Bug 436152

Try memcheck on an AVX2 shift with an undefined distance; minimal example below. Expected behavior: no errors. Observed behavior: "Use of uninitialised value of size 1" error. (As a side note, track-origins doesn't seem to work here.)

My impression is that this particular error is generated by line 4840 of memcheck/mc_translate.c in current valgrind git. An accompanying comment says "this is wrong now", and a comment at the top of the file says that memcheck "complains, but should not" when an undefined value is used as "the shift value in certain SIMD shift operations". So there appears to be consensus that this is a bug.

The actual application leading to this bug report is intentionally and correctly using an undefined value here for security reasons explained in https://neuromancer.sk/article/26, so a bug fix would be helpful. I presume that the fix would look like the existing scalarShift() function.

timecop@bolero-bullseye1:~$ uname -a
Linux bolero-bullseye1 4.15.0-96-generic #97-Ubuntu SMP Wed Apr 1 03:25:46 UTC 2020 x86_64 GNU/Linux
timecop@bolero-bullseye1:~$ gcc --version
gcc (Debian 10.2.1-6) 10.2.1 20210110
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

timecop@bolero-bullseye1:~$ valgrind --version
valgrind-3.16.1
timecop@bolero-bullseye1:~$ cat x.c
#include <immintrin.h>

volatile __m256i x;

