54 lines
2.0 KiB
Plaintext
54 lines
2.0 KiB
Plaintext
|
From: Roland McGrath <roland@redhat.com>
|
||
|
|
Date: Tue, 14 Sep 2010 19:22:58 +0000 (-0700)
|
||
|
|
Subject: x86-64, compat: Retruncate rax after ia32 syscall entry tracing
|
||
|
|
Git-commit: eefdca043e8391dcd719711716492063030b55ac
|
||
|
|
References: CVE-2010-3301 bnc#639708
|
||
|
|
Patch-mainline: 2.6.36
|
||
|
|
Introduced-by: 2.6.27
|
||
|
|
|
||
|
|
x86-64, compat: Retruncate rax after ia32 syscall entry tracing
|
||
|
|
|
||
|
|
In commit d4d6715, we reopened an old hole for a 64-bit ptracer touching a
|
||
|
|
32-bit tracee in system call entry. A %rax value set via ptrace at the
|
||
|
|
entry tracing stop gets used whole as a 32-bit syscall number, while we
|
||
|
|
only check the low 32 bits for validity.
|
||
|
|
|
||
|
|
Fix it by truncating %rax back to 32 bits after syscall_trace_enter,
|
||
|
|
in addition to testing the full 64 bits as has already been added.
|
||
|
|
|
||
|
|
Reported-by: Ben Hawkes <hawkes@sota.gen.nz>
|
||
|
|
Signed-off-by: Roland McGrath <roland@redhat.com>
|
||
|
|
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
|
||
|
|
Acked-by: Jeff Mahoney <jeffm@suse.com>
|
||
|
|
---
|
||
|
|
|
||
|
|
arch/x86/ia32/ia32entry.S | 8 +++++++-
|
||
|
|
1 file changed, 7 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
|
||
|
|
index 84e3a4e..518bb99 100644
|
||
|
|
--- a/arch/x86/ia32/ia32entry.S
|
||
|
|
+++ b/arch/x86/ia32/ia32entry.S
|
||
|
|
@@ -50,7 +50,12 @@
|
||
|
|
/*
|
||
|
|
* Reload arg registers from stack in case ptrace changed them.
|
||
|
|
* We don't reload %eax because syscall_trace_enter() returned
|
||
|
|
- * the value it wants us to use in the table lookup.
|
||
|
|
+ * the %rax value we should see. Instead, we just truncate that
|
||
|
|
+ * value to 32 bits again as we did on entry from user mode.
|
||
|
|
+ * If it's a new value set by user_regset during entry tracing,
|
||
|
|
+ * this matches the normal truncation of the user-mode value.
|
||
|
|
+ * If it's -1 to make us punt the syscall, then (u32)-1 is still
|
||
|
|
+ * an appropriately invalid value.
|
||
|
|
*/
|
||
|
|
.macro LOAD_ARGS32 offset, _r9=0
|
||
|
|
.if \_r9
|
||
|
|
@@ -60,6 +65,7 @@
|
||
|
|
movl \offset+48(%rsp),%edx
|
||
|
|
movl \offset+56(%rsp),%esi
|
||
|
|
movl \offset+64(%rsp),%edi
|
||
|
|
+ movl %eax,%eax /* zero extension */
|
||
|
|
.endm
|
||
|
|
|
||
|
|
.macro CFI_STARTPROC32 simple
|