Messages in this thread | | | From | Joshua Hudson <> | Date | Fri, 1 Sep 2023 10:38:15 -0700 | Subject | Re: System Call trashing registers |
| |
On Fri, Sep 1, 2023 at 9:24 AM Ammar Faizi <ammarfaizi2@gnuweeb.org> wrote: > > On 8/24/23 11:15 PM, Joshua Hudson wrote: > > 1) A lot of my old 32-bit programs don't work on x64 linux anymore > > because int 80h now trashes ecx and edx. This hasn't been a serious > > problem for me. > > Do you have a reproducer? It doesn't trash ecx and edx on my machine. > > Linux 6.5.0-rc5-af-home-2023-08-08-gf01d31303231 > ``` > #include <stdio.h> > > static void do_int80(void) > { > int ecx = 0x11111; > int edx = 0x22222; > int eax = 158; // sched_yield > > __asm__ volatile ( > "int $0x80" > : "+a"(eax), "+c"(ecx), "+d"(edx) > : > : "memory" > ); > printf("ecx = %#x\n", ecx); > printf("edx = %#x\n", edx); > } > > int main(void) > { > int i; > > for (i = 0; i < 3; i++) > do_int80(); > > return 0; > } > ``` > > ammarfaizi2@integral2:/tmp$ gcc -Wall -Wextra -Os z.c -o z > ammarfaizi2@integral2:/tmp$ ./z > ecx = 0x11111 > edx = 0x22222 > ecx = 0x11111 > edx = 0x22222 > ecx = 0x11111 > edx = 0x22222 > > > > 2) syscall is documented to trash rcx and r11. > > > > What I don't understand is why this hasn't ever led to a security > > issue due to leaking values from kernel space (in the trashed > > registers) back to userspace. > > That behavior is architectural. It's the 'syscall' instruction that > clobbers %rcx and %r11. Not the kernel. > > -- > Ammar Faizi
Correction: it's been fixed again. Sorry about that.
I know the asmutils tools have been broken for a decade, but they're working now.
What would happen is system calls that take arguments in ecx and edx would find ecx and edx trashed, but only a few calls actually did this, the primary offender being open(). The best regression test seems to be hexdump from asmutils because the corruption would reliably crash the binary. sched_yeild was never an affected syscall.
| |