[PATCH 0/1] MR7064: ntdll: Check for invalid %gs value in 32-bit code on WoW64.

[William Horvath (＠whrvth)]

Adapted from check_invalid_gs in [signal_i386.c](https://gitlab.winehq.org/wine/wine/-/blob/d7a7cae2e2d1ad34af6dbefcb06fbef2f...). This prevents crashing when the %gs register is manipulated in 32-bit code on "new-style" WoW64.

[test.c](https://bugs.winehq.org/attachment.cgi?id=77444) is a simple reproduction of the crash, courtesy of Fabian Maurer from the Bugzilla comments.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=57444

[PATCH 1/1] ntdll: Check for invalid %gs value in 32-bit code on WoW64.

[William Horvath]

From: William Horvath

Adapted from check_invalid_gs in signal_i386.c. This prevents
crashing when the %gs register is manipulated in 32-bit code on
"new-style" WoW64.

The SYSCALL_HAVE_WRFSGSBASE fast-path for getting/setting the segment
registers on Linux is already checked in signal_init_process, and
the other platforms' implementations follow existing conventions.

Also note that we check in the TRAP_x86_PAGEFLT case because
the error occurs when the invalid %gs value is actually used, i.e.
by an internal call to NtCurrentTeb().

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=57444
---
 dlls/ntdll/unix/signal_x86_64.c | 63 +++++++++++++++++++++++++++++++++
 1 file changed, 63 insertions(+)

diff --git a/dlls/ntdll/unix/signal_x86_64.c b/dlls/ntdll/unix/signal_x86_64.c
index caa85249896..3ad08c96057 100644
--- a/dlls/ntdll/unix/signal_x86_64.c
+++ b/dlls/ntdll/unix/signal_x86_64.c
@@ -1967,6 +1967,64 @@ static BOOL handle_syscall_trap( ucontext_t *sigcontext, siginfo_t *siginfo )
 }

+/***********************************************************************
+ *           check_invalid_gs
+ *
+ * Check for fault caused by invalid %gs value (some copy protection schemes mess with it).
+ *
+ */
+static inline BOOL check_invalid_gs( ucontext_t *sigcontext, CONTEXT *context )
+{
+    const BYTE *instr = (BYTE *)context->Rip;
+    TEB *teb = get_current_teb();
+    WORD system_gs = ds64_sel;
+    int cur_gs = 0;
+
+    /* only handle faults in system libraries */
+    if (virtual_is_valid_code_address( instr, 1 )) return FALSE;
+
+#ifdef __linux__
+    if (syscall_flags & SYSCALL_HAVE_WRFSGSBASE)
+        __asm__ volatile ("rdgsbase %0" : "=r" (cur_gs));
+    else
+        cur_gs = arch_prctl( ARCH_GET_GS, teb );
+#elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
+    amd64_get_gsbase( &cur_gs );
+#elif defined(__NetBSD__)
+    sysarch( X86_64_GET_GSBASE, &cur_gs );
+#elif defined(__APPLE__)
+    cur_gs = mac_thread_gsbase();
+#else
+# error Please define getting %gs for your architecture
+#endif
+
+    if (cur_gs == system_gs) return FALSE;
+
+    TRACE( "%04x/%04x at %p, fixing up\n", cur_gs, system_gs, instr );
+
+#ifdef __linux__
+    if (syscall_flags & SYSCALL_HAVE_WRFSGSBASE)
+        __asm__ volatile ("wrgsbase %0" :: "r" ((uintptr_t)teb));
+    else
+        arch_prctl(ARCH_SET_GS, teb);
+#elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
+    amd64_set_gsbase( teb );
+#elif defined(__NetBSD__)
+    sysarch( X86_64_SET_GSBASE, &teb );
+#elif defined(__APPLE__)
+    __asm__ volatile ("movq %0,%%gs:%c1" :: "r" (teb->Tib.Self),
+                     "n" (FIELD_OFFSET(TEB, Tib.Self)));
+    __asm__ volatile ("movq %0,%%gs:%c1" :: "r" (teb->ThreadLocalStoragePointer),
+                     "n" (FIELD_OFFSET(TEB, ThreadLocalStoragePointer)));
+#else
+# error Please define setting %gs for your architecture
+#endif
+
+    GS_sig(sigcontext) = system_gs;
+    return TRUE;
+}
+
+
 /**********************************************************************
  *		segv_handler
  *
@@ -2025,6 +2083,11 @@ static void segv_handler( int signal, siginfo_t *siginfo, void *sigcontext )
             /* send EXCEPTION_EXECUTE_FAULT only if data execution prevention is enabled */
             if (!(flags & MEM_EXECUTE_OPTION_DISABLE)) rec.ExceptionInformation[0] = EXCEPTION_READ_FAULT;
         }
+        if (check_invalid_gs( sigcontext, &context.c ))
+        {
+            leave_handler( ucontext );
+            return;
+        }
         break;
     case TRAP_x86_ALIGNFLT:  /* Alignment check exception */
         if (EFL_sig(ucontext) & 0x00040000)

[PATCH 1/1] ntdll: Check for invalid %gs value in 32-bit code on WoW64.

[Marvin]

Hi,

It looks like your patch introduced the new failures shown below.
Please investigate and fix them before resubmitting your patch.
If they are not new, fixing them anyway would help a lot. Otherwise
please ask for the known failures list to be updated.

The tests also ran into some preexisting test failures. If you know how
to fix them that would be helpful. See the TestBot job for the details:

The full results can be found at:
https://testbot.winehq.org/JobDetails.pl?Key=150489

Your paranoid android.

=== debian11b (64 bit WoW report) ===

advapi32:
security: Timeout

crypt32:
msg: Timeout

ddraw:
ddrawmodes: Timeout

kernel32:
console: Timeout
file: Timeout
time: Timeout
virtual: Timeout

ntdll:
exception: Timeout
file: Timeout
info: Timeout
om: Timeout
pipe: Timeout
reg: Timeout
time: Timeout
virtual: Timeout

user32:
input.c:4305: Test succeeded inside todo block: button_down_hwnd_todo 1: got MSG_TEST_WIN hwnd 0000000002A800FE, msg WM_LBUTTONDOWN, wparam 0x1, lparam 0x320032

Report validation errors:
user32:msg timeout

=== debian11b (build log) ===

WineRunWineTest.pl:error: The task timed out

[PATCH 0/1] MR7064: Draft: ntdll: Check for invalid %gs value in 32-bit code on WoW64.

[William Horvath (＠whrvth)]

I'll have to look into the macos build failure and test it there as well.