Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJeff Mahoney <jeffm@suse.de>2010-09-16 14:58:28 -0400
committerJeff Mahoney <jeffm@suse.de>2010-09-16 14:58:32 -0400
commite6266b98cbc58a9ffe49fb4a652557fd5ddfae0d (patch)
tree292bcbffaa605a41de73d67147382562674df886
parent664a0ac1d4264279ad3ed00d1beac8688c31f3b9 (diff)
- x86-64, compat: Retruncate rax after ia32 syscall entry tracing
(CVE-2010-3301 bnc#639708).
-rw-r--r--patches.fixes/x86-64-compat-retruncate-rax-after-ia32-syscall-entry-tracing53
-rw-r--r--series.conf1
2 files changed, 54 insertions, 0 deletions
diff --git a/patches.fixes/x86-64-compat-retruncate-rax-after-ia32-syscall-entry-tracing b/patches.fixes/x86-64-compat-retruncate-rax-after-ia32-syscall-entry-tracing
new file mode 100644
index 0000000000..6dd270f957
--- /dev/null
+++ b/patches.fixes/x86-64-compat-retruncate-rax-after-ia32-syscall-entry-tracing
@@ -0,0 +1,53 @@
+From: Roland McGrath <roland@redhat.com>
+Date: Tue, 14 Sep 2010 19:22:58 +0000 (-0700)
+Subject: x86-64, compat: Retruncate rax after ia32 syscall entry tracing
+Git-commit: eefdca043e8391dcd719711716492063030b55ac
+References: CVE-2010-3301 bnc#639708
+Patch-mainline: 2.6.36
+Introduced-by: 2.6.27
+
+x86-64, compat: Retruncate rax after ia32 syscall entry tracing
+
+In commit d4d6715, we reopened an old hole for a 64-bit ptracer touching a
+32-bit tracee in system call entry. A %rax value set via ptrace at the
+entry tracing stop gets used whole as a 32-bit syscall number, while we
+only check the low 32 bits for validity.
+
+Fix it by truncating %rax back to 32 bits after syscall_trace_enter,
+in addition to testing the full 64 bits as has already been added.
+
+Reported-by: Ben Hawkes <hawkes@sota.gen.nz>
+Signed-off-by: Roland McGrath <roland@redhat.com>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Acked-by: Jeff Mahoney <jeffm@suse.com>
+---
+
+ arch/x86/ia32/ia32entry.S | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
+index 84e3a4e..518bb99 100644
+--- a/arch/x86/ia32/ia32entry.S
++++ b/arch/x86/ia32/ia32entry.S
+@@ -50,7 +50,12 @@
+ /*
+ * Reload arg registers from stack in case ptrace changed them.
+ * We don't reload %eax because syscall_trace_enter() returned
+- * the value it wants us to use in the table lookup.
++ * the %rax value we should see. Instead, we just truncate that
++ * value to 32 bits again as we did on entry from user mode.
++ * If it's a new value set by user_regset during entry tracing,
++ * this matches the normal truncation of the user-mode value.
++ * If it's -1 to make us punt the syscall, then (u32)-1 is still
++ * an appropriately invalid value.
+ */
+ .macro LOAD_ARGS32 offset, _r9=0
+ .if \_r9
+@@ -60,6 +65,7 @@
+ movl \offset+48(%rsp),%edx
+ movl \offset+56(%rsp),%esi
+ movl \offset+64(%rsp),%edi
++ movl %eax,%eax /* zero extension */
+ .endm
+
+ .macro CFI_STARTPROC32 simple
diff --git a/series.conf b/series.conf
index 79f294eb6e..99035680a5 100644
--- a/series.conf
+++ b/series.conf
@@ -135,6 +135,7 @@
patches.arch/kvm-replace-kvm-io-delay-pv-ops-with-linux-magic
patches.suse/x86-mark_rodata_rw.patch
+ patches.fixes/x86-64-compat-retruncate-rax-after-ia32-syscall-entry-tracing
########################################################
# x86 MCE/MCA (Machine Check Error/Architecture) extensions