int main()
{
  int i;
  x = _mm256_slli_epi32(x,i);
  return 0;
}
timecop@bolero-bullseye1:~$ gcc -o x x.c -march=native -g
timecop@bolero-bullseye1:~$ valgrind -v ./x
==29256== Memcheck, a memory error detector
==29256== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==29256== Using Valgrind-3.16.1-36d6727e1d-20200622X and LibVEX; rerun with -h for copyright info
==29256== Command: ./x
==29256== 
--29256-- Valgrind options:
--29256--    -v
--29256-- Contents of /proc/version:
--29256--   Linux version 4.15.0-96-generic (buildd@lgw01-amd64-004) (gcc version 7.5.0 (Ubuntu 7.5.0-3ubuntu1~18.04)) #97-Ubuntu SMP Wed Apr 1 03:25:46 UTC 2020
--29256-- 
--29256-- Arch and hwcaps: AMD64, LittleEndian, amd64-cx16-lzcnt-sse3-ssse3-avx-avx2-bmi-f16c-rdrand
--29256-- Page sizes: currently 4096, max supported 4096
--29256-- Valgrind library directory: /home/timecop/lib/valgrind
--29256-- Reading syms from /home/timecop/x
--29256-- Reading syms from /lib/x86_64-linux-gnu/ld-2.31.so
--29256--   Considering /usr/lib/debug/.build-id/ab/75e6eb59378454f315620832dff4d450abc6ab.debug ..
--29256--   .. build-id is valid
--29256-- Reading syms from /home/timecop/lib/valgrind/memcheck-amd64-linux
--29256--    object doesn't have a dynamic symbol table
--29256-- Scheduler: using generic scheduler lock implementation.
--29256-- Reading suppressions file: /home/timecop/lib/valgrind/default.supp
==29256== embedded gdbserver: reading from /tmp/vgdb-pipe-from-vgdb-to-29256-by-timecop-on-???
==29256== embedded gdbserver: writing to   /tmp/vgdb-pipe-to-vgdb-from-29256-by-timecop-on-???
==29256== embedded gdbserver: shared mem   /tmp/vgdb-pipe-shared-mem-vgdb-29256-by-timecop-on-???
==29256== 
==29256== TO CONTROL THIS PROCESS USING vgdb (which you probably
==29256== don't want to do, unless you know exactly what you're doing,
==29256== or are doing some strange experiment):
==29256==   /home/timecop/lib/valgrind/../../bin/vgdb --pid=29256 ...command...
==29256== 
==29256== TO DEBUG THIS PROCESS USING GDB: start GDB like this
==29256==   /path/to/gdb ./x
==29256== and then give GDB the following command
==29256==   target remote | /home/timecop/lib/valgrind/../../bin/vgdb --pid=29256
==29256== --pid is optional if only one valgrind process is running
==29256== 
--29256-- REDIR: 0x401f8f0 (ld-linux-x86-64.so.2:strlen) redirected to 0x580b9662 (vgPlain_amd64_linux_REDIR_FOR_strlen)
--29256-- REDIR: 0x401f6d0 (ld-linux-x86-64.so.2:index) redirected to 0x580b967c (vgPlain_amd64_linux_REDIR_FOR_index)
--29256-- Reading syms from /home/timecop/lib/valgrind/vgpreload_core-amd64-linux.so
--29256-- Reading syms from /home/timecop/lib/valgrind/vgpreload_memcheck-amd64-linux.so
==29256== WARNING: new redirection conflicts with existing -- ignoring it
--29256--     old: 0x0401f8f0 (strlen              ) R-> (0000.0) 0x580b9662 vgPlain_amd64_linux_REDIR_FOR_strlen
--29256--     new: 0x0401f8f0 (strlen              ) R-> (2007.0) 0x0483ba70 strlen
--29256-- REDIR: 0x401c110 (ld-linux-x86-64.so.2:strcmp) redirected to 0x483c940 (strcmp)
--29256-- REDIR: 0x401fe30 (ld-linux-x86-64.so.2:mempcpy) redirected to 0x4840130 (mempcpy)
--29256-- Reading syms from /lib/x86_64-linux-gnu/libc-2.31.so
--29256--   Considering /usr/lib/debug/.build-id/38/b3269ce84ff6aa4d681208b45b868391ccc3bd.debug ..
--29256--   .. build-id is valid
--29256-- REDIR: 0x48dfea0 (libc.so.6:memmove) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48df250 (libc.so.6:strncpy) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48e01c0 (libc.so.6:strcasecmp) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48deb70 (libc.so.6:strcat) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48df2b0 (libc.so.6:rindex) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48e1550 (libc.so.6:rawmemchr) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48f9710 (libc.so.6:wmemchr) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48f92b0 (libc.so.6:wcscmp) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48e0000 (libc.so.6:mempcpy) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48dfe30 (libc.so.6:bcmp) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48df1f0 (libc.so.6:strncmp) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48dec20 (libc.so.6:strcmp) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48dff60 (libc.so.6:memset) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48f9270 (libc.so.6:wcschr) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48df150 (libc.so.6:strnlen) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48decf0 (libc.so.6:strcspn) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48e0210 (libc.so.6:strncasecmp) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48dec90 (libc.so.6:strcpy) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48e0360 (libc.so.6:memcpy@@GLIBC_2.14) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48fa910 (libc.so.6:wcsnlen) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48f92f0 (libc.so.6:wcscpy) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48df2f0 (libc.so.6:strpbrk) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48debd0 (libc.so.6:index) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48df110 (libc.so.6:strlen) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48e58b0 (libc.so.6:memrchr) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48e0260 (libc.so.6:strcasecmp_l) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48dfdf0 (libc.so.6:memchr) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48f9390 (libc.so.6:wcslen) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48df590 (libc.so.6:strspn) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48e0160 (libc.so.6:stpncpy) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48e0100 (libc.so.6:stpcpy) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48e1590 (libc.so.6:strchrnul) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x48e02b0 (libc.so.6:strncasecmp_l) redirected to 0x482e198 (_vgnU_ifunc_wrapper)
--29256-- REDIR: 0x49b08f0 (libc.so.6:__strrchr_avx2) redirected to 0x483b4b0 (rindex)
==29256== Use of uninitialised value of size 1
==29256==    at 0x109149: _mm256_slli_epi32 (avx2intrin.h:684)
==29256==    by 0x109149: main (x.c:8)
==29256== 
--29256-- REDIR: 0x48db720 (libc.so.6:free) redirected to 0x483987b (free)
==29256== 
==29256== HEAP SUMMARY:
==29256==     in use at exit: 0 bytes in 0 blocks
==29256==   total heap usage: 0 allocs, 0 frees, 0 bytes allocated
==29256== 
==29256== All heap blocks were freed -- no leaks are possible
==29256== 
==29256== Use --track-origins=yes to see where uninitialised values come from
==29256== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
==29256== 
==29256== 1 errors in context 1 of 1:
==29256== Use of uninitialised value of size 1
==29256==    at 0x109149: _mm256_slli_epi32 (avx2intrin.h:684)
==29256==    by 0x109149: main (x.c:8)
==29256== 
==29256== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
timecop@bolero-bullseye1:~$