{"action":"opened","issue":{"url":"https://api.github.com/repos/lionheart/openradar-mirror/issues/14393","repository_url":"https://api.github.com/repos/lionheart/openradar-mirror","labels_url":"https://api.github.com/repos/lionheart/openradar-mirror/issues/14393/labels{/name}","comments_url":"https://api.github.com/repos/lionheart/openradar-mirror/issues/14393/comments","events_url":"https://api.github.com/repos/lionheart/openradar-mirror/issues/14393/events","html_url":"https://github.com/lionheart/openradar-mirror/issues/14393","id":149051590,"number":14393,"title":"12382220: Mach exception handling does not report int3 faults when %cs base is non-zero","user":{"login":"openradar-mirror","id":13605213,"avatar_url":"https://avatars.githubusercontent.com/u/13605213?v=3","gravatar_id":"","url":"https://api.github.com/users/openradar-mirror","html_url":"https://github.com/openradar-mirror","followers_url":"https://api.github.com/users/openradar-mirror/followers","following_url":"https://api.github.com/users/openradar-mirror/following{/other_user}","gists_url":"https://api.github.com/users/openradar-mirror/gists{/gist_id}","starred_url":"https://api.github.com/users/openradar-mirror/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openradar-mirror/subscriptions","organizations_url":"https://api.github.com/users/openradar-mirror/orgs","repos_url":"https://api.github.com/users/openradar-mirror/repos","events_url":"https://api.github.com/users/openradar-mirror/events{/privacy}","received_events_url":"https://api.github.com/users/openradar-mirror/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/lionheart/openradar-mirror/labels/classification:other%20bug","name":"classification:other bug","color":"e11d21"},{"url":"https://api.github.com/repos/lionheart/openradar-mirror/labels/reproducible:always","name":"reproducible:always","color":"5319e7"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/lionheart/openradar-mirror/milestones/66","html_url":"https://github.com/lionheart/openradar-mirror/milestones/Mac%20OS%20X","labels_url":"https://api.github.com/repos/lionheart/openradar-mirror/milestones/66/labels","id":1238025,"number":66,"title":"Mac OS X","description":null,"creator":{"login":"openradar-mirror","id":13605213,"avatar_url":"https://avatars.githubusercontent.com/u/13605213?v=3","gravatar_id":"","url":"https://api.github.com/users/openradar-mirror","html_url":"https://github.com/openradar-mirror","followers_url":"https://api.github.com/users/openradar-mirror/followers","following_url":"https://api.github.com/users/openradar-mirror/following{/other_user}","gists_url":"https://api.github.com/users/openradar-mirror/gists{/gist_id}","starred_url":"https://api.github.com/users/openradar-mirror/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openradar-mirror/subscriptions","organizations_url":"https://api.github.com/users/openradar-mirror/orgs","repos_url":"https://api.github.com/users/openradar-mirror/repos","events_url":"https://api.github.com/users/openradar-mirror/events{/privacy}","received_events_url":"https://api.github.com/users/openradar-mirror/received_events","type":"User","site_admin":false},"open_issues":196,"closed_issues":0,"state":"open","created_at":"2015-08-03T10:45:58Z","updated_at":"2016-04-18T06:02:16Z","due_on":null,"closed_at":null},"comments":0,"created_at":"2016-04-18T06:02:16Z","updated_at":"2016-04-18T06:02:16Z","closed_at":null,"body":"#### Description\n\nSummary:\r\n\r\nThe Mac OS X kernel has a bug in which exceptions from the x86 \"int3\"\r\ninstruction are often not reported via Mach exception handling when\r\nthe %cs segment base is non-zero.\r\n\r\nThe problem does not occur when the %cs segment base is zero, nor does\r\nit occur with other types of fault (the HLT instruction, memory access\r\nerrors, etc.).\r\n\r\n\r\nSteps to Reproduce:\r\n\r\nSee the attached test program, mach_exception_int3_with_segs.c.\r\n\r\n\r\nExpected Results:\r\n\r\nThe program should output something like:\r\n\r\nWaiting for fault to be reported (with the Mac bug present, we expect this to hang)...\r\nGot exception, type 0x6\r\neip=0x74465 (476261)\r\nesp=0xc0071d5c (-1073275556)\r\nss=0x23 (35)\r\ncs=0x1f (31)\r\nds=0x23 (35)\r\nes=0x23 (35)\r\nfs=0x0 (0)\r\ngs=0xf (15)\r\n\r\n\r\nActual Results:\r\n\r\nThe program hangs.\r\n\r\n\r\nRegression:\r\n\r\nThis was probably introduced when DTrace support was added to the kernel.\r\n\r\n\r\nNotes:\r\n\r\nWhen the int3 fault occurs, the Mac kernel examines the instruction\r\npreceding %eip to check whether it is (still) an int3 instruction, but\r\nit fails to take the %cs segment base into account.\r\n\r\nI think I've found the code responsible in the Mac kernel sources.\r\nxnu-1699.22.73/osfmk/i386/trap.c handles T_INT3.  It calls\r\ndtrace_user_probe() in xnu-1699.22.73/bsd/dev/i386/dtrace_subr_x86.c,\r\nwhich contains code which reads memory to check for int3.  This fails\r\nto take the %cs segment base into account.\r\n\r\n\r\nFor the test program, see the attachment on https://code.google.com/p/nativeclient/issues/detail?id=2879\n\n-\nProduct Version: 10.7.4 (11E53)\nCreated: 2012-09-27T00:01:42.755912\nOriginated: 2012-09-26T00:00:00\nOpen Radar Link: http://www.openradar.me/12382220"}}