Re: [musl] i386 __set_thread_area will crash if the syscall fails

[Rich Felker <dalias@libc.org>]

On Sun, Aug 30, 2020 at 05:34:09PM -0700, Theodore Dubois wrote:
> Found a (small) bug in this file:
> https://git.musl-libc.org/cgit/musl/tree/src/thread/i386/__set_thread_area..s
> 
> If the syscall fails, the branch on line 20 is taken and %eax will
> be a small negative number. Then "mov $123,%al" will make syscall
> 0xffffff7b instead of 0x7b, since overwriting %al only overwrites
> the low byte of %eax. So the modify_ldt fallback has apparently
> never worked.

Thanks! Indeed, systems where the first syscall fails are outside the
actually-supported version range (before 2.6) so it's likely that this
was never actually tested. Nowadays SECCOMP_FILTER makes it easy to
test, so we should actually try to test some of these things. Have you
checked if it works adding xor %eax,%eax before the byte mov or
changing it to a 32-bit mov?

> Tangentially, I'm not sure why this file has so many hardcoded magic
> numbers and no comments to explain what they are.

Really it shouldn't even be external asm anymore. I'm trying to move
as much external asm as possible to inline asm written in C, and this
could be written entirely with __syscall() after #define
SYSCALL_NO_TLS (recently added) and all the structures setup
explicitly in C. I'll take a stab at doing that after fixing the bug.

Rich