linux-kernel - Re: System Call trashing registers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+jjjYSMq-hKx5XsMDf=+n4wfAr6Btt7x8gpG5kdRRrzr6YK2Q@mail.gmail.com>
Date:   Fri, 1 Sep 2023 10:38:15 -0700
From:   Joshua Hudson <joshudson@...il.com>
To:     Ammar Faizi <ammarfaizi2@...weeb.org>
Cc:     Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        x86-ml <x86@...nel.org>
Subject: Re: System Call trashing registers

On Fri, Sep 1, 2023 at 9:24 AM Ammar Faizi <ammarfaizi2@...weeb.org> wrote:
>
> On 8/24/23 11:15 PM, Joshua Hudson wrote:
> > 1) A lot of my old 32-bit programs don't work on x64 linux anymore
> > because int 80h now trashes ecx and edx. This hasn't been a serious
> > problem for me.
>
> Do you have a reproducer? It doesn't trash ecx and edx on my machine.
>
> Linux 6.5.0-rc5-af-home-2023-08-08-gf01d31303231
> ```
> #include <stdio.h>
>
> static void do_int80(void)
> {
>         int ecx = 0x11111;
>         int edx = 0x22222;
>         int eax = 158; // sched_yield
>
>         __asm__ volatile (
>                 "int $0x80"
>                 : "+a"(eax), "+c"(ecx), "+d"(edx)
>                 :
>                 : "memory"
>         );
>         printf("ecx = %#x\n", ecx);
>         printf("edx = %#x\n", edx);
> }
>
> int main(void)
> {
>         int i;
>
>         for (i = 0; i < 3; i++)
>                 do_int80();
>
>         return 0;
> }
> ```
>
> ammarfaizi2@...egral2:/tmp$ gcc -Wall -Wextra -Os z.c -o z
> ammarfaizi2@...egral2:/tmp$ ./z
> ecx = 0x11111
> edx = 0x22222
> ecx = 0x11111
> edx = 0x22222
> ecx = 0x11111
> edx = 0x22222
>
>
> > 2) syscall is documented to trash rcx and r11.
> >
> > What I don't understand is why this hasn't ever led to a security
> > issue due to leaking values from kernel space (in the trashed
> > registers) back to userspace.
>
> That behavior is architectural. It's the 'syscall' instruction that
> clobbers %rcx and %r11. Not the kernel.
>
> --
> Ammar Faizi

Correction: it's been fixed again. Sorry about that.

I know the asmutils tools have been broken for a decade, but they're
working now.

What would happen is system calls that take arguments in ecx and edx would find
ecx and edx trashed, but only a few calls actually did this, the
primary offender
being open(). The best regression test seems to be hexdump from
asmutils because the
corruption would reliably crash the binary. sched_yeild was never an
affected syscall.