| From 9fedde386516a69dd3152edc7e9dbb07dc76c254 Mon Sep 17 00:00:00 2001 |
| From: Roland McGrath <roland@redhat.com> |
| Date: Tue, 14 Sep 2010 12:22:58 -0700 |
| Subject: [PATCH] x86-64, compat: Retruncate rax after ia32 syscall entry tracing |
| |
| commit eefdca043e8391dcd719711716492063030b55ac upstream. |
| |
| In commit d4d6715, we reopened an old hole for a 64-bit ptracer touching a |
| 32-bit tracee in system call entry. A %rax value set via ptrace at the |
| entry tracing stop gets used whole as a 32-bit syscall number, while we |
| only check the low 32 bits for validity. |
| |
| Fix it by truncating %rax back to 32 bits after syscall_trace_enter, |
| in addition to testing the full 64 bits as has already been added. |
| |
| Reported-by: Ben Hawkes <hawkes@sota.gen.nz> |
| Signed-off-by: Roland McGrath <roland@redhat.com> |
| Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| --- |
| arch/x86/ia32/ia32entry.S | 8 +++++++- |
| 1 files changed, 7 insertions(+), 1 deletions(-) |
| |
| diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S |
| index 944e3fc..4f5f71e 100644 |
| --- a/arch/x86/ia32/ia32entry.S |
| +++ b/arch/x86/ia32/ia32entry.S |
| @@ -50,7 +50,12 @@ |
| /* |
| * Reload arg registers from stack in case ptrace changed them. |
| * We don't reload %eax because syscall_trace_enter() returned |
| - * the value it wants us to use in the table lookup. |
| + * the %rax value we should see. Instead, we just truncate that |
| + * value to 32 bits again as we did on entry from user mode. |
| + * If it's a new value set by user_regset during entry tracing, |
| + * this matches the normal truncation of the user-mode value. |
| + * If it's -1 to make us punt the syscall, then (u32)-1 is still |
| + * an appropriately invalid value. |
| */ |
| .macro LOAD_ARGS32 offset, _r9=0 |
| .if \_r9 |
| @@ -60,6 +65,7 @@ |
| movl \offset+48(%rsp),%edx |
| movl \offset+56(%rsp),%esi |
| movl \offset+64(%rsp),%edi |
| + movl %eax,%eax /* zero extension */ |
| .endm |
| |
| .macro CFI_STARTPROC32 simple |
| -- |
| 1.7.0.4 |
| |
