DynamoRIO / DynamoRIO/dynamorio

rcx syscall return address not transparent when xl8 app state

Open
#3,306 0 comments 0 reactions 0 assignees View on GitHub
Bug-AppFail OpSys-Linux OpSys-UNIX OpSys-x64
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

I observed in burst_threadfilter test that when a thread is occasionally suspended at syscall, the xcx value is not getting restored.

Code cache:

0x00005633d5cf8c40 0f 05 syscall -> %rcx

Looping on synch with thread 14524
recreate_app_state -- translating from:
priv_mcontext_t @0x00007fcb68d12780
xax = 0x00000000000000ca
xbx = 0x00007fcb6ad17700
xcx = 0x00005633d5cf8c42
xdx = 0x00000000000038bd
xsi = 0x0000000000000000
xdi = 0x00007fcb6ad179d0
xbp = 0x0000000000000000
xsp = 0x00007ffeb3574190
r8 = 0x00000000000000ca
r9 = 0x00007fcb6ad179d0
r10 = 0x0000000000000000
r11 = 0x0000000000000246
r12 = 0x0000000000000000
r13 = 0x00007ffeb35741a0
r14 = 0x0000000000000000
r15 = 0x0000000000000000
ymm0= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm1= 0x6b10456000007fcb6b107bc000007fcb00000000000000000000000000000000
ymm2= 0x66666f2d656e696c616d2d2072745f7800000000000000000000000000000000
ymm3= 0x6474732d5f7272656b73616d6378302000000000000000000000000000000000
ymm4= 0xb357539300007ffeb35753a900007ffe00000000000000000000000000000000
ymm5= 0xb3575f4700007ffeb3575f6700007ffe00000000000000000000000000000000
ymm6= 0xb3575e4900007ffeb3575e7600007ffe00000000000000000000000000000000
ymm7= 0xb3575dba00007ffeb3575dcb00007ffe00000000000000000000000000000000
ymm8= 0xb3575d6500007ffeb3575d7400007ffe00000000000000000000000000000000
ymm9= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm10= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm11= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm12= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm13= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm14= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm15= 0x0000000000000000000000000000000000000000000000000000000000000000
mxcsr=0x00001fa0
eflags = 0x0000000000000246
pc = 0x00005633d5cf8c40
recreate_app pc = after_syscall, translating
recreate_app_state -- translation is:
priv_mcontext_t @0x00007fcb68d12780
xax = 0x00000000000000ca
xbx = 0x00007fcb6ad17700
xcx = 0x00005633d5cf8c42
xdx = 0x00000000000038bd
xsi = 0x0000000000000000
xdi = 0x00007fcb6ad179d0
xbp = 0x0000000000000000
xsp = 0x00007ffeb3574190
r8 = 0x00000000000000ca
r9 = 0x00007fcb6ad179d0
r10 = 0x0000000000000000
r11 = 0x0000000000000246
r12 = 0x0000000000000000
r13 = 0x00007ffeb35741a0
r14 = 0x0000000000000000
r15 = 0x0000000000000000
ymm0= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm1= 0x6b10456000007fcb6b107bc000007fcb00000000000000000000000000000000
ymm2= 0x66666f2d656e696c616d2d2072745f7800000000000000000000000000000000
ymm3= 0x6474732d5f7272656b73616d6378302000000000000000000000000000000000
ymm4= 0xb357539300007ffeb35753a900007ffe00000000000000000000000000000000
ymm5= 0xb3575f4700007ffeb3575f6700007ffe00000000000000000000000000000000
ymm6= 0xb3575e4900007ffeb3575e7600007ffe00000000000000000000000000000000
ymm7= 0xb3575dba00007ffeb3575dcb00007ffe00000000000000000000000000000000
ymm8= 0xb3575d6500007ffeb3575d7400007ffe00000000000000000000000000000000
ymm9= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm10= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm11= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm12= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm13= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm14= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm15= 0x0000000000000000000000000000000000000000000000000000000000000000
mxcsr=0x00001fa0
eflags = 0x0000000000000246
pc = 0x00007fcb6bc54d2b

xcx is still code cache return address. I have seen the same thread crashing but it is likely crashing because of some other issue.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.