results: 3. $return (and something else) is changed and the system crashes very soon. Expected results: 3. $return is changed and system keeps going. Additional info: Patch adds a return statement in runtime/regs-ia64.c after line 116: http://sources.redhat.com/git/gitweb.cgi?p=systemtap.git;a=blob;f=runtime/regs-ia64.c;h=c78a757eb38fb25c5724bb62ec479aa3ad0f4389;hb=HEAD#l116
Created attachment 418755 [details] Test probe that changes $return
Created attachment 418756 [details] Test program to be used with the probe
patch in hand
Fixed upstream in commit 9f2f086: <http://sources.redhat.com/git/gitweb.cgi?p=systemtap.git;a=commitdiff;h=9f2f0866b0f8deb24de6e252c446ba24ae85a2ec> This patch will need to be backported.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHEA-2011-0037.html