DynamoRIO / DynamoRIO/dynamorio
use of %gs by an app on linux not handled properly
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 30
Description
During the dev of the test case for #1823 I found a problem when a program use the gs segment.
Just run the program following program with drrun.
``` C
#include
#ifdef __i386__
# include
# include
# include
# include
# include
# include
#else
# include
# include
#endif
int arch_prctl(int code, unsigned long addr);
int test_func()
{
return (42);
}
int main()
{
#ifdef __i386__
void *seg = mmap(NULL, getpagesize(), PROT_WRITE | PROT_READ,
MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
struct user_desc u_info;
int val;
((void **)seg)[0x10 / sizeof(void *)] = &test_func;
u_info.entry_number = 7;
u_info.base_addr = (unsigned long)seg;
u_info.limit = getpagesize();
u_info.seg_32bit = 1;
u_info.contents = MODIFY_LDT_CONTENTS_DATA;
u_info.read_exec_only = 0;
u_info.limit_in_pages = 0;
u_info.seg_not_present = 0;
u_info.useable = 1;
val = (7 << 3 | 0 << 2 | 3);
if (syscall(SYS_set_thread_area, &u_info) < 0 && errno == EINVAL) {
u_info.entry_number = 13;
val = (13 << 3 | 0 << 2 | 3);
syscall(SYS_set_thread_area, &u_info);
}
__asm__ volatile ("push %%gs; \n\
mov %0, %%gs; \n\
call *%%gs:0x10; \n\
mov $0x10, %%eax; \n\
call *%%gs:(%%eax); \n\
pop %%gs" \
: : "m" (val) : "eax");
#else
void (*funcs[10])();
void *old_fs;
funcs[0x10 / sizeof(void *)] = (void *)&test_func;
arch_prctl(ARCH_SET_GS, (unsigned long)funcs);
__asm__ volatile ("call *%gs:0x10; \n\
mov $0x10, %rax; \n\
call *%gs:(%rax);");
#endif
return 0;
}
```
On 32bit dynamoRIO segfault and on 64bit it's look like an infinite loop.
This program run correctly without dynamoRIO in both 32bit and 64bit.
Contributor guide
Research direction
Start by compiling the C reproducer in the issue and running it with drrun on both 32-bit and 64-bit Linux, then compare its behavior with a direct run. Trace the %gs accesses and segment setup involved in the reproducer; done means both variants execute test_func and return normally under DynamoRIO, as they do without it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, linux
- Domain
- devtools, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100