Skip to content

[release/9.0-rc1] Remove CONTEXT_XSTATE in FaultingExceptionFrame::UpdateRegDisplay #106550

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 16, 2024

Conversation

github-actions[bot]
Copy link
Contributor

@github-actions github-actions bot commented Aug 16, 2024

Backport of #106466 to release/9.0-rc1

/cc @janvorli

Customer Impact

  • Customer reported
  • Found internally

There is a bug in updating REGDISPLAY from a faulting exception frame. The context stored in the frame can contain extended state, but we only copy the basic CONTEXT part. But we are not removing the CONTEXT_XSTATE flag. There was an issue found on arm64 Windows with SVE enabled by the folks working on enabling SVE on Windows. The context from a hardware exception contains the SVE extended state and when we resume after catch for the exception or start propagating it through native frames, the RtlRestoreContext uses some garbage to try to restore the extended state and ends up corrupting memory.

Regression

  • Yes
  • No

Testing

The fix was verified on an actual SVE enabled Windows arm64 machine using a test provided by one of the folks working on the SVE enabling that was reliably failing without the fix.

Risk

Low. It just removes incorrect bit from the CONTEXT flags that would otherwise cause Windows to read garbage.

Fixing the problem introduced by the previous attempt to fix that.
The problem was that the CONTEXT_XSTATE contains not only the bit for
the xstate, but also the architecture "id" (CONTEXT_AMD64,
CONTEXT_ARM64, ...).

I've verified this fix using the debugger tests that the previous change
was breaking.

There is a bug in updating REGDISPLAY from a faulting exception frame.
The context stored in the frame can contain extended state, but we only
copy the basic CONTEXT part. But we are not removing the CONTEXT_XSTATE
flag. There was an issue found on arm64 Windows with SVE enabled. The
context from a hardware exception contains the SVE extended state and
when we resume after catch for the exception or start propagating it
through native frames, the RtlRestoreContext uses some garbage to try to
restore the extended state and ends up corrupting memory.

The fix is to remove the CONTEXT_XSTATE flag from the context after we
copy it to the REGDISPLAY.

While we have hit this problem on Windows ARM64 with SVE only, I have
made the same change for other targets that can have extended state too.

Close #105483
@ghost ghost added the area-VM-coreclr label Aug 16, 2024
Copy link
Contributor

Tagging subscribers to this area: @mangod9
See info in area-owners.md if you want to be subscribed.

@janvorli janvorli requested a review from jkotas August 16, 2024 17:08
@janvorli janvorli self-assigned this Aug 16, 2024
@janvorli janvorli added this to the 9.0.0 milestone Aug 16, 2024
Copy link
Member

@jeffschwMSFT jeffschwMSFT left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm. we will take for consideration in rc1

@carlossanlop carlossanlop removed the Servicing-consider Issue for next servicing release review label Aug 16, 2024
@carlossanlop
Copy link
Contributor

Approved by Tactics via email.

@carlossanlop carlossanlop added the Servicing-approved Approved for servicing release label Aug 16, 2024
@carlossanlop carlossanlop merged commit 6d543fa into release/9.0-rc1 Aug 16, 2024
91 of 97 checks passed
@carlossanlop carlossanlop deleted the backport/pr-106466-to-release/9.0-rc1 branch August 16, 2024 19:25
@github-actions github-actions bot locked and limited conversation to collaborators Sep 16, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
area-VM-coreclr Servicing-approved Approved for servicing release
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants