From patchwork Tue Jan 19 15:08:49 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Helge Deller X-Patchwork-Id: 8063301 Return-Path: X-Original-To: patchwork-linux-parisc@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id CF0E59F744 for ; Tue, 19 Jan 2016 15:09:26 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id E7EEF2051F for ; Tue, 19 Jan 2016 15:09:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0A5622052D for ; Tue, 19 Jan 2016 15:09:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754328AbcASPJK (ORCPT ); Tue, 19 Jan 2016 10:09:10 -0500 Received: from mout.gmx.net ([212.227.15.18]:49894 "EHLO mout.gmx.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754297AbcASPJH (ORCPT ); Tue, 19 Jan 2016 10:09:07 -0500 Received: from p100.box ([92.203.36.96]) by mail.gmx.com (mrgmx001) with ESMTPSA (Nemesis) id 0MGj8j-1aQEk92BXN-00DUm3; Tue, 19 Jan 2016 16:08:52 +0100 Date: Tue, 19 Jan 2016 16:08:49 +0100 From: Helge Deller To: linux-parisc@vger.kernel.org, James Bottomley , John David Anglin Cc: Mike Frysinger Subject: [PATCH] parisc: Fix ptrace: syscall number and return value modification Message-ID: <20160119150849.GA22546@p100.box> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.23 (2014-03-12) X-Provags-ID: V03:K0:1SluY+e4hJyJdAXspo/LgDXmsTwfOF7iU0gfcBzZbMMFjnhAeCJ TNBJuJwjvycjFNyy+WjEqlF3TQqATFv9POQpl+UeOnthzgdiFZx1pomomt0cgKrxPv6WNZR ggKBh/4n318PDB1PY8zjOy//MwajusqgtTHaSZp7OmTiEHTrYxgZrb04N33mimmd0uyq+M3 /oP46rTkZ69pFuiUUmMlg== X-UI-Out-Filterresults: notjunk:1; V01:K0:skyr7URckW8=:8LPH2lE5boQZZik6sVZ1Aq 6klEduAswdgGGb4TRAJeiyFX3R6vE+tTeZAtSVRvgkwZcqNjQIPZeY5scZ9T/YuYkBBVKYwq2 YE/aDew8elKGOrmEThDbi04gc5gsehb4Nv3ExxU3EnSPPXaPsYa8ntUadvxVFhxN3eTjQ50b9 uqbwi9qos7zWG6P6wp+LlUPi1b7DOIofJsOxI/+b28sw0X4JMI+pHi+YXunfwGtWMBVRIWHKB e/0hN8whzpnDkUVZqQsDQQSM1plEU4S7M6/KBB/bOC7OYQ2UMkQNkSLrbpztotPLtarz7sy5u VsRokuStFIL/n083G/rlkjrRkkzrGVi5Gjb6t20N+g9J8q/xxCbsImI4xEW7cZWSa0TVstaQW 88dtivU1IILJHqZsPdPpHSp0mPvtHQVawGRWAsneasn2rAzhXXkzr1csVv7BAukPA16s1o0Uc 0WFWrDPGD9zbnY7RgYVN5jmtm7eSiQQ4vHYqnYb/jVF3GnAzKJO3gd4QzVaZLnxJ8om0CY79t YsEOt0K26UTn6sjpyvwI9tSITi0pv9vhCAZ59QtHDX9NRQTlLSny4HJ4ZWpoUgQpqHa6wJC2b /MIfqM9WYZYo5MU72NhRvIE/dBxvbqWqK1PncEtt7G/9Jd66Pk1vqKMcRSPAddadkY6/W39Se cP1z0rAgxyhSbLGIUesFlVl4lEg68H/+28Rxpv8uLApoiw9GIlO7aoJ17M/PFHHEZGXXkDb6p V9A/nEs36RmIGPdSenwq9EMcu9o832x562qKIS3pXXpQ1XJO+aHgIjUMzNQ= Sender: linux-parisc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-parisc@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Mike Frysinger reported that his ptrace testcase showed strange behaviour on parisc: It was not possible to avoid a syscall and the return value of a syscall couldn't be changed. To modify a syscall number, we were missing to save the new syscall number to gr20 which is then picked up later in assembly again. The effect that the return value couldn't be changed is a side-effect of another bug in the assembly code. When a process is ptraced, userspace expects each syscall to report entrance and exit of a syscall. If a syscall number was given which doesn't exist, we jumped to the normal syscall exit code instead of informing userspace that the (non-existant) syscall exits. This unexpected behaviour confuses userspace and thus the bug was misinterpreted as if we can't change the return value. This patch fixes both problems and was tested on 64bit kernel with 32bit userspace. Signed-off-by: Helge Deller Cc: Mike Frysinger Cc: Tested-by: Mike Frysinger --- To unsubscribe from this list: send the line "unsubscribe linux-parisc" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c index 9585c81..ce0b2b4 100644 --- a/arch/parisc/kernel/ptrace.c +++ b/arch/parisc/kernel/ptrace.c @@ -269,14 +269,19 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request, long do_syscall_trace_enter(struct pt_regs *regs) { - long ret = 0; - /* Do the secure computing check first. */ secure_computing_strict(regs->gr[20]); if (test_thread_flag(TIF_SYSCALL_TRACE) && - tracehook_report_syscall_entry(regs)) - ret = -1L; + tracehook_report_syscall_entry(regs)) { + /* + * Tracing decided this syscall should not happen or the + * debugger stored an invalid system call number. Skip + * the system call and the system call restart handling. + */ + regs->gr[20] = -1UL; + goto out; + } #ifdef CONFIG_64BIT if (!is_compat_task()) @@ -290,7 +295,8 @@ long do_syscall_trace_enter(struct pt_regs *regs) regs->gr[24] & 0xffffffff, regs->gr[23] & 0xffffffff); - return ret ? : regs->gr[20]; +out: + return regs->gr[20]; } void do_syscall_trace_exit(struct pt_regs *regs) diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S index 3fbd725..fbafa0d 100644 --- a/arch/parisc/kernel/syscall.S +++ b/arch/parisc/kernel/syscall.S @@ -343,7 +343,7 @@ tracesys_next: #endif comiclr,>>= __NR_Linux_syscalls, %r20, %r0 - b,n .Lsyscall_nosys + b,n .Ltracesys_nosys LDREGX %r20(%r19), %r19 @@ -359,6 +359,9 @@ tracesys_next: be 0(%sr7,%r19) ldo R%tracesys_exit(%r2),%r2 +.Ltracesys_nosys: + ldo -ENOSYS(%r0),%r28 /* set errno */ + /* Do *not* call this function on the gateway page, because it makes a direct call to syscall_trace. */