From ce38bb7aeaffe4a092993e3c0db0f802ae5d1ee5 Mon Sep 17 00:00:00 2001
From: guenther <guenther@openbsd.org>
Date: Thu, 11 May 2023 19:35:50 +0000
Subject: [PATCH] Retguard addition in commit 72pYktDvmJhq7OyF was based on the
 understanding that the removal of the off_t padding, amd64 syscalls no longer
 passed a 7th or later argument.  We overlooked that syscall(2) bumps the arg
 count by one, so six argument calls like SYS_sysctl still pass an argument on
 the stack.

So, repush the 7th argument so it's at the expected stack offset after the
retguard register is pushed.

problem reported and ok bluhm@
---
 lib/libc/arch/amd64/sys/syscall.S | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/lib/libc/arch/amd64/sys/syscall.S b/lib/libc/arch/amd64/sys/syscall.S
index 6568ecc55af..99d502ecc9e 100644
--- a/lib/libc/arch/amd64/sys/syscall.S
+++ b/lib/libc/arch/amd64/sys/syscall.S
@@ -1,4 +1,4 @@
-/*	$OpenBSD: syscall.S,v 1.8 2016/05/07 19:05:21 guenther Exp $	*/
+/*	$OpenBSD: syscall.S,v 1.9 2023/05/11 19:35:50 guenther Exp $	*/
 /*	$NetBSD: syscall.S,v 1.2 2002/06/03 18:30:33 fvdl Exp $	*/
 
 /*-
@@ -39,4 +39,18 @@
 
 #include "SYS.h"
 
-RSYSCALL(syscall)
+SYSENTRY(syscall)
+	RETGUARD_SETUP(_thread_sys_syscall, r11)
+#ifdef _RET_PROTECTOR
+	pushq	8(%rsp)		/* repush 6th argument */
+#endif
+	RETGUARD_PUSH(r11)
+	SYSTRAP(syscall)
+	HANDLE_ERRNO;
+	RETGUARD_POP(r11)
+#ifdef _RET_PROTECTOR
+	addq	$8,%rsp		/* repush 6th argument */
+#endif
+	RETGUARD_CHECK(_thread_sys_syscall, r11)
+	ret
+SYSCALL_END(syscall)
-- 
2.20.1