linux-kernel - Re: System Call trashing registers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <dbce949f-d8b5-fb88-af63-21a82e431aa3@gnuweeb.org>
Date:   Fri, 1 Sep 2023 23:24:11 +0700
From:   Ammar Faizi <ammarfaizi2@...weeb.org>
To:     Joshua Hudson <joshudson@...il.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Cc:     x86-ml <x86@...nel.org>
Subject: Re: System Call trashing registers

On 8/24/23 11:15 PM, Joshua Hudson wrote:
> 1) A lot of my old 32-bit programs don't work on x64 linux anymore
> because int 80h now trashes ecx and edx. This hasn't been a serious
> problem for me.

Do you have a reproducer? It doesn't trash ecx and edx on my machine.

Linux 6.5.0-rc5-af-home-2023-08-08-gf01d31303231
```
#include <stdio.h>

static void do_int80(void)
{
	int ecx = 0x11111;
	int edx = 0x22222;
	int eax = 158; // sched_yield

	__asm__ volatile (
		"int $0x80"
		: "+a"(eax), "+c"(ecx), "+d"(edx)
		:
		: "memory"
	);
	printf("ecx = %#x\n", ecx);
	printf("edx = %#x\n", edx);
}

int main(void)
{
	int i;

	for (i = 0; i < 3; i++)
		do_int80();

	return 0;
}
```

ammarfaizi2@...egral2:/tmp$ gcc -Wall -Wextra -Os z.c -o z
ammarfaizi2@...egral2:/tmp$ ./z
ecx = 0x11111
edx = 0x22222
ecx = 0x11111
edx = 0x22222
ecx = 0x11111
edx = 0x22222


> 2) syscall is documented to trash rcx and r11.
> 
> What I don't understand is why this hasn't ever led to a security
> issue due to leaking values from kernel space (in the trashed
> registers) back to userspace.

That behavior is architectural. It's the 'syscall' instruction that
clobbers %rcx and %r11. Not the kernel.

The kernel's syscall entry point even saves %rcx and %r11, but at that
point they've already been overwritten by the syscall instruction
itself with the original %rip and %rflags values. So they contain
userspace values. No internal kernel data is leaked in %rcx and %r11.

-- 
Ammar Faizi