Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Incorrect flags update for IMULr #524

Closed
basavesh opened this issue Jul 16, 2023 · 6 comments · Fixed by #528
Closed

Incorrect flags update for IMULr #524

basavesh opened this issue Jul 16, 2023 · 6 comments · Fixed by #528

Comments

@basavesh
Copy link
Collaborator

basavesh commented Jul 16, 2023

This bug is found due to fuzz-test. (the bug is present in all IMULr variants, though it is easily reproducible for size 16)
In some cases, the flags CF and OF are not set properly.

I think the Jasmin semantic is wrong as it looks for overflow (I might be wrong)

Executing Instruction IMULr_16_R12_RSI -> imulw %si, %r12w

Before:

RSI: 9416389359609642987
R12: 13449037565095184505
CF: false
PF: false
ZF: false
SF: false
OF: false

After:

RSI: 9416389359609642987
R12: 13449037565095202323
CF: false
PF: undef
ZF: undef
SF: undef
OF: false

However, in the above case, Hardware sets the CF and OF flags.

These crashes are easily reproducible.
Edit:
removed irrelevant data
CC: @vbgl @bgregoir @cryptojedi @gbarthe

@basavesh basavesh changed the title Incorrect flags update for IMULr_16_R12_RSI Incorrect flags update for IMULr Jul 16, 2023
@basavesh
Copy link
Collaborator Author

The same bug exists for IMUL and I believe it will be there in IMULri too as they are all variants of x86 imul instruction.

@vbgl
Copy link
Member

vbgl commented Jul 18, 2023

Please be concise and to the point. There is way too much irrelevant data in this report.

@bgregoir
Copy link
Contributor

Sorry but I don't understand this bug report.
What is the meaning of Before and After ? what is the problem with flag ?
If the problem is that some flag are undef, this is not a bug.

@vbgl
Copy link
Member

vbgl commented Jul 18, 2023

Tentative fix in #528.

@basavesh
Copy link
Collaborator Author

sorry for the confusion. Before is asm state before executing the instruction and after is the result after executing that instruction.

The bug here is, for that input CF and OF should true. However Jasmin has set it to false.

vbgl added a commit that referenced this issue Jul 18, 2023
vbgl added a commit that referenced this issue Jul 18, 2023
@basavesh
Copy link
Collaborator Author

basavesh commented Jul 18, 2023

My dumb fuzzer is happy with the fix. Usually it triggers the bug within couple of seconds and I don't see crashes anymore after the fix.

bgregoir pushed a commit that referenced this issue Jul 18, 2023
vbgl added a commit that referenced this issue Jul 18, 2023
Fixes #524

(cherry picked from commit fa2041c)
vbgl added a commit that referenced this issue Jul 18, 2023
Fixes #524

(cherry picked from commit fa2041c)
(cherry picked from commit 27357d7)
vbgl added a commit that referenced this issue Jul 19, 2023
Fixes #524

(cherry picked from commit fa2041c)
(cherry picked from commit 27357d7)
(cherry picked from commit dbac5ce)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants