Date: Sun, 30 Aug 2020 21:07:10 -0400 From: Rich Felker <dalias@...c.org> To: musl@...ts.openwall.com Cc: Theodore Dubois <tblodt@...oud.com> Subject: Re: i386 __set_thread_area will crash if the syscall fails On Sun, Aug 30, 2020 at 05:34:09PM -0700, Theodore Dubois wrote: > Found a (small) bug in this file: > https://git.musl-libc.org/cgit/musl/tree/src/thread/i386/__set_thread_area..s > > If the syscall fails, the branch on line 20 is taken and %eax will > be a small negative number. Then "mov $123,%al" will make syscall > 0xffffff7b instead of 0x7b, since overwriting %al only overwrites > the low byte of %eax. So the modify_ldt fallback has apparently > never worked. Thanks! Indeed, systems where the first syscall fails are outside the actually-supported version range (before 2.6) so it's likely that this was never actually tested. Nowadays SECCOMP_FILTER makes it easy to test, so we should actually try to test some of these things. Have you checked if it works adding xor %eax,%eax before the byte mov or changing it to a 32-bit mov? > Tangentially, I'm not sure why this file has so many hardcoded magic > numbers and no comments to explain what they are. Really it shouldn't even be external asm anymore. I'm trying to move as much external asm as possible to inline asm written in C, and this could be written entirely with __syscall() after #define SYSCALL_NO_TLS (recently added) and all the structures setup explicitly in C. I'll take a stab at doing that after fixing the bug. Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.