Re: segmentation fault with glibc-2.34

[Adhemerval Zanella <adhemerval.zanella@linaro.org>]

On 03/12/2021 11:55, Adhemerval Zanella wrote:
> On Fri, Dec 3, 2021 at 10:38 AM Andreas Fink via Libc-help
> <libc-help@sourceware.org> wrote:
>>
>> Hello,
>> I have observed a crash in firefox with glibc-2.34 and have found a
>> small reproducer.
>> Is the sigsys signal handler valid? If yes, then there is a bug in
>> glibc-2.34.
>> If it is invalid to set the result in the context, I think the firefox
>> sandbox is doing dodgy things.
>>
>> gcc test.c -lseccomp
>> strace ./a.out
> 
> The seccomp filter *explicitly* blocks newfstatat, which might be used
> by getpwuid.

Oops, I didn't not get the issue at first.  It seems that the syscall return
code it not being set as expected:

(gdb) disas
Dump of assembler code for function __GI___fstatat64:
   0x00007ffff7e6fe70 <+0>:	endbr64 
   0x00007ffff7e6fe74 <+4>:	mov    %ecx,%r10d
   0x00007ffff7e6fe77 <+7>:	mov    $0x106,%eax
   0x00007ffff7e6fe7c <+12>:	syscall 
   0x00007ffff7e6fe7e <+14>:	cmp    $0xfffff000,%eax
=> 0x00007ffff7e6fe83 <+19>:	ja     0x7ffff7e6fe90 <__GI___fstatat64+32>
   0x00007ffff7e6fe85 <+21>:	xor    %eax,%eax
   0x00007ffff7e6fe87 <+23>:	ret    
   0x00007ffff7e6fe88 <+24>:	nopl   0x0(%rax,%rax,1)
   0x00007ffff7e6fe90 <+32>:	mov    0x100f79(%rip),%rdx        # 0x7ffff7f70e10
   0x00007ffff7e6fe97 <+39>:	neg    %eax
   0x00007ffff7e6fe99 <+41>:	mov    %eax,%fs:(%rdx)
   0x00007ffff7e6fe9c <+44>:	mov    $0xffffffff,%eax
   0x00007ffff7e6fea1 <+49>:	ret    
End of assembler dump.
(gdb) i r eax
eax            0x0                 0

Which makes getpwuid access uninitiated/invalid memory later.