linux/arch/parisc/kernel
Helge Deller ed79b86d8a parisc: fix bug in compat_arch_ptrace
Commit 81e192d6ce ("parisc: convert to
generic compat_sys_ptrace") introduced a bug which segfaults the parisc
64bit kernel when stracing 32bit applications:

  Kernel Fault: Code=15 regs=00000000bafa42b0 (Addr=00000001baf5ab57)
       YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI
  PSW: 00001000000001101111111100001011 Tainted: G        W
  r00-03  000000ff0806ff0b 000000004068edc0 00000000401203f8 00000000fb3e2508
  r04-07  0000000040686dc0 00000000baf5a800 fffffffffffffffc fffffffffb3e2508
  r08-11  00000000baf5a800 000000000004b068 00000000000402b0 0000000000040d68
  r12-15  0000000000042a9c 0000000000040a9c 0000000000040d60 0000000000042e9c
  r16-19  000000000004b060 000000000004b058 0000000000042d9c ffffffffffffffff
  r20-23  000000000800000b 0000000000000000 000000000800000b fffffffffb3e2508
  r24-27  00000000fffffffc 0000000000000003 00000000fffffffc 0000000040686dc0
  r28-31  00000001baf5a7ff 00000000bafa4280 00000000bafa42b0 00000000000001d7
  sr00-03  0000000000fca000 0000000000000000 0000000000000000 0000000000fca000
  sr04-07  0000000000000000 0000000000000000 0000000000000000 0000000000000000

  IASQ: 0000000000000000 0000000000000000 IAOQ: 0000000040120400 0000000040120404
   IIR: 4b9a06b0    ISR: 0000000000000000  IOR: 00000001baf5ab57
   CPU:        0   CR30: 00000000bafa4000 CR31: 00000000d22344e0
   ORIG_R28: 00000000fb3e2248
   IAOQ[0]: compat_arch_ptrace+0xb8/0x160
   IAOQ[1]: compat_arch_ptrace+0xbc/0x160
   RP(r2): compat_arch_ptrace+0xb0/0x160
  Backtrace:
   [<00000000401612ac>] compat_sys_ptrace+0x15c/0x180
   [<0000000040104ef8>] syscall_exit+0x0/0x14

The problem is that compat_arch_ptrace() enters with an addr value of
type compat_ulong_t and calls translate_usr_offset() to translate the
address offset into a struct pt_regs offset like this:

	addr = translate_usr_offset(addr)

this means that any return value of translate_usr_offset() is stored
back as compat_ulong_t type into the addr variable.

But since translate_usr_offset() returns -1 for invalid offsets, addr
can now get the value 0xffffffff which then fails the next return-value
sanity check and thus the kernel tries to access invalid memory:

	if (addr < 0)
		break;

Fix this bug by modifying translate_usr_offset() to take and return
values of type compat_ulong_t, and by returning the value
"sizeof(struct pt_regs)" as an error indicator.

Additionally change the sanity check to check for return values
for >= sizeof(struct pt_regs).

This patch survived my compile and run-tests.

Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-11-20 13:09:17 -08:00
..
.gitignore parisc: add arch/parisc/kernel/.gitignore 2008-10-10 16:32:28 +00:00
Makefile parisc: remove -traditional from assembler flags 2008-05-15 11:03:45 -04:00
asm-offsets.c parisc: move pdc_result to real2.S 2008-10-10 16:32:28 +00:00
binfmt_elf32.c [PATCH] remove unused ibcs2/PER_SVR4 in SET_PERSONALITY 2008-10-16 15:40:05 +02:00
cache.c on_each_cpu(): kill unused 'retry' parameter 2008-06-26 11:24:38 +02:00
drivers.c [PARISC] display parisc device modalias in sysfs 2007-02-17 01:08:09 -05:00
entry.S Revert "parisc: fix trivial section name warnings" 2008-06-13 10:49:45 -04:00
firmware.c parisc: add pdc_coproc_cfg_unlocked and set_firmware_width_unlocked 2008-10-10 16:32:29 +00:00
hardware.c [PARISC] add back Crestone Peak cpu 2008-03-15 19:12:19 -07:00
head.S parisc: hijack jump to start_kernel 2008-10-10 16:32:30 +00:00
hpmc.S Revert "parisc: fix trivial section name warnings" 2008-06-13 10:49:45 -04:00
init_task.c [PATCH] take init_files to fs/file.c 2008-05-16 17:22:20 -04:00
inventory.c parisc: replace remaining __FUNCTION__ occurrences 2008-05-15 10:38:54 -04:00
irq.c [PARISC] timer interrupt should not be IRQ_DISABLED 2007-12-06 09:16:45 -08:00
module.c lib: Correct printk %pF to work on all architectures 2008-09-09 11:51:15 -07:00
pa7300lc.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
pacache.S Revert "parisc: fix trivial section name warnings" 2008-06-13 10:49:45 -04:00
parisc_ksyms.c parisc: export copy_user_page_asm 2008-06-13 10:49:50 -04:00
pci-dma.c parisc: use non-racy method for /proc/pcxl_dma creation 2008-04-29 08:06:21 -07:00
pci.c PCI: parisc: use generic pci_enable_resources() 2008-04-20 21:47:06 -07:00
pdc_chassis.c [PARISC] Work around machines which do not support chassis warnings 2006-06-27 23:28:37 +00:00
pdc_cons.c [PARISC] pdc_console: fix bizarre panic on boot 2008-03-15 19:12:03 -07:00
perf.c parisc-kernel-perf: BKL pushdown 2008-07-02 15:06:24 -06:00
perf_asm.S Revert "parisc: fix trivial section name warnings" 2008-06-13 10:49:45 -04:00
perf_images.h [PARISC] Use kzalloc and other janitor-style cleanups 2006-01-22 20:26:31 -05:00
process.c Remove fs.h from mm.h 2007-07-29 17:09:29 -07:00
processor.c [PARISC] Unbreak processor_probe when we have more than NR_CPUS 2007-10-18 00:58:57 -07:00
ptrace.c parisc: fix bug in compat_arch_ptrace 2008-11-20 13:09:17 -08:00
real2.S parisc: move pdc_result to real2.S 2008-10-10 16:32:28 +00:00
setup.c parisc: initialize unwinder much earlier 2008-10-10 16:32:30 +00:00
signal.c [PARISC] fix signal trampoline cache flushing 2008-04-15 15:51:36 -07:00
signal32.c parisc: fix off by one in setup_sigcontext32 2008-06-13 10:49:55 -04:00
signal32.h [PARISC] spelling fixes: arch/parisc/ 2007-05-22 22:52:16 -04:00
smp.c on_each_cpu(): kill unused 'retry' parameter 2008-06-26 11:24:38 +02:00
sys32.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
sys_parisc.c unified (weak) sys_pipe implementation 2008-05-03 13:50:33 -07:00
sys_parisc32.c compat: generic compat get/settimeofday 2008-10-16 11:21:33 -07:00
syscall.S Revert "parisc: fix trivial section name warnings" 2008-06-13 10:49:45 -04:00
syscall_table.S Merge git://git.kernel.org/pub/scm/linux/kernel/git/kyle/parisc-2.6 2008-10-20 14:40:31 -07:00
time.c parisc: add rtc platform driver 2008-10-10 16:32:30 +00:00
topology.c Replace remaining references to "driverfs" with "sysfs". 2007-02-17 19:13:42 +01:00
traps.c parisc: replace remaining __FUNCTION__ occurrences 2008-05-15 10:38:54 -04:00
unaligned.c arch/parisc/kernel/unaligned.c: use time_* macros 2008-05-15 10:38:54 -04:00
unwind.c parisc: initialize unwinder much earlier 2008-10-10 16:32:30 +00:00
vmlinux.lds.S Merge branch 'linus' into core/rodata 2008-06-16 11:24:00 +02:00