DynamoRIO / DynamoRIO/dynamorio

Translating state not advancing PC after observing async signal in mangle epilogue

Open
#3,307 2 comments 0 reactions 1 assignee Claimed by @hgreving2304 View on GitHub
Bug-AppCrash Bug-AppFail OpSys-Linux OpSys-UNIX OpSys-x64 OpSys-x86
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

I am seeing the xl8 PC wrong when an asynchronous signal hits in a mangled region but after the app's mangled instruction. In my case, this always happens on a restore that is part of the mangled region.

In my case, this is an rip-rel mangled region

0x00005633d5d2f4b7 65 48 a3 00 00 00 00 mov %rax -> %gs:0x00[8byte]
00 00 00 00
0x00005633d5d2f4c2 48 b8 d0 d9 41 6b cb mov $0x00007fcb6b41d9d0 -> %rax
7f 00 00
0x00005633d5d2f4cc c4 62 e9 9d 00 vfnmadd132sd %xmm2[8byte] (%rax)[8byte] %xmm8[8byte] -> %xmm8[8byte]
0x00005633d5d2f4d1 65 48 a1 00 00 00 00 mov %gs:0x00[8byte] -> %rax
00 00 00 00
0x00005633d5d2f4dc 65 48 8b 0c 25 b0 00 mov %gs:0xb0[8byte] -> %rcx

The signal hits on 0x00005633d5d2f4d1. The vfnmadd132sd in the app is at 0x00007fcb6b3b060a. After translating the app's state, the PC is 0x00007fcb6b3b060a, but I think should be 0x00007fcb6b3b0613.

This is likely be the reason for another crash I am observing w.r.t. xref #2941 .

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.