From: Greg Kroah-Hartman Date: Wed, 15 Sep 2010 23:05:21 +0000 (-0700) Subject: .32 patches X-Git-Tag: v2.6.27.54~20 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=33da4c9e802ffdb862e25b63e1f48a29b37bc13b;p=thirdparty%2Fkernel%2Fstable-queue.git .32 patches --- diff --git a/queue-2.6.32/series b/queue-2.6.32/series index 50c4695a120..eed3181697b 100644 --- a/queue-2.6.32/series +++ b/queue-2.6.32/series @@ -61,3 +61,4 @@ wireless-extensions-fix-kernel-heap-content-leak.patch x86-tsc-fix-a-preemption-leak-in-restore_sched_clock_state.patch x86-64-compat-test-rax-for-the-syscall-number-not-eax.patch compat-make-compat_alloc_user_space-incorporate-the-access_ok.patch +x86-64-compat-retruncate-rax-after-ia32-syscall-entry-tracing.patch diff --git a/queue-2.6.32/x86-64-compat-retruncate-rax-after-ia32-syscall-entry-tracing.patch b/queue-2.6.32/x86-64-compat-retruncate-rax-after-ia32-syscall-entry-tracing.patch new file mode 100644 index 00000000000..f00ba7e9e02 --- /dev/null +++ b/queue-2.6.32/x86-64-compat-retruncate-rax-after-ia32-syscall-entry-tracing.patch @@ -0,0 +1,50 @@ +From eefdca043e8391dcd719711716492063030b55ac Mon Sep 17 00:00:00 2001 +From: Roland McGrath +Date: Tue, 14 Sep 2010 12:22:58 -0700 +Subject: x86-64, compat: Retruncate rax after ia32 syscall entry tracing + +From: Roland McGrath + +commit eefdca043e8391dcd719711716492063030b55ac upstream. + +In commit d4d6715, we reopened an old hole for a 64-bit ptracer touching a +32-bit tracee in system call entry. A %rax value set via ptrace at the +entry tracing stop gets used whole as a 32-bit syscall number, while we +only check the low 32 bits for validity. + +Fix it by truncating %rax back to 32 bits after syscall_trace_enter, +in addition to testing the full 64 bits as has already been added. + +Reported-by: Ben Hawkes +Signed-off-by: Roland McGrath +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/ia32/ia32entry.S | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/arch/x86/ia32/ia32entry.S ++++ b/arch/x86/ia32/ia32entry.S +@@ -50,7 +50,12 @@ + /* + * Reload arg registers from stack in case ptrace changed them. + * We don't reload %eax because syscall_trace_enter() returned +- * the value it wants us to use in the table lookup. ++ * the %rax value we should see. Instead, we just truncate that ++ * value to 32 bits again as we did on entry from user mode. ++ * If it's a new value set by user_regset during entry tracing, ++ * this matches the normal truncation of the user-mode value. ++ * If it's -1 to make us punt the syscall, then (u32)-1 is still ++ * an appropriately invalid value. + */ + .macro LOAD_ARGS32 offset, _r9=0 + .if \_r9 +@@ -60,6 +65,7 @@ + movl \offset+48(%rsp),%edx + movl \offset+56(%rsp),%esi + movl \offset+64(%rsp),%edi ++ movl %eax,%eax /* zero extension */ + .endm + + .macro CFI_STARTPROC32 simple