[PATCH 0/1] MR7159: ntdll: Don't wow64-offset NULL TEB.

[Paul Gofman (＠gofman)]

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=57690

Fixes a regression introduced by commit de23dfc5b1eac6e111cd66540ad9a97b61a3fe28.

[PATCH 1/1] ntdll: Don't wow64-offset NULL TEB.

[Paul Gofman]

From: Paul Gofman

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=57690

Fixes a regression introduced by commit de23dfc5b1eac6e111cd66540ad9a97b61a3fe28.
---
 dlls/ntdll/unix/thread.c | 2 +-
 dlls/wow64/process.c     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dlls/ntdll/unix/thread.c b/dlls/ntdll/unix/thread.c
index cec6b3cb106..b64a7dd40af 100644
--- a/dlls/ntdll/unix/thread.c
+++ b/dlls/ntdll/unix/thread.c
@@ -2069,7 +2069,7 @@ NTSTATUS WINAPI NtQueryInformationThread( HANDLE handle, THREADINFOCLASS class,
         {
             if (is_old_wow64())
             {
-                if (is_process_wow64( &info.ClientId ))
+                if (info.TebBaseAddress && is_process_wow64( &info.ClientId ))
                     info.TebBaseAddress = (char *)info.TebBaseAddress + teb_offset;
                 else
                     info.TebBaseAddress = NULL;
diff --git a/dlls/wow64/process.c b/dlls/wow64/process.c
index 4d067cea06f..c459de16418 100644
--- a/dlls/wow64/process.c
+++ b/dlls/wow64/process.c
@@ -692,7 +692,7 @@ NTSTATUS WINAPI wow64_NtQueryInformationThread( UINT *args )
         if (!status)
         {
             info32.ExitStatus = info.ExitStatus;
-            info32.TebBaseAddress = is_process_id_wow64( &info.ClientId ) ?
+            info32.TebBaseAddress = is_process_id_wow64( &info.ClientId ) && info.TebBaseAddress ?
                                     PtrToUlong(info.TebBaseAddress) + 0x2000 : 0;
             info32.ClientId.UniqueProcess = HandleToULong( info.ClientId.UniqueProcess );
             info32.ClientId.UniqueThread = HandleToULong( info.ClientId.UniqueThread );

[PATCH 1/1] ntdll: Don't wow64-offset NULL TEB.

[Marvin]

Hi,

It looks like your patch introduced the new failures shown below.
Please investigate and fix them before resubmitting your patch.
If they are not new, fixing them anyway would help a lot. Otherwise
please ask for the known failures list to be updated.

The tests also ran into some preexisting test failures. If you know how
to fix them that would be helpful. See the TestBot job for the details:

The full results can be found at:
https://testbot.winehq.org/JobDetails.pl?Key=150942

Your paranoid android.

=== debian11b (64 bit WoW report) ===

mfmediaengine:
mfmediaengine.c:2640: Test failed: Got unexpected refcount 1.

[Paul Gofman (＠gofman)]

Currently in Wine TEB pointer obtained by NtQueryInformationThread( ThreadBasicInformation ) from '( get_thread_info )' server call can be NULL when thread was already created in the creating thread ('( new_thread )' was called) but not yet initialized on its own and didn't yet call '( init_thread )'. In that state thread can be found. The blamed commit actually tries to handle such a situation by checking TEB pointer for NULL but for wow64 thread (both in new 64 on 32 and old wow64 modes) the TEB pointer gets offset and becomes 0x2000 instead of NULL, leading to crash in alloc_tls_slot().

I am not entirely sure if it is ever possible to get NULL teb pointer from NtQueryInformationThread() on Windows, probably not. But changing this behaviour is rather involved as the TEB should not only get its address but probably be further initialized before it can be reported from NtQueryInformationThread which happens in the thread itself before it calls '(init_thread)'. I hope this added check is fine to fix the regression and is safe enough for the end of code freeze.