DynamoRIO / DynamoRIO/dynamorio

use of %gs by an app on linux not handled properly

Open
#1,833 0 comments 0 reactions 0 assignees View on GitHub
Bug-AppFail help wanted OpSys-Linux
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 18h
Merged PRs (30d)
30

Description

During the dev of the test case for #1823 I found a problem when a program use the gs segment.
Just run the program following program with drrun.

``` C
#include

#ifdef __i386__
# include
# include
# include
# include
# include
# include
#else
# include
# include
#endif

int arch_prctl(int code, unsigned long addr);

int test_func()
{
return (42);
}

int main()
{
#ifdef __i386__
void *seg = mmap(NULL, getpagesize(), PROT_WRITE | PROT_READ,
MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
struct user_desc u_info;
int val;

((void **)seg)[0x10 / sizeof(void *)] = &test_func;
u_info.entry_number = 7;
u_info.base_addr = (unsigned long)seg;
u_info.limit = getpagesize();
u_info.seg_32bit = 1;
u_info.contents = MODIFY_LDT_CONTENTS_DATA;
u_info.read_exec_only = 0;
u_info.limit_in_pages = 0;
u_info.seg_not_present = 0;
u_info.useable = 1;
val = (7 << 3 | 0 << 2 | 3);

if (syscall(SYS_set_thread_area, &u_info) < 0 && errno == EINVAL) {
u_info.entry_number = 13;
val = (13 << 3 | 0 << 2 | 3);
syscall(SYS_set_thread_area, &u_info);
}

__asm__ volatile ("push %%gs; \n\
mov %0, %%gs; \n\
call *%%gs:0x10; \n\
mov $0x10, %%eax; \n\
call *%%gs:(%%eax); \n\
pop %%gs" \
: : "m" (val) : "eax");
#else
void (*funcs[10])();
void *old_fs;

funcs[0x10 / sizeof(void *)] = (void *)&test_func;

arch_prctl(ARCH_SET_GS, (unsigned long)funcs);
__asm__ volatile ("call *%gs:0x10; \n\
mov $0x10, %rax; \n\
call *%gs:(%rax);");

#endif
return 0;
}

```

On 32bit dynamoRIO segfault and on 64bit it's look like an infinite loop.

This program run correctly without dynamoRIO in both 32bit and 64bit.

Contributor guide

Open the contributing guide

Research direction

Start by compiling the C reproducer in the issue and running it with drrun on both 32-bit and 64-bit Linux, then compare its behavior with a direct run. Trace the %gs accesses and segment setup involved in the reproducer; done means both variants execute test_func and return normally under DynamoRIO, as they do without it.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux
Domain
devtools, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.