public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Oleg Nesterov <oleg@redhat.com>
To: Andrew Morton <akpm@linux-foundation.org>,
	Andy Lutomirski <luto@kernel.org>,
	Linus Torvalds <torvalds@linux-foundation.org>
Cc: Denys Vlasenko <dvlasenk@redhat.com>,
	"H. Peter Anvin" <hpa@zytor.com>, Ingo Molnar <mingo@redhat.com>,
	Jan Kratochvil <jan.kratochvil@redhat.com>,
	Pedro Alves <palves@redhat.com>,
	Thomas Gleixner <tglx@linutronix.de>,
	x86@kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH 1/1] get_nr_restart_syscall() should return __NR_ia32_restart_syscall if __USER32_CS
Date: Tue, 28 Mar 2017 16:54:32 +0200	[thread overview]
Message-ID: <20170328145432.GA3163@redhat.com> (raw)
In-Reply-To: <20170328145413.GA3164@redhat.com>

get_nr_restart_syscall() checks TS_I386_REGS_POKED but this bit is only
set if debugger is 32-bit. If a 64-bit debugger restores the registers
of a 32-bit debugee outside of syscall exit path get_nr_restart_syscall()
wrongly returns __NR_restart_syscall.

Test-case:

  $ cvs -d :pserver:anoncvs:anoncvs@sourceware.org:/cvs/systemtap co ptrace-tests
  $ gcc -o erestartsys-trap-debuggee ptrace-tests/tests/erestartsys-trap-debuggee.c --m32
  $ gcc -o erestartsys-trap-debugger ptrace-tests/tests/erestartsys-trap-debugger.c -lutil
  $ ./erestartsys-trap-debugger
  Unexpected: retval 1, errno 22
  erestartsys-trap-debugger: ptrace-tests/tests/erestartsys-trap-debugger.c:421

As Jan explains this is what "(gdb) call func()" actually does:

	* Tracee calls sleep(2).
	* Debugger interrupts the tracee by CTRL-C after 1 sec.
	* Save regs by PTRACE_GETREGS.
	* Use PTRACE_SETREGS changing %rip to some 'func' and setting %orig_rax=-1
	* PTRACE_CONT
	* func() uses int3.
	* Debugger catches SIGTRAP.
	* Restore original regs by PTRACE_SETREGS.
	* PTRACE_CONT

Change get_nr_restart_syscall() to take __USER32_CS into account, to me
this looks a bit better than TIF_IA32 check but either way this logic
can't be always right as the comment explains.

Alternatively we could change putreg() to set TS_I386_REGS_POKED just like
putreg32() does if "child" is 32-bit, but this won't fix all the problems
too and I think it would be beter to kill TS_I386_REGS_POKED after this
change.

Reported-by: Jan Kratochvil <jan.kratochvil@redhat.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Cc: stable@vger.kernel.org
---
 arch/x86/kernel/signal.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
index 763af1d..1b05448 100644
--- a/arch/x86/kernel/signal.c
+++ b/arch/x86/kernel/signal.c
@@ -785,7 +785,8 @@ static inline unsigned long get_nr_restart_syscall(const struct pt_regs *regs)
 	 * than the tracee.
 	 */
 #ifdef CONFIG_IA32_EMULATION
-	if (current->thread.status & (TS_COMPAT|TS_I386_REGS_POKED))
+	if ((current->thread.status & (TS_COMPAT|TS_I386_REGS_POKED)) ||
+	    regs->cs == __USER32_CS)
 		return __NR_ia32_restart_syscall;
 #endif
 #ifdef CONFIG_X86_X32_ABI
-- 
2.5.0

  reply	other threads:[~2017-03-28 14:55 UTC|newest]

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-03-28 14:54 [PATCH 0/1] get_nr_restart_syscall() should return __NR_ia32_restart_syscall if __USER32_CS Oleg Nesterov
2017-03-28 14:54 ` Oleg Nesterov [this message]
2017-03-28 15:03   ` [PATCH 1/1] " Andy Lutomirski
2017-03-28 16:27     ` Oleg Nesterov
2017-03-28 17:10       ` Andy Lutomirski
2017-03-29 15:05       ` Oleg Nesterov
2017-03-29 16:59         ` Andy Lutomirski
2017-03-30 15:28           ` Oleg Nesterov
2017-03-30 18:36             ` Andy Lutomirski
2017-03-29 16:33 ` syscall_get_error() && TS_ checks Oleg Nesterov
2017-03-29 16:45   ` Linus Torvalds
2017-03-29 16:55     ` Oleg Nesterov
2017-03-29 16:59       ` Linus Torvalds
2017-03-29 17:04         ` Oleg Nesterov
2017-03-29 17:16           ` Linus Torvalds
2017-03-29 18:50             ` Oleg Nesterov
2017-03-29 18:56               ` Linus Torvalds
2017-03-30 13:51                 ` Oleg Nesterov
2017-03-30 15:49                   ` Oleg Nesterov
2017-03-30 17:46                     ` Linus Torvalds
2017-03-30 18:23                       ` Andy Lutomirski
2017-03-30 18:35                         ` Linus Torvalds
2017-03-30 18:59                           ` Andy Lutomirski
2017-03-30 19:11                             ` Linus Torvalds
2017-03-30 19:21                               ` Andy Lutomirski
2017-03-30 19:29                                 ` Linus Torvalds
2017-03-29 16:56     ` Andy Lutomirski

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170328145432.GA3163@redhat.com \
    --to=oleg@redhat.com \
    --cc=akpm@linux-foundation.org \
    --cc=dvlasenk@redhat.com \
    --cc=hpa@zytor.com \
    --cc=jan.kratochvil@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luto@kernel.org \
    --cc=mingo@redhat.com \
    --cc=palves@redhat.com \
    --cc=tglx@linutronix.de \
    --cc=torvalds@linux-foundation.org \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox