Skip to content

Conversation

@sivukhin
Copy link
Contributor

@sivukhin sivukhin commented Dec 26, 2025

  • if we will construct syscall from scratch - "unused" args (we have 6 registers in total - but syscall can use less) will be zeroed
  • tail_inject will set all registers - potentially overwriting registers unused for this syscall but having some important information for execution
  • after this patch I was able to run bash in the sandbox on ARM (with few additional tweaks) - without it shell just behaves "randomly" (it exits immediately, but in some different setups it can work in weird ways - which confirms the explanation of registers overwrite as this will lead to arbitrary UB)

Internally, during tail_inject reverie do:

regs.set_args((
    args.arg0 as Reg,
    args.arg1 as Reg,
    args.arg2 as Reg,
    args.arg3 as Reg,
    args.arg4 as Reg,
    args.arg5 as Reg,
));

- if we will construct syscall from scratch - "unused" args (we have 6 registers in total - but syscall can use less) will be zeroed
- tail_inject will set all registers - potentially overwriting registers unused for this syscall but having some important information for execution
- after this patch I was able to run bash in the sandbox on ARM (with few additional tweaks) - without it shell just behaves "randomly" (it exits immediately, but in some different setups it can work in weird ways - which confirms the explanation of registers overwrite as this will lead to arbitrary UB)
@penberg penberg merged commit 279fa46 into tursodatabase:main Dec 26, 2025
33 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants