Skip to content

RuntimeLibcGuard may not fully protect the runtime libc‘s FS base (and its TLS area) #4

@Gallium70

Description

@Gallium70

The comment on RuntimeLibcGuard states:

Use when calling into the runtime's copy of libc
Will disable preemption and set the correct FS register.

However, in practice, it may be difficult (if not impossible) to comprehensively cover all cases where execution enters libc.

For example, when the runtime first invokes a function from the std library, it may trigger lazy binding through the dynamic linker. During this process, glibc’s _dl_fixup can access the TLS area. Such calls are implicit and may not be easily anticipated or exhaustively guarded by RuntimeLibcGuard.

A more robust approach might be to switch the FS base at every entry point into the runtime, and restore it upon returning to the user program. This would include handling transitions such as syscalls, interrupts, and signal trampolines (e.g., in entry.S).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions