提交 eefdca04 编写于 作者: R Roland McGrath 提交者: H. Peter Anvin

x86-64, compat: Retruncate rax after ia32 syscall entry tracing

In commit d4d67150, we reopened an old hole for a 64-bit ptracer touching a
32-bit tracee in system call entry.  A %rax value set via ptrace at the
entry tracing stop gets used whole as a 32-bit syscall number, while we
only check the low 32 bits for validity.

Fix it by truncating %rax back to 32 bits after syscall_trace_enter,
in addition to testing the full 64 bits as has already been added.
Reported-by: NBen Hawkes <hawkes@sota.gen.nz>
Signed-off-by: NRoland McGrath <roland@redhat.com>
Signed-off-by: NH. Peter Anvin <hpa@linux.intel.com>
上级 36d001c7
...@@ -50,7 +50,12 @@ ...@@ -50,7 +50,12 @@
/* /*
* Reload arg registers from stack in case ptrace changed them. * Reload arg registers from stack in case ptrace changed them.
* We don't reload %eax because syscall_trace_enter() returned * We don't reload %eax because syscall_trace_enter() returned
* the value it wants us to use in the table lookup. * the %rax value we should see. Instead, we just truncate that
* value to 32 bits again as we did on entry from user mode.
* If it's a new value set by user_regset during entry tracing,
* this matches the normal truncation of the user-mode value.
* If it's -1 to make us punt the syscall, then (u32)-1 is still
* an appropriately invalid value.
*/ */
.macro LOAD_ARGS32 offset, _r9=0 .macro LOAD_ARGS32 offset, _r9=0
.if \_r9 .if \_r9
...@@ -60,6 +65,7 @@ ...@@ -60,6 +65,7 @@
movl \offset+48(%rsp),%edx movl \offset+48(%rsp),%edx
movl \offset+56(%rsp),%esi movl \offset+56(%rsp),%esi
movl \offset+64(%rsp),%edi movl \offset+64(%rsp),%edi
movl %eax,%eax /* zero extension */
.endm .endm
.macro CFI_STARTPROC32 simple .macro CFI_STARTPROC32 simple
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册