|author||Roland McGrath <email@example.com>||2010-09-14 12:22:58 -0700|
|committer||H. Peter Anvin <firstname.lastname@example.org>||2010-09-14 16:08:47 -0700|
x86-64, compat: Retruncate rax after ia32 syscall entry tracing
In commit d4d6715, we reopened an old hole for a 64-bit ptracer touching a 32-bit tracee in system call entry. A %rax value set via ptrace at the entry tracing stop gets used whole as a 32-bit syscall number, while we only check the low 32 bits for validity. Fix it by truncating %rax back to 32 bits after syscall_trace_enter, in addition to testing the full 64 bits as has already been added. Reported-by: Ben Hawkes <email@example.com> Signed-off-by: Roland McGrath <firstname.lastname@example.org> Signed-off-by: H. Peter Anvin <email@example.com>
1 files changed, 7 insertions, 1 deletions
diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
index 84e3a4e..518bb99 100644
@@ -50,7 +50,12 @@
* Reload arg registers from stack in case ptrace changed them.
* We don't reload %eax because syscall_trace_enter() returned
- * the value it wants us to use in the table lookup.
+ * the %rax value we should see. Instead, we just truncate that
+ * value to 32 bits again as we did on entry from user mode.
+ * If it's a new value set by user_regset during entry tracing,
+ * this matches the normal truncation of the user-mode value.
+ * If it's -1 to make us punt the syscall, then (u32)-1 is still
+ * an appropriately invalid value.
.macro LOAD_ARGS32 offset, _r9=0
@@ -60,6 +65,7 @@
+ movl %eax,%eax /* zero extension */
.macro CFI_STARTPROC32 simple