[PATCH 1/1] ntdll: Check for invalid %gs value in 32-bit code on WoW64.

[William Horvath]

From: William Horvath

Adapted from check_invalid_gs in signal_i386.c. This prevents
crashing when the %gs register is manipulated in 32-bit code on
"new-style" WoW64.

The SYSCALL_HAVE_WRFSGSBASE fast-path for getting/setting the segment
registers on Linux is already checked in signal_init_process, and
the other platforms' implementations follow existing conventions.

Also note that we check in the TRAP_x86_PAGEFLT case because
the error occurs when the invalid %gs value is actually used, i.e.
by an internal call to NtCurrentTeb().

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=57444
---
 dlls/ntdll/unix/signal_x86_64.c | 63 +++++++++++++++++++++++++++++++++
 1 file changed, 63 insertions(+)

diff --git a/dlls/ntdll/unix/signal_x86_64.c b/dlls/ntdll/unix/signal_x86_64.c
index caa85249896..3ad08c96057 100644
--- a/dlls/ntdll/unix/signal_x86_64.c
+++ b/dlls/ntdll/unix/signal_x86_64.c
@@ -1967,6 +1967,64 @@ static BOOL handle_syscall_trap( ucontext_t *sigcontext, siginfo_t *siginfo )
 }

+/***********************************************************************
+ *           check_invalid_gs
+ *
+ * Check for fault caused by invalid %gs value (some copy protection schemes mess with it).
+ *
+ */
+static inline BOOL check_invalid_gs( ucontext_t *sigcontext, CONTEXT *context )
+{
+    const BYTE *instr = (BYTE *)context->Rip;
+    TEB *teb = get_current_teb();
+    WORD system_gs = ds64_sel;
+    int cur_gs = 0;
+
+    /* only handle faults in system libraries */
+    if (virtual_is_valid_code_address( instr, 1 )) return FALSE;
+
+#ifdef __linux__
+    if (syscall_flags & SYSCALL_HAVE_WRFSGSBASE)
+        __asm__ volatile ("rdgsbase %0" : "=r" (cur_gs));
+    else
+        cur_gs = arch_prctl( ARCH_GET_GS, teb );
+#elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
+    amd64_get_gsbase( &cur_gs );
+#elif defined(__NetBSD__)
+    sysarch( X86_64_GET_GSBASE, &cur_gs );
+#elif defined(__APPLE__)
+    cur_gs = mac_thread_gsbase();
+#else
+# error Please define getting %gs for your architecture
+#endif
+
+    if (cur_gs == system_gs) return FALSE;
+
+    TRACE( "%04x/%04x at %p, fixing up\n", cur_gs, system_gs, instr );
+
+#ifdef __linux__
+    if (syscall_flags & SYSCALL_HAVE_WRFSGSBASE)
+        __asm__ volatile ("wrgsbase %0" :: "r" ((uintptr_t)teb));
+    else
+        arch_prctl(ARCH_SET_GS, teb);
+#elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
+    amd64_set_gsbase( teb );
+#elif defined(__NetBSD__)
+    sysarch( X86_64_SET_GSBASE, &teb );
+#elif defined(__APPLE__)
+    __asm__ volatile ("movq %0,%%gs:%c1" :: "r" (teb->Tib.Self),
+                     "n" (FIELD_OFFSET(TEB, Tib.Self)));
+    __asm__ volatile ("movq %0,%%gs:%c1" :: "r" (teb->ThreadLocalStoragePointer),
+                     "n" (FIELD_OFFSET(TEB, ThreadLocalStoragePointer)));
+#else
+# error Please define setting %gs for your architecture
+#endif
+
+    GS_sig(sigcontext) = system_gs;
+    return TRUE;
+}
+
+
 /**********************************************************************
  *		segv_handler
  *
@@ -2025,6 +2083,11 @@ static void segv_handler( int signal, siginfo_t *siginfo, void *sigcontext )
             /* send EXCEPTION_EXECUTE_FAULT only if data execution prevention is enabled */
             if (!(flags & MEM_EXECUTE_OPTION_DISABLE)) rec.ExceptionInformation[0] = EXCEPTION_READ_FAULT;
         }
+        if (check_invalid_gs( sigcontext, &context.c ))
+        {
+            leave_handler( ucontext );
+            return;
+        }
         break;
     case TRAP_x86_ALIGNFLT:  /* Alignment check exception */
         if (EFL_sig(ucontext) & 0x00040000)