]> git.ipfire.org Git - people/ms/linux.git/commit
ptrace,x86: force IRET path after a ptrace_stop()
authorTejun Heo <tj@kernel.org>
Thu, 3 Jul 2014 19:43:15 +0000 (15:43 -0400)
committerWilly Tarreau <w@1wt.eu>
Sun, 23 Nov 2014 09:55:37 +0000 (10:55 +0100)
commita3b45048ba450a3f94e5f1a8c616a0925a0da07a
tree551999b9fa6b274d960c168525c4920e49d2fe16
parent883f30e7d98d97d704df38cd2972a33be852f23a
ptrace,x86: force IRET path after a ptrace_stop()

[ Upstream commit b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a ]

The 'sysret' fastpath does not correctly restore even all regular
registers, much less any segment registers or reflags values.  That is
very much part of why it's faster than 'iret'.

Normally that isn't a problem, because the normal ptrace() interface
catches the process using the signal handler infrastructure, which
always returns with an iret.

However, some paths can get caught using ptrace_event() instead of the
signal path, and for those we need to make sure that we aren't going to
return to user space using 'sysret'.  Otherwise the modifications that
may have been done to the register set by the tracer wouldn't
necessarily take effect.

Fix it by forcing IRET path by setting TIF_NOTIFY_RESUME from
arch_ptrace_stop_needed() which is invoked from ptrace_stop().

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Andy Lutomirski <luto@amacapital.net>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[wt: fixes CVE-2014-4699]
Signed-off-by: Willy Tarreau <w@1wt.eu>
arch/x86/include/asm/ptrace.h
include/linux/ptrace.h