[PATCH v5 0/1] MR7064: Draft: ntdll: Check for invalid %gs value in 32-bit code on WoW64.

[William Horvath (＠whrvth)]

Adapted from [check_invalid_gs](https://gitlab.winehq.org/wine/wine/-/blob/d7a7cae2e2d1ad34af6dbefcb06fbef2f...) in signal_i386.c. This prevents crashing when the %gs register is manipulated in 32-bit code on "new-style" WoW64.

[test.c](https://bugs.winehq.org/attachment.cgi?id=77444) is a simple reproduction of the crash, courtesy of Fabian Maurer from the Bugzilla comments.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=57444

--
  v5: ntdll: Check for invalid %gs value in 32-bit code on WoW64.
 
https://gitlab.winehq.org/wine/wine/-/merge_requests/7064

[PATCH v5 1/1] ntdll: Check for invalid %gs value in 32-bit code on WoW64.

[William Horvath]

From: William Horvath <william(a)horvath.blog>

Adapted from check_invalid_gs in signal_i386.c. This prevents
crashing when the %gs register is manipulated. An example of this
can be seen in the game "Exertus: Darkness Approaches", which crashes
in 32-bit code when using "new-style" WoW64.

The SYSCALL_HAVE_WRFSGSBASE fast-path for getting/setting the segment
registers on Linux is already checked in signal_init_process, and
the other platforms' implementations follow existing conventions.

Also note that we check in the TRAP_x86_PAGEFLT case because
the error occurs when the invalid %gs value is actually used.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=57444
---
 dlls/ntdll/unix/signal_x86_64.c | 108 ++++++++++++++++++++++++++++++++
 1 file changed, 108 insertions(+)

diff --git a/dlls/ntdll/unix/signal_x86_64.c b/dlls/ntdll/unix/signal_x86_64.c
index caa85249896..289760f0808 100644
--- a/dlls/ntdll/unix/signal_x86_64.c
+++ b/dlls/ntdll/unix/signal_x86_64.c
@@ -1967,6 +1967,109 @@ static BOOL handle_syscall_trap( ucontext_t *sigcontext, siginfo_t *siginfo )
 }
 
 
+/***********************************************************************
+ *           check_invalid_gsbase
+ *
+ * Check for fault caused by invalid %gs value (some copy protection schemes mess with it).
+ *
+ */
+static inline BOOL check_invalid_gsbase( ucontext_t *sigcontext, CONTEXT *context )
+{
+    unsigned int prefix_count = 0;
+    const BYTE *instr = (const BYTE *)context->Rip;
+    ULONG_PTR cur_gsbase = 0;
+    TEB *teb;
+
+    if (CS_sig(sigcontext) != cs64_sel) return FALSE;
+    /* FIXME: breaks on linux 64-bit code and macOS 32- or 64-bit code
+    if (virtual_is_valid_code_address( instr, 1 )) return FALSE;
+    */
+
+#ifdef __linux__
+    if (syscall_flags & SYSCALL_HAVE_WRFSGSBASE)
+        __asm__ volatile ("rdgsbase %0" : "=r" (cur_gsbase));
+    else
+        arch_prctl( ARCH_GET_GS, &cur_gsbase );
+#elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
+    amd64_get_gsbase( &cur_gsbase );
+#elif defined(__NetBSD__)
+    sysarch( X86_64_GET_GSBASE, &cur_gsbase );
+#elif defined(__APPLE__)
+    /* FIXME */
+#else
+# error Please define getting %gs for your architecture
+#endif
+
+    teb = NtCurrentTeb();
+    if (cur_gsbase == (ULONG_PTR)teb) return FALSE;
+
+    for (;;)
+    {
+        switch(*instr)
+        {
+        /* instruction prefixes */
+        case 0x2e:  /* %cs: */
+        case 0x36:  /* %ss: */
+        case 0x3e:  /* %ds: */
+        case 0x26:  /* %es: */
+        case 0x40:  /* rex */
+        case 0x41:  /* rex */
+        case 0x42:  /* rex */
+        case 0x43:  /* rex */
+        case 0x44:  /* rex */
+        case 0x45:  /* rex */
+        case 0x46:  /* rex */
+        case 0x47:  /* rex */
+        case 0x48:  /* rex */
+        case 0x49:  /* rex */
+        case 0x4a:  /* rex */
+        case 0x4b:  /* rex */
+        case 0x4c:  /* rex */
+        case 0x4d:  /* rex */
+        case 0x4e:  /* rex */
+        case 0x4f:  /* rex */
+        case 0x64:  /* %fs: */
+        case 0x66:  /* opcode size */
+        case 0x67:  /* addr size */
+        case 0xf0:  /* lock */
+        case 0xf2:  /* repne */
+        case 0xf3:  /* repe */
+            if (++prefix_count >= 15) return FALSE;
+            instr++;
+            continue;
+        case 0x65:  /* %gs: */
+            GS_sig(sigcontext) = ds64_sel;
+            break;
+        default:
+            return FALSE;
+        }
+        break;      /* %gs: */
+    }
+
+    TRACE( "%016llx/%p at %p, fixing up\n", cur_gsbase, teb, instr );
+
+#ifdef __linux__
+    if (syscall_flags & SYSCALL_HAVE_WRFSGSBASE)
+        __asm__ volatile ("wrgsbase %0" :: "r" (teb));
+    else
+        arch_prctl( ARCH_SET_GS, teb );
+#elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
+    amd64_set_gsbase( teb );
+#elif defined(__NetBSD__)
+    sysarch( X86_64_SET_GSBASE, &teb );
+#elif defined(__APPLE__)
+    __asm__ volatile ("movq %0,%%gs:%c1" :: "r" (teb->Tib.Self),
+                      "n" (FIELD_OFFSET(TEB, Tib.Self)));
+    __asm__ volatile ("movq %0,%%gs:%c1" :: "r" (teb->ThreadLocalStoragePointer),
+                      "n" (FIELD_OFFSET(TEB, ThreadLocalStoragePointer)));
+#else
+# error Please define setting %gs for your architecture
+#endif
+
+    return TRUE;
+}
+
+
 /**********************************************************************
  *		segv_handler
  *
@@ -2025,6 +2128,11 @@ static void segv_handler( int signal, siginfo_t *siginfo, void *sigcontext )
             /* send EXCEPTION_EXECUTE_FAULT only if data execution prevention is enabled */
             if (!(flags & MEM_EXECUTE_OPTION_DISABLE)) rec.ExceptionInformation[0] = EXCEPTION_READ_FAULT;
         }
+        if (check_invalid_gsbase( ucontext, &context.c ))
+        {
+            leave_handler( ucontext );
+            return;
+        }
         break;
     case TRAP_x86_ALIGNFLT:  /* Alignment check exception */
         if (EFL_sig(ucontext) & 0x00040000)
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/7064