[lkml]   [2010]   [Sep]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[102/129] x86-64, compat: Retruncate rax after ia32 syscall entry tracing
    2.6.35-stable review patch.  If anyone has any objections, please let us know.


    From: Roland McGrath <>

    commit eefdca043e8391dcd719711716492063030b55ac upstream.

    In commit d4d6715, we reopened an old hole for a 64-bit ptracer touching a
    32-bit tracee in system call entry. A %rax value set via ptrace at the
    entry tracing stop gets used whole as a 32-bit syscall number, while we
    only check the low 32 bits for validity.

    Fix it by truncating %rax back to 32 bits after syscall_trace_enter,
    in addition to testing the full 64 bits as has already been added.

    Reported-by: Ben Hawkes <>
    Signed-off-by: Roland McGrath <>
    Signed-off-by: H. Peter Anvin <>
    Signed-off-by: Greg Kroah-Hartman <>

    arch/x86/ia32/ia32entry.S | 8 +++++++-
    1 file changed, 7 insertions(+), 1 deletion(-)

    --- a/arch/x86/ia32/ia32entry.S
    +++ b/arch/x86/ia32/ia32entry.S
    @@ -50,7 +50,12 @@
    * Reload arg registers from stack in case ptrace changed them.
    * We don't reload %eax because syscall_trace_enter() returned
    - * the value it wants us to use in the table lookup.
    + * the %rax value we should see. Instead, we just truncate that
    + * value to 32 bits again as we did on entry from user mode.
    + * If it's a new value set by user_regset during entry tracing,
    + * this matches the normal truncation of the user-mode value.
    + * If it's -1 to make us punt the syscall, then (u32)-1 is still
    + * an appropriately invalid value.
    .macro LOAD_ARGS32 offset, _r9=0
    .if \_r9
    @@ -60,6 +65,7 @@
    movl \offset+48(%rsp),%edx
    movl \offset+56(%rsp),%esi
    movl \offset+64(%rsp),%edi
    + movl %eax,%eax /* zero extension */

    .macro CFI_STARTPROC32 simple

     \ /
      Last update: 2010-09-18 21:25    [W:0.026 / U:127.400 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site