.35 patches

diff --git a/queue-2.6.35/series b/queue-2.6.35/series
index 5f9eff72217e9b2bdf459e86da7d2bae849b6af2..b31acd168d8ff2dfafcd1b38f2b094df5be599c3 100644 (file)
--- a/queue-2.6.35/series
+++ b/queue-2.6.35/series
@@ -100,3 +100,4 @@ rdma-cxgb3-don-t-exceed-the-max-hw-cq-depth.patch
 x86-tsc-fix-a-preemption-leak-in-restore_sched_clock_state.patch
 x86-64-compat-test-rax-for-the-syscall-number-not-eax.patch
 compat-make-compat_alloc_user_space-incorporate-the-access_ok.patch
+x86-64-compat-retruncate-rax-after-ia32-syscall-entry-tracing.patch

diff --git a/queue-2.6.35/x86-64-compat-retruncate-rax-after-ia32-syscall-entry-tracing.patch b/queue-2.6.35/x86-64-compat-retruncate-rax-after-ia32-syscall-entry-tracing.patch
new file mode 100644 (file)
index 0000000..f00ba7e
--- /dev/null
+++ b/queue-2.6.35/x86-64-compat-retruncate-rax-after-ia32-syscall-entry-tracing.patch
@@ -0,0 +1,50 @@
+From eefdca043e8391dcd719711716492063030b55ac Mon Sep 17 00:00:00 2001
+From: Roland McGrath <roland@redhat.com>
+Date: Tue, 14 Sep 2010 12:22:58 -0700
+Subject: x86-64, compat: Retruncate rax after ia32 syscall entry tracing
+
+From: Roland McGrath <roland@redhat.com>
+
+commit eefdca043e8391dcd719711716492063030b55ac upstream.
+
+In commit d4d6715, we reopened an old hole for a 64-bit ptracer touching a
+32-bit tracee in system call entry.  A %rax value set via ptrace at the
+entry tracing stop gets used whole as a 32-bit syscall number, while we
+only check the low 32 bits for validity.
+
+Fix it by truncating %rax back to 32 bits after syscall_trace_enter,
+in addition to testing the full 64 bits as has already been added.
+
+Reported-by: Ben Hawkes <hawkes@sota.gen.nz>
+Signed-off-by: Roland McGrath <roland@redhat.com>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/ia32/ia32entry.S |    8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/ia32/ia32entry.S
++++ b/arch/x86/ia32/ia32entry.S
+@@ -50,7 +50,12 @@
+       /*
+        * Reload arg registers from stack in case ptrace changed them.
+        * We don't reload %eax because syscall_trace_enter() returned
+-       * the value it wants us to use in the table lookup.
++       * the %rax value we should see.  Instead, we just truncate that
++       * value to 32 bits again as we did on entry from user mode.
++       * If it's a new value set by user_regset during entry tracing,
++       * this matches the normal truncation of the user-mode value.
++       * If it's -1 to make us punt the syscall, then (u32)-1 is still
++       * an appropriately invalid value.
+        */
+       .macro LOAD_ARGS32 offset, _r9=0
+       .if \_r9
+@@ -60,6 +65,7 @@
+       movl \offset+48(%rsp),%edx
+       movl \offset+56(%rsp),%esi
+       movl \offset+64(%rsp),%edi
++      movl %eax,%eax                  /* zero extension */
+       .endm
+       
+       .macro CFI_STARTPROC32 simple