From: Oleg Nesterov <oleg@redhat.com>
To: Andrew Morton <akpm@linux-foundation.org>,
Andy Lutomirski <luto@kernel.org>,
Linus Torvalds <torvalds@linux-foundation.org>
Cc: Denys Vlasenko <dvlasenk@redhat.com>,
"H. Peter Anvin" <hpa@zytor.com>, Ingo Molnar <mingo@redhat.com>,
Jan Kratochvil <jan.kratochvil@redhat.com>,
Pedro Alves <palves@redhat.com>,
Thomas Gleixner <tglx@linutronix.de>,
x86@kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH 1/1] get_nr_restart_syscall() should return __NR_ia32_restart_syscall if __USER32_CS
Date: Tue, 28 Mar 2017 16:54:32 +0200 [thread overview]
Message-ID: <20170328145432.GA3163@redhat.com> (raw)
In-Reply-To: <20170328145413.GA3164@redhat.com>
get_nr_restart_syscall() checks TS_I386_REGS_POKED but this bit is only
set if debugger is 32-bit. If a 64-bit debugger restores the registers
of a 32-bit debugee outside of syscall exit path get_nr_restart_syscall()
wrongly returns __NR_restart_syscall.
Test-case:
$ cvs -d :pserver:anoncvs:anoncvs@sourceware.org:/cvs/systemtap co ptrace-tests
$ gcc -o erestartsys-trap-debuggee ptrace-tests/tests/erestartsys-trap-debuggee.c --m32
$ gcc -o erestartsys-trap-debugger ptrace-tests/tests/erestartsys-trap-debugger.c -lutil
$ ./erestartsys-trap-debugger
Unexpected: retval 1, errno 22
erestartsys-trap-debugger: ptrace-tests/tests/erestartsys-trap-debugger.c:421
As Jan explains this is what "(gdb) call func()" actually does:
* Tracee calls sleep(2).
* Debugger interrupts the tracee by CTRL-C after 1 sec.
* Save regs by PTRACE_GETREGS.
* Use PTRACE_SETREGS changing %rip to some 'func' and setting %orig_rax=-1
* PTRACE_CONT
* func() uses int3.
* Debugger catches SIGTRAP.
* Restore original regs by PTRACE_SETREGS.
* PTRACE_CONT
Change get_nr_restart_syscall() to take __USER32_CS into account, to me
this looks a bit better than TIF_IA32 check but either way this logic
can't be always right as the comment explains.
Alternatively we could change putreg() to set TS_I386_REGS_POKED just like
putreg32() does if "child" is 32-bit, but this won't fix all the problems
too and I think it would be beter to kill TS_I386_REGS_POKED after this
change.
Reported-by: Jan Kratochvil <jan.kratochvil@redhat.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Cc: stable@vger.kernel.org
---
arch/x86/kernel/signal.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
index 763af1d..1b05448 100644
--- a/arch/x86/kernel/signal.c
+++ b/arch/x86/kernel/signal.c
@@ -785,7 +785,8 @@ static inline unsigned long get_nr_restart_syscall(const struct pt_regs *regs)
* than the tracee.
*/
#ifdef CONFIG_IA32_EMULATION
- if (current->thread.status & (TS_COMPAT|TS_I386_REGS_POKED))
+ if ((current->thread.status & (TS_COMPAT|TS_I386_REGS_POKED)) ||
+ regs->cs == __USER32_CS)
return __NR_ia32_restart_syscall;
#endif
#ifdef CONFIG_X86_X32_ABI
--
2.5.0
next prev parent reply other threads:[~2017-03-28 14:55 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-03-28 14:54 [PATCH 0/1] get_nr_restart_syscall() should return __NR_ia32_restart_syscall if __USER32_CS Oleg Nesterov
2017-03-28 14:54 ` Oleg Nesterov [this message]
2017-03-28 15:03 ` [PATCH 1/1] " Andy Lutomirski
2017-03-28 16:27 ` Oleg Nesterov
2017-03-28 17:10 ` Andy Lutomirski
2017-03-29 15:05 ` Oleg Nesterov
2017-03-29 16:59 ` Andy Lutomirski
2017-03-30 15:28 ` Oleg Nesterov
2017-03-30 18:36 ` Andy Lutomirski
2017-03-29 16:33 ` syscall_get_error() && TS_ checks Oleg Nesterov
2017-03-29 16:45 ` Linus Torvalds
2017-03-29 16:55 ` Oleg Nesterov
2017-03-29 16:59 ` Linus Torvalds
2017-03-29 17:04 ` Oleg Nesterov
2017-03-29 17:16 ` Linus Torvalds
2017-03-29 18:50 ` Oleg Nesterov
2017-03-29 18:56 ` Linus Torvalds
2017-03-30 13:51 ` Oleg Nesterov
2017-03-30 15:49 ` Oleg Nesterov
2017-03-30 17:46 ` Linus Torvalds
2017-03-30 18:23 ` Andy Lutomirski
2017-03-30 18:35 ` Linus Torvalds
2017-03-30 18:59 ` Andy Lutomirski
2017-03-30 19:11 ` Linus Torvalds
2017-03-30 19:21 ` Andy Lutomirski
2017-03-30 19:29 ` Linus Torvalds
2017-03-29 16:56 ` Andy Lutomirski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170328145432.GA3163@redhat.com \
--to=oleg@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=dvlasenk@redhat.com \
--cc=hpa@zytor.com \
--cc=jan.kratochvil@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=palves@redhat.com \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox