wmkhoo / taintgrind

A taint-tracking plugin for the Valgrind memory checking tool
GNU General Public License v2.0
249 stars 42 forks source link

_dl_runtime_resolve_avx fail with #11

Closed eiselekd closed 8 years ago

eiselekd commented 8 years ago

I encountered a problem where tnt_translate.c:convert_Value() failes because Ity_V256 is not handled in the switch statement when tyH == Ity_I64. The function _dl_runtime_resolve_avx seems to save all simd registers on the stack before running _dl_runtime_resolve and does a lot of movaps,vmovdqa instructions. Is there a possibility (for me) to fix this? I dont care about tainting of simd instructions however maybe they can be ignored?


taintgrind: the 'impossible' happened:
   tnt_translate.c: convert_Value

host stacktrace:
==22759==    at 0x38078378: show_sched_status_wrk (m_libcassert.c:343)
==22759==    by 0x38078494: report_and_quit (m_libcassert.c:415)
==22759==    by 0x38078734: vgPlain_tool_panic (m_libcassert.c:491)
==22759==    by 0x3805C556: convert_Value (tnt_translate.c:5808)
==22759==    by 0x38067E8E: create_dirty_GET (tnt_translate.c:6272)
==22759==    by 0x38069686: vgTaintgrind_instrument (tnt_translate.c:4509)
==22759==    by 0x380933FF: tool_instrument_then_gdbserver_if_needed (m_translate.c:238)
==22759==    by 0x3813CA1C: LibVEX_Translate (main_main.c:934)
==22759==    by 0x38095A1B: vgPlain_translate (m_translate.c:1765)
==22759==    by 0x380C868E: vgPlain_scheduler (scheduler.c:1048)
==22759==    by 0x380D7756: run_a_thread_NORETURN (syswrap-linux.c:102)

sched status:
  running_tid=1

Thread 1: status = VgTs_Runnable (lwpid 22759)
==22759==    at 0x40176A0: _dl_runtime_resolve_avx (dl-trampoline.h:64)
==22759==    by 0xAAC9EBD: __pthread_initialize_minimal (nptl-init.c:433)
==22759==    by 0xAAC95D0: ??? (in /lib/x86_64-linux-gnu/libpthread-2.23.so)
==22759==    by 0x400044F: ??? (in /lib/x86_64-linux-gnu/ld-2.23.so)
==22759==    by 0x40104A9: call_init.part.0 (dl-init.c:58)
==22759==    by 0x4010664: _dl_init (dl-init.c:104)
==22759==    by 0x4000CF9: ??? (in /lib/x86_64-linux-gnu/ld-2.23.so)
eiselekd commented 8 years ago

Maybe something like:

diff --git a/tnt_translate.c b/tnt_translate.c
index f734d9e..357b04c 100644
--- a/tnt_translate.c
+++ b/tnt_translate.c
@@ -4506,6 +4506,12 @@ void do_shadow_WRTMP ( MCEnv* mce, IRStmt *clone, IRTemp tmp, IRExpr* expr )
    assign( 'V', mce, findShadowTmpV( mce, tmp ), expr2vbits( mce, expr ) );

    if( expr->tag != Iex_Const ){
+
+      IRType ty = typeOfIRTemp(mce->sb->tyenv, tmp);
+      if (mce->hWordTy == Ity_I64 && ty == Ity_V256) {
+         return;
+      }
+
       di2 = create_dirty_WRTMP( mce, clone, tmp, expr );

       if( di2 != NULL )
@@ -4631,7 +4637,8 @@ void do_shadow_Store ( MCEnv* mce,
       the address (shadow) to 'defined' following the test. */
    // Taintgrind: What to do in the vdata case?
    //        vdata cases (CAS, Dirty) are handled by their resp. shadow routines
-   if( data && clone ){
+   if( data && clone &&
+      !(mce->hWordTy == Ity_I64 && typeOfIRExpr(mce->sb->tyenv, data) == Ity_V256)) {
       di2 = create_dirty_STORE( mce, clone, end, 0/*resSC*/, addr, data );
       if ( di2 ) complainIfTainted( mce, addr, di2 );
    }
@@ -6959,6 +6966,7 @@ typedef
             break;

          case Ist_Put:
+            if (!(mce.hWordTy == Ity_I64 && typeOfIRExpr(mce.sb->tyenv, st->Ist.Put.data) == Ity_V256))
             do_shadow_PUT( &mce,
                            clone,
                            st->Ist.Put.offset,
wmkhoo commented 8 years ago

Hi could you try applying the patch for #10 and see if that works? I vaguely remember handling the Ity_256/V256 issue. Thanks!

eiselekd commented 8 years ago

Confirm, patch for #10 made it continue.

wmkhoo commented 8 years ago

Thanks for confirming. Closing.