APP CRASH on sysenter after vsyscall hook fails in 32-bit apps on Ubuntu20
Running any Dr. Memory test app, including tests/hello, and presumably any 32-bit app at all (but then why doesn't every single test fail in the DR and DrM suites??), we have an app crash:
bruening@ubuntu:~/drmemory/git/build_x86_dbg_tests$ dynamorio/bin32/drrun -- tests/hello
<Starting application /home/bruening/drmemory/git/build_x86_dbg_tests/tests/hello (35741)>
<Initial options = -no_dynamic_options -code_api -stack_size 56K -signal_stack_size 32K -max_elide_jmp 0 -max_elide_call 0 -early_inject -emulate_brk -no_inline_ignored_syscalls -native_exec_default_list '' -no_native_exec_managed_code -no_indcall2direct >
<Paste into GDB to debug DynamoRIO clients:
set confirm off
add-symbol-file '/home/bruening/drmemory/git/build_x86_dbg_tests/dynamorio/lib32/debug/libdynamorio.so' 0xf7b9f000
>
<spurious rep/repne prefix @0xf7b48dd0 (f3 0f 1e fb): >
<(1+x) Handling our fault in a TRY at 0xf7db56fd>
<Application tried to execute from unreadable memory 0x00000000.
This may be a result of an unsuccessful attack or a potential application vulnerability.>
<Application /home/bruening/drmemory/git/build_x86_dbg_tests/tests/hello (35741). Application exception at PC 0xf7b7e549.
Signal 11 delivered to application as default action.
Callstack:
0xf7b7e549 <[vdso]+0x549>
>
<Stopping application /home/bruening/drmemory/git/build_x86_dbg_tests/tests/hello (35741)>
Segmentation fault (core dumped)
interp: start_pc = 0xf7a251dd
check_thread_vm_area: pc = 0xf7a251dd
prepend_entry_to_fraglist: putting fragment @0xf7a251dd (shared) on vmarea 0xf794e000-0xf7aa6000
check_thread_vm_area: check_stop = 0xf7aa6000
0xf7a251dd 8b 4c 24 20 mov 0x20(%esp)[4byte] -> %ecx
0xf7a251e1 b8 27 01 00 00 mov $0x00000127 -> %eax
0xf7a251e6 bb 9c ff ff ff mov $0xffffff9c -> %ebx
0xf7a251eb 65 ff 15 10 00 00 00 call %gs:0x10[4byte] %esp -> %esp 0xfffffffc(%esp)[4byte]
mbr exit target = 0x4bfa1640
end_pc = 0xf7a251f2
interp: start_pc = 0xf7b65540
check_thread_vm_area: pc = 0xf7b65540
new shared vm area: 0xf7b65000-0xf7b67000 ---- VDSO linux-gate.so.1
checking thread vmareas against executable_areas
prepend_entry_to_fraglist: putting fragment @0xf7b65540 (shared) on vmarea 0xf7b65000-0xf7b67000
check_thread_vm_area: check_stop = 0xf7b67000
0xf7b65540 51 push %ecx %esp -> %esp 0xfffffffc(%esp)[4byte]
0xf7b65541 52 push %edx %esp -> %esp 0xfffffffc(%esp)[4byte]
0xf7b65542 55 push %ebp %esp -> %esp 0xfffffffc(%esp)[4byte]
0xf7b65543 89 e5 mov %esp -> %ebp
0xf7b65545 0f 34 sysenter -> %esp
interp: syscall @ 0xf7b65545
find_syscall_num: never found write of syscall number
syscall # is -1
found non-ignorable system call 0xffffffff
ending bb at syscall & removing the interrupt itself
end_pc = 0xf7b65547
fcache_enter = 0x4bfa0e80, target = 0x4bfb45dc
Exit from F1856(0xf7b65540).0x4bfb45e1 (shared)
(block ends with syscall)
Entry into do_syscall to execute a non-ignorable system call
system call 295
fcache_enter = 0x4c017e80, target = 0x4c018240
Exit from system call
post syscall: sysnum=0x00000127, result=0x00000003 (3)
adjust_syscall_continuation: asynch_target => 0xf7b65549
finished handling system call
d_r_dispatch: target = 0xf7b65549
interp: start_pc = 0x00000000
check_thread_vm_area: pc = 0x00000000
application tried to execute from unreadable 0x00000000 is_allocated_mem=0 prot=0x0
Thread 35406 call stack:
SYSLOG_WARNING: Application tried to execute from unreadable memory 0x00000000.
Presumably it's related to this but it's not immediately clear why it went to 0:
Found vsyscall @ 0xf7b65545 => page 0xf7b65000, post 0xf7b65547
Unable to hook vsyscall page; falling back on int
The layout is not what our hook code expects:
(gdb) x/25i 0xf7fcf540
0xf7fcf540 <__kernel_vsyscall>: push %ecx
0xf7fcf541 <__kernel_vsyscall+1>: push %edx
0xf7fcf542 <__kernel_vsyscall+2>: push %ebp
0xf7fcf543 <__kernel_vsyscall+3>: mov %esp,%ebp
0xf7fcf545 <__kernel_vsyscall+5>: sysenter
0xf7fcf547 <__kernel_vsyscall+7>: int $0x80
0xf7fcf549 <__kernel_vsyscall+9>: pop %ebp
0xf7fcf54a <__kernel_vsyscall+10>: pop %edx
0xf7fcf54b <__kernel_vsyscall+11>: pop %ecx
0xf7fcf54c <__kernel_vsyscall+12>: ret
0xf7fcf54d: nop
0xf7fcf54e: nop
0xf7fcf54f: nop
0xf7fcf550: nop
0xf7fcf551: lea 0x0(%esi,%eiz,1),%esi
0xf7fcf558: lea 0x0(%esi,%eiz,1),%esi
0xf7fcf55f: nop
0xf7fcf560 <__kernel_sigreturn>: pop %eax
0xf7fcf561 <__kernel_sigreturn+1>: mov $0x77,%eax
0xf7fcf566 <__kernel_sigreturn+6>: int $0x80
0xf7fcf568 <__kernel_sigreturn+8>: nop
0xf7fcf569: lea 0x0(%esi,%eiz,1),%esi
0xf7fcf570 <__kernel_rt_sigreturn>: mov $0xad,%eax
0xf7fcf575 <__kernel_rt_sigreturn+5>: int $0x80
0xf7fcf577 <__kernel_rt_sigreturn+7>: nop