From eefdca043e8391dcd719711716492063030b55ac Mon Sep 17 00:00:00 2001

From: Roland McGrath <roland@redhat.com>

Date: Tue, 14 Sep 2010 12:22:58 -0700

Subject: [PATCH] x86-64, compat: Retruncate rax after ia32 syscall entry tracing

In commit d4d6715, we reopened an old hole for a 64-bit ptracer touching a

32-bit tracee in system call entry.  A %rax value set via ptrace at the

entry tracing stop gets used whole as a 32-bit syscall number, while we

only check the low 32 bits for validity.

Fix it by truncating %rax back to 32 bits after syscall_trace_enter,

in addition to testing the full 64 bits as has already been added.

Reported-by: Ben Hawkes <hawkes@sota.gen.nz>

Signed-off-by: Roland McGrath <roland@redhat.com>

Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>

---

 arch/x86/ia32/ia32entry.S |    8 +++++++-

 1 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S

index 84e3a4e..518bb99 100644

--- a/arch/x86/ia32/ia32entry.S

+++ b/arch/x86/ia32/ia32entry.S

@@ -50,7 +50,12 @@

 	/*

 	 * Reload arg registers from stack in case ptrace changed them.

 	 * We don't reload %eax because syscall_trace_enter() returned

-	 * the value it wants us to use in the table lookup.

+	 * the %rax value we should see.  Instead, we just truncate that

+	 * value to 32 bits again as we did on entry from user mode.

+	 * If it's a new value set by user_regset during entry tracing,

+	 * this matches the normal truncation of the user-mode value.

+	 * If it's -1 to make us punt the syscall, then (u32)-1 is still

+	 * an appropriately invalid value.

 	 */

 	.macro LOAD_ARGS32 offset, _r9=0

 	.if \_r9

@@ -60,6 +65,7 @@

 	movl \offset+48(%rsp),%edx

 	movl \offset+56(%rsp),%esi

 	movl \offset+64(%rsp),%edi

+	movl %eax,%eax			/* zero extension */

 	.endm

 	.macro CFI_STARTPROC32 simple

-- 

1.7.2.3