LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Andi Kleen <ak@suse.de>
To: Jeff Dike <jdike@addtoit.com>, Andi Kleen <ak@suse.de>,
	patches@x86-64.org, linux-kernel@vger.kernel.org
Subject: [PATCH x86 for review III] [12/29] x86_64: 32-bit ptrace mangles sixth system call argument
Date: Mon, 12 Feb 2007 17:51:32 +0100 (CET)	[thread overview]
Message-ID: <20070212165132.6518713F45@wotan.suse.de> (raw)
In-Reply-To: <20070212551.664370000@suse.de>


From: Jeff Dike <jdike@addtoit.com>

The 32-bit sysenter entry point mangles the sixth system call argument for
both 32-bit and 64-bit ptrace.  In both cases, strace shows the frame
pointer (ebp) as the sixth argument.

Here's a snippet of a 64-bit strace of a 32-bit test program which
calls mmap through sysenter:

mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0xfff00fcc) = 0xfffffffff7f7a000
fstat64(0x1, 0xfff008d8)                = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0xfff0089c) = 0xfffffffff7f79000
write(1, "mmap returns 0xf7f7a000\n", 24mmap returns 0xf7f7a000
) = 24

Here's a 32-bit strace of the same program:

mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0xffc224ec) = 0xf7fcb000
fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 1), ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0xffc21dbc) = 0xf7fca000
write(1, "mmap returns 0xf7fcb000\n", 24mmap returns 0xf7fcb000
) = 24

The first mmap is the one made by the test - its final argument (the
offset) is 0, but strace shows 0xfff00fcc, which is the value of ebp.
The second is a guilty bystander which is also showing the bug.

The patch below copies %r9 (where the sixth argument has been
stashed) into the RBP slot of pt_regs before syscall_trace_enter is
called.  This fixes ptrace.

To allow a successful return to userspace, the original value of rbp
must be restored.  This is done by storing the current value of rbp
into the RBP slot of pt_regs before the RESTORE_REST.

With this patch, the straces now look like this:

64-bit:

mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xfffffffff7f5a000
fstat64(0x1, 0xff926ee8)                = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xfffffffff7f59000
write(1, "mmap returns 0xf7f5a000\n", 24mmap returns 0xf7f5a000
) = 24

32-bit:

mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xf7fa9000
fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 1), ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xf7fa8000
write(1, "mmap returns 0xf7fa9000\n", 24mmap returns 0xf7fa9000
) = 24

Signed-off-by: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Andi Kleen <ak@suse.de>
Cc: Andi Kleen <ak@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 arch/x86_64/ia32/ia32entry.S |   12 ++++++++++++
 1 file changed, 12 insertions(+)

Index: linux/arch/x86_64/ia32/ia32entry.S
===================================================================
--- linux.orig/arch/x86_64/ia32/ia32entry.S
+++ linux/arch/x86_64/ia32/ia32entry.S
@@ -148,11 +148,23 @@ sysenter_do_call:	
 sysenter_tracesys:
 	CFI_RESTORE_STATE
 	SAVE_REST
+	/*
+	 * We need the 6th system call argument to be in regs->rbp at
+	 * this point so that ptrace will see it.  It's in r9 now, so copy
+	 * it to the rbp slot now.
+	 */
+	movq	%r9, RBP(%rsp)
 	CLEAR_RREGS
 	movq	$-ENOSYS,RAX(%rsp)	/* really needed? */
 	movq	%rsp,%rdi        /* &pt_regs -> arg1 */
 	call	syscall_trace_enter
 	LOAD_ARGS ARGOFFSET  /* reload args from stack in case ptrace changed it */
+	/*
+	 * Now, we need the correct value of rbp to be restored.  It
+	 * was never munged, so we can save it to the rbp slot and
+	 * just have it restored.
+	 */
+	movq	%rbp, RBP(%rsp)
 	RESTORE_REST
 	movl	%ebp, %ebp
 	/* no need to do an access_ok check here because rbp has been

  parent reply	other threads:[~2007-02-12 17:00 UTC|newest]

Thread overview: 43+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2007-02-12 16:51 [PATCH x86 for review III] [1/29] i386: avoid gcc extension Andi Kleen
2007-02-12 16:51 ` [PATCH x86 for review III] [2/29] i386: support Classic MediaGXm Andi Kleen
2007-02-12 16:51 ` [PATCH x86 for review III] [3/29] i386: entry.S END/ENDPROC annotations Andi Kleen
2007-02-12 16:51 ` [PATCH x86 for review III] [4/29] x86_64: clean up sparsemem memory_present call Andi Kleen
2007-02-12 16:51 ` [PATCH x86 for review III] [5/29] i386: arch/i386/kernel/alternative.c should #include <asm/bugs.h> Andi Kleen
2007-02-12 16:51 ` [PATCH x86 for review III] [6/29] i386: Remove unused kernel config option X86_XADD Andi Kleen
2007-02-12 16:51 ` [PATCH x86 for review III] [7/29] x86_64: update IO-APIC dest field to 8-bit for xAPIC Andi Kleen
2007-02-12 19:49   ` Eric W. Biederman
2007-02-12 16:51 ` [PATCH x86 for review III] [8/29] x86_64: avoid warning message livelock Andi Kleen
2007-02-12 16:51 ` [PATCH x86 for review III] [9/29] x86_64: Minor patch for compilation warning in x86_64 signal code Andi Kleen
2007-02-12 16:51 ` [PATCH x86 for review III] [10/29] i386: don't include bugs.h Andi Kleen
2007-02-12 17:35   ` Jörn Engel
2007-02-12 18:33     ` Andi Kleen
2007-02-12 16:51 ` [PATCH x86 for review III] [11/29] i386: add option to show more code in oops reports Andi Kleen
2007-02-12 16:51 ` Andi Kleen [this message]
2007-02-12 22:04   ` [PATCH x86 for review III] [12/29] x86_64: 32-bit ptrace mangles sixth system call argument Chuck Ebbert
2007-02-12 22:26     ` Andi Kleen
2007-02-14 17:52     ` Jeff Dike
2007-02-12 16:51 ` [PATCH x86 for review III] [13/29] i386: geode configuration fixes Andi Kleen
2007-02-12 16:51 ` [PATCH x86 for review III] [15/29] x86_64: Fix wrong gcc check in bitops.h Andi Kleen
2007-02-12 16:51 ` [PATCH x86 for review III] [16/29] i386: Remove fastcall in paravirt.[ch] Andi Kleen
2007-02-12 16:51 ` [PATCH x86 for review III] [17/29] x86: Add new CPUID bits for AMD Family 10 CPUs in /proc/cpuinfo Andi Kleen
2007-02-12 22:11   ` Chuck Ebbert
2007-02-12 22:23     ` Andi Kleen
2007-02-12 22:37       ` Chuck Ebbert
2007-02-12 22:38         ` Andi Kleen
2007-02-12 23:04           ` Chuck Ebbert
2007-02-12 16:51 ` [PATCH x86 for review III] [18/29] i386: Add L3 cache support to AMD CPUID4 emulation Andi Kleen
2007-02-12 16:51 ` [PATCH x86 for review III] [19/29] x86: Enable NMI watchdog for AMD Family 0x10 CPUs Andi Kleen
2007-02-12 16:51 ` [PATCH x86 for review III] [20/29] i386: Fix warning in microcode.c Andi Kleen
2007-02-12 16:51 ` [PATCH x86 for review III] [21/29] i386: Fix warning in cpu initialization Andi Kleen
2007-02-12 16:51 ` [PATCH x86 for review III] [23/29] x86: Don't require the vDSO for handling a.out signals Andi Kleen
2007-02-12 16:51 ` [PATCH x86 for review III] [24/29] x86_64: -mm merge plans for 2.6.21 Andi Kleen
2007-02-12 16:51 ` [PATCH x86 for review III] [25/29] i386: paravirt unhandled fallthrough Andi Kleen
2007-02-12 16:51 ` [PATCH x86 for review III] [26/29] i386: Move mce_disabled to asm/mce.h Andi Kleen
2007-02-12 16:51 ` [PATCH x86 for review III] [27/29] i386: Rename cpu_gdt_descr and remove extern declaration from smpboot.c Andi Kleen
2007-02-12 16:51 ` [PATCH x86 for review III] [28/29] i386: Remove extern declaration from mm/discontig.c, put in header Andi Kleen
2007-02-12 16:51 ` [PATCH x86 for review III] [29/29] x86: Unify pcspeaker platform device code between i386/x86-64 Andi Kleen
2007-02-12 19:43 ` [PATCH x86 for review III] [1/29] i386: avoid gcc extension Jochen Voß
2007-02-12 20:18   ` Randy Dunlap
2007-02-13 15:11 ` Arnd Bergmann
2007-02-13 16:10   ` Randy Dunlap
2007-02-13 16:52     ` Andi Kleen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20070212165132.6518713F45@wotan.suse.de \
    --to=ak@suse.de \
    --cc=jdike@addtoit.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=patches@x86-64.org \
    --subject='Re: [PATCH x86 for review III] [12/29] x86_64: 32-bit ptrace mangles sixth system call argument' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).