Re: [PATCH v2] ptrace: reject out of range error values in PTRACE_SET_SYSCALL_INFO

[Bradley Morgan <bradley.morgan@linux.dev>]

On 15 November 2026 08:25:39 GMT, Renzo Davoli <renzo@cs.unibo.it> wrote:
>With is_error set, PTRACE_SET_SYSCALL_INFO passes info.exit.rval to
>syscall_set_return_value() as an "int" error without checking it: a
>positive value, or on 64-bit one outside the "int" range, turns the
>error into a success or is truncated.
>
>Reject with -ERANGE any error value outside [-MAX_ERRNO, -1].
>
>Fixes: 26bb32768fe6 ("ptrace: introduce PTRACE_SET_SYSCALL_INFO request")

CC:stable?

Reviewed-by: Bradley Morgan <bradley.morgan@linux.dev>


>Signed-off-by: Renzo Davoli <renzo@cs.unibo.it>
>---
>v2: shorter commit message and comment, dropped Assisted-by (Bradley Morgan)
>v1: https://lore.kernel.org/lkml/20261114184842.373304-1-renzo@cs.unibo.it/
>
>Tested on x86_64: rval 0, 1, 3, -4096, INT_MIN and 0x100000000 with
>is_error set are now rejected with -ERANGE; -ESRCH and -4095 still work.

I don't know why ai does these kinds of sections tbf. I think testing is
like a basic requirement, like so basic that it wouldn't need to be added
as a section 

>
> kernel/ptrace.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
>diff --git a/kernel/ptrace.c b/kernel/ptrace.c
>index 3f2fe68ccb14..1ffacfcef8d4 100644
>--- a/kernel/ptrace.c
>+++ b/kernel/ptrace.c
>@@ -1111,6 +1111,10 @@ ptrace_set_syscall_info_exit(struct task_struct *child, struct pt_regs *regs,
> 	if (rval != info->exit.rval)
> 		return -ERANGE;
> 
>+	/* An error must be a negative errno value. */
>+	if (info->exit.is_error && (rval < -MAX_ERRNO || rval >= 0))
>+		return -ERANGE;
>+

please consider Renzos comment and add a test case.

> 	if (info->exit.is_error)
> 		syscall_set_return_value(child, regs, rval, 0);
> 	else
>
>base-commit: 7e1392a42ea288d70a266f6553fe06f57f8647ea
>

--- Thanks!