[Bug 267616] Linuxulator: get_robust_list is slightly broken on amd64 for 32-bit apps

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=267616

            Bug ID: 267616
           Summary: Linuxulator: get_robust_list is slightly broken on
                    amd64 for 32-bit apps
           Product: Base System
           Version: 13.1-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: iwtcex@gmail.com
                CC: trasz@FreeBSD.org

New Steam beta fails with "Fatal error: futex robust_list not initialized by
pthreads".

% uname -a
FreeBSD desktop 13.1-RELEASE FreeBSD 13.1-RELEASE
releng/13.1-n250148-fc952ac2212 GENERIC amd64
% cat robust.c
#include <assert.h>
#include <unistd.h>
#include <stdio.h>
#include <linux/futex.h>
#include <sys/syscall.h>

int main() {

  assert(sizeof(size_t) == sizeof(void*));

  {
    void* x[2];

    int err = syscall(SYS_get_robust_list, 0, &x[0], &x[1]);
    assert(err == 0);

    struct robust_list_head* head =         x[0];
    size_t len                    = (size_t)x[1];

    printf("head: %p, len: 0x%x, offset = %ld\n", head, len,
head->futex_offset);
  }

  {
    void* x[2];

    int err = syscall(SYS_get_robust_list, 0, &x[1], &x[0]);
    assert(err == 0);

    struct robust_list_head* head =         x[1];
    size_t len                    = (size_t)x[0];

    printf("head: %p, len: 0x%x, offset = %ld\n", head, len,
head->futex_offset);
  }

  return 0;
}
% /compat/linux/bin/cc robust.c -pthread -m32 -Wall -o robust32
% ./robust3
head: 0x28261770, len: 0x0, offset = -20 # len is being overwritten by the
previous argument, not ok
head: 0x28261770, len: 0xc, offset = -20 # ok

I locally patched the issue like this:

--- linux_futex.c.orig  2022-11-07 16:09:35.911266000 +0300
+++ linux_futex.c       2022-11-07 16:12:48.581662000 +0300
@@ -1179,7 +1179,7 @@ linux_get_robust_list(struct thread *td, struct linux_
                return (EFAULT);
        }

-       error = copyout(&head, args->head, sizeof(head));
+       error = copyout(&head, args->head, sizeof(l_uintptr_t));
        if (error) {
                LIN_SDT_PROBE1(futex, linux_get_robust_list, copyout_error,
                    error);

-- 
You are receiving this mail because:
You are the assignee for the bug.