Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-93581

breakpoint in vandps instruction causes register clobber

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • gdb-16.3-2.el10
    • None
    • Low
    • 2
    • rhel-pt-gdb
    • ssg_platform_tools
    • 15
    • 1
    • False
    • False
    • No
    • PT PerfDebug 2025 S07, PT PerfDebug 2025 S09
    • Release Note Not Required
    • None
    • 57,005

      Example reproducer:

      $ tar xf gdb_avx_issue.tar
      $ cd gdb_avx_issue/
      $ ./build
      $ ./run
      Out 0: 0xdeadbeef
      Out 1: 0xdeadbeef
      Out 2: 0xdeadbeef
      Out 3: 0xdeadbeef
      Out 4: 0xdeadbeef
      Out 5: 0xdeadbeef
      Out 6: 0xdeadbeef
      Out 7: 0xdeadbeef

      Now in gdb:

      $ gdb run
      ...
      (gdb) b test_func
      Breakpoint 1 at 0x401240: file /usr/lib/gcc/x86_64-redhat-linux/11/include/avxintrin.h, line 174.
      (gdb) r
      ...
      Breakpoint 1, test_func (x=...) at test.c:12
      12 return _mm256_and_ps(x, constants[512]);
      (gdb) c
      Continuing.
      Out 0: 0x00000000
      Out 1: 0x00000000
      Out 2: 0x00000000
      Out 3: 0x00000000
      Out 4: 0x00000000
      Out 5: 0x00000000
      Out 6: 0x00000000
      Out 7: 0x00000000

      This issue appears to happen not just in rhel8 but any other recent environment
      tested with different gdb major versions.

      For the reproducer, the issue appear to only happen if the breakpoint is in the
      vandps instruction, but probably might trigger in other instructions or
      conditions.

      (gdb) p $ymm0
      $1 = {..., v8_int32 = {-1, -1, -1, -1, -1, -1, -1, -1}, ... }
      (gdb) watch $ymm0
      Watchpoint 2: $ymm0
      (gdb) disassemble
      Dump of assembler code for function test_func:
      => 0x0000000000401240 <+0>: vandps 0x6e18(%rip),%ymm0,%ymm0 # 0x408060 <constants+16384>
      0x0000000000401248 <+8>: ret
      End of assembler dump.
      (gdb) si

      Watchpoint 2: $ymm0

      Old value = {..., v8_int32 = {-1, -1, -1, -1, -1, -1, -1, -1}, ...}
      New value = {..., v8_int32 =

      {0, 0, 0, 0, 0, 0, 0, 0}

      , ...}
      0x0000000000401248 in test_func (x=...) at test.c:18
      18 }

              glarsen@redhat.com Guinevere Larsen
              rhn-support-pandrade Paulo Andrade
              Keith Seitz Keith Seitz
              Michal Kolar Michal Kolar
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: