Accessing Register Value can have race condition

[tylergu]

In SPI's generated instrumentation snippet, e.g.

    7f0533470000( 1 bytes): push %rdi                 | 57 
    7f0533470001( 1 bytes): push %rsi                 | 56 
    7f0533470002( 1 bytes): push %rdx                 | 52 
    7f0533470003( 1 bytes): push %rcx                 | 51 
    7f0533470004( 2 bytes): push %r8                  | 41 50 
    7f0533470006( 2 bytes): push %r9                  | 41 51 
    7f0533470008( 1 bytes): push %rax                 | 50 
    7f0533470009( 1 bytes): lahf                      | 9f 
    7f053347000a( 3 bytes): seto %al                  |  f 90 c0 
    7f053347000d( 1 bytes): push %rax                 | 50 
    7f053347000e(10 bytes): mov 69f68088,%rax         | 48 b8 88 80 f6 69 3e 56  0  0   # Save stack pointer 
    7f0533470018( 3 bytes): mov %rsp,(%rax)           | 48 89 20                        # to a class member variable
    7f053347001b( 8 bytes): lea 0xffffff78(%rsp),%rsp | 48 8d a4 24 78 ff ff ff 
    7f0533470023( 3 bytes): mov %rsp,%rax             | 48 8b c4 
    7f0533470026( 6 bytes): add 8,%rax                | 48  5  8  0  0  0 
    7f053347002c( 4 bytes): movdqa %xmm0,(%rax)       | 66  f 7f  0 
    7f0533470030( 5 bytes): movdqa %xmm1,0x10(%rax)   | 66  f 7f 48 10 
    7f0533470035( 5 bytes): movdqa %xmm2,0x20(%rax)   | 66  f 7f 50 20 
    7f053347003a( 5 bytes): movdqa %xmm3,0x30(%rax)   | 66  f 7f 58 30 
    7f053347003f( 5 bytes): movdqa %xmm4,0x40(%rax)   | 66  f 7f 60 40 
    7f0533470044( 5 bytes): movdqa %xmm5,0x50(%rax)   | 66  f 7f 68 50 
    7f0533470049( 5 bytes): movdqa %xmm6,0x60(%rax)   | 66  f 7f 70 60 
    7f053347004e( 5 bytes): movdqa %xmm7,0x70(%rax)   | 66  f 7f 78 70 
    7f0533470053( 1 bytes): push %rax                 | 50 
    7f0533470054(10 bytes): mov 4d712380,%rdi         | 48 bf 80 23 71 4d 3e 56  0  0 
    7f053347005e(10 bytes): mov 9317c714,%rsi         | 48 be 14 c7 17 93  5 7f  0  0 
    7f0533470068( 5 bytes): call 9317bb0a             | e8 9d ba d0 5f 

It pushes registers onto stack, and at the instruction at 7f053347000e and 7f0533470018, it moves %rsp to a class member variable of SpSnippet which is unique per SpPoint.

Now consider the multi-threaded case, where two threads are executing this same snippet in parallel. One thread saved the stack pointer to the class member variable, but haven't called the payload entry yet; the other thread tries to save the stack pointer to the class member variable and overwrites the old data by the first thread.