Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eefdca04 authored by Roland McGrath's avatar Roland McGrath Committed by H. Peter Anvin
Browse files

x86-64, compat: Retruncate rax after ia32 syscall entry tracing 



In commit d4d67150, we reopened an old hole for a 64-bit ptracer touching a
32-bit tracee in system call entry.  A %rax value set via ptrace at the
entry tracing stop gets used whole as a 32-bit syscall number, while we
only check the low 32 bits for validity.

Fix it by truncating %rax back to 32 bits after syscall_trace_enter,
in addition to testing the full 64 bits as has already been added.

Reported-by: default avatarBen Hawkes <hawkes@sota.gen.nz>
Signed-off-by: default avatarRoland McGrath <roland@redhat.com>
Signed-off-by: default avatarH. Peter Anvin <hpa@linux.intel.com>
parent 36d001c7

arch/x86/ia32/ia32entry.S

+7 −1
Original line number Diff line number Diff line
@@ -50,7 +50,12 @@ 
	/*

	 * Reload arg registers from stack in case ptrace changed them.

	 * We don't reload %eax because syscall_trace_enter() returned

	 * the value it wants us to use in the table lookup.

	 * the %rax value we should see.  Instead, we just truncate that

	 * value to 32 bits again as we did on entry from user mode.

	 * If it's a new value set by user_regset during entry tracing,

	 * this matches the normal truncation of the user-mode value.

	 * If it's -1 to make us punt the syscall, then (u32)-1 is still

	 * an appropriately invalid value.

	 */

	.macro LOAD_ARGS32 offset, _r9=0

	.if \_r9
@@ -60,6 +65,7 @@ 
	movl \offset+48(%rsp),%edx

	movl \offset+56(%rsp),%esi

	movl \offset+64(%rsp),%edi

	movl %eax,%eax			/* zero extension */

	.endm

	

	.macro CFI_STARTPROC32 simple