NetBSD Problem Report #59263

From www@netbsd.org  Mon Apr  7 00:26:39 2025
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 024FE1A9239
	for <gnats-bugs@gnats.NetBSD.org>; Mon,  7 Apr 2025 00:26:39 +0000 (UTC)
Message-Id: <20250407002637.B1D091A923C@mollari.NetBSD.org>
Date: Mon,  7 Apr 2025 00:26:37 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: t_printf:snprintf_float test is failing
X-Send-Pr-Version: www-1.0

>Number:         59263
>Category:       port-vax
>Synopsis:       t_printf:snprintf_float test is failing
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    port-vax-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Apr 07 00:30:00 +0000 2025
>Originator:     Taylor R Campbell
>Release:        current
>Organization:
The VaxBSnprintfD Reservation
>Environment:
>Description:
Termination reason

FAILED: Test program received signal 4 (core dumped)
Standard error stream

Test program crashed; attempting to get stack trace
[New process 7576]
Core was generated by `t_printf'.
Program terminated with signal SIGILL, Illegal instruction.
#0  0x0001146e in atfu_snprintf_float_body (140628)
#0  0x0001146e in atfu_snprintf_float_body (140628)
#1  0x7f6b83d1 in atf_tc_run (140628, 2134909024) from /usr/lib/libatf-c.so.0
#2  0x7f6b570e in atf_tp_run (2147481748, 2134909088, 2134909024) from /usr/lib/libatf-c.so.0
#3  0x7f6b52ac in atf_tp_main (5, 2147481960, 71084) from /usr/lib/libatf-c.so.0
#4  0x00011a22 in main (5, 2147481960, 2147481984)
Stack trace complete

https://releng.netbsd.org/b5reports/vax/2025/2025.04.04.21.52.19/test.html#lib_libc_stdio_t_printf_snprintf_float

This happens because we interpret random 64-bit strings (literally) as floating-point values, and some of those are reserved operands:

    137 	union {
    138 		double d;
    139 		uint64_t bits;
    140 	} u;
...
    154 		ul = rand();
    155 		uh = rand();
    156 		u.bits = (uint64_t)uh << 32 | ul;
    157 		ATF_CHECK(snprintf(buf, sizeof buf, " %.2f", u.d) != -1);

https://nxr.netbsd.org/xref/src/tests/lib/libc/stdio/t_printf.c?r=1.18#154

The MOVD instruction is presumably where the reserved-operand fault happens, leading to SIGILL (signal 4):

/home/riastradh/netbsd/current/src/tests/lib/libc/stdio/t_printf.c:154
 901:   fb 00 ef 00     calls $0x0,908 <atfu_snprintf_float_body+0x92>
 905:   00 00 00 
                        904: R_VAX_PLT32        rand
 908:   d0 50 56        movl r0,r6
/home/riastradh/netbsd/current/src/tests/lib/libc/stdio/t_printf.c:155
 90b:   fb 00 ef 00     calls $0x0,912 <atfu_snprintf_float_body+0x9c>
 90f:   00 00 00 
                        90e: R_VAX_PLT32        rand
/home/riastradh/netbsd/current/src/tests/lib/libc/stdio/t_printf.c:156
 912:   d0 56 58        movl r6,r8
 915:   d0 50 59        movl r0,r9
/home/riastradh/netbsd/current/src/tests/lib/libc/stdio/t_printf.c:157
 918:   70 58 7e        movd r8,-(sp)
 91b:   9f ef 00 00     pushab 921 <atfu_snprintf_float_body+0xab>
 91f:   00 00 
                        91d: R_VAX_PC32 .rodata.str1.1+0x37f
 921:   3c 8f e8 03     movzwl $0x03e8,-(sp)
 925:   7e 
 926:   dd 5a           pushl r10
 928:   fb 05 ef 00     calls $0x5,92f <atfu_snprintf_float_body+0xb9>
>How-To-Repeat:
cd /usr/tests/lib/libc/stdio
atf-run t_printf | atf-report
>Fix:
Add

#ifdef __vax__
        if (u.bits forms a reserved operand)
                continue;
#endif

before trying to use u.d.  (Not sure we have any machine-independent predicate for reserved operands to avoid the #ifdef __vax__.)

Home	PR Database Search