mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-06 02:50:43 +00:00
![Chris Metcalf](/assets/img/avatar_default.png)
The kernel was allowing any component of the pt_regs to be updated either by signal handlers writing to the stack, or by processes writing via PTRACE_POKEUSR or PTRACE_SETREGS, which meant they could set their PL up from 0 to 1 and get access to kernel code and data (or, in practice, cause a kernel panic). We now always reset the ex1 field, allowing the user to set their ICS bit only. Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
205 lines
5.1 KiB
C
205 lines
5.1 KiB
C
/*
|
|
* Copyright 2010 Tilera Corporation. All Rights Reserved.
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public License
|
|
* as published by the Free Software Foundation, version 2.
|
|
*
|
|
* This program is distributed in the hope that it will be useful, but
|
|
* WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
|
|
* NON INFRINGEMENT. See the GNU General Public License for
|
|
* more details.
|
|
*
|
|
* Copied from i386: Ross Biro 1/23/92
|
|
*/
|
|
|
|
#include <linux/kernel.h>
|
|
#include <linux/ptrace.h>
|
|
#include <linux/kprobes.h>
|
|
#include <linux/compat.h>
|
|
#include <linux/uaccess.h>
|
|
#include <asm/traps.h>
|
|
|
|
void user_enable_single_step(struct task_struct *child)
|
|
{
|
|
set_tsk_thread_flag(child, TIF_SINGLESTEP);
|
|
}
|
|
|
|
void user_disable_single_step(struct task_struct *child)
|
|
{
|
|
clear_tsk_thread_flag(child, TIF_SINGLESTEP);
|
|
}
|
|
|
|
/*
|
|
* Called by kernel/ptrace.c when detaching..
|
|
*/
|
|
void ptrace_disable(struct task_struct *child)
|
|
{
|
|
clear_tsk_thread_flag(child, TIF_SINGLESTEP);
|
|
|
|
/*
|
|
* These two are currently unused, but will be set by arch_ptrace()
|
|
* and used in the syscall assembly when we do support them.
|
|
*/
|
|
clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
|
|
}
|
|
|
|
long arch_ptrace(struct task_struct *child, long request,
|
|
unsigned long addr, unsigned long data)
|
|
{
|
|
unsigned long __user *datap = (long __user __force *)data;
|
|
unsigned long tmp;
|
|
long ret = -EIO;
|
|
char *childreg;
|
|
struct pt_regs copyregs;
|
|
int ex1_offset;
|
|
|
|
switch (request) {
|
|
|
|
case PTRACE_PEEKUSR: /* Read register from pt_regs. */
|
|
if (addr >= PTREGS_SIZE)
|
|
break;
|
|
childreg = (char *)task_pt_regs(child) + addr;
|
|
#ifdef CONFIG_COMPAT
|
|
if (is_compat_task()) {
|
|
if (addr & (sizeof(compat_long_t)-1))
|
|
break;
|
|
ret = put_user(*(compat_long_t *)childreg,
|
|
(compat_long_t __user *)datap);
|
|
} else
|
|
#endif
|
|
{
|
|
if (addr & (sizeof(long)-1))
|
|
break;
|
|
ret = put_user(*(long *)childreg, datap);
|
|
}
|
|
break;
|
|
|
|
case PTRACE_POKEUSR: /* Write register in pt_regs. */
|
|
if (addr >= PTREGS_SIZE)
|
|
break;
|
|
childreg = (char *)task_pt_regs(child) + addr;
|
|
|
|
/* Guard against overwrites of the privilege level. */
|
|
ex1_offset = PTREGS_OFFSET_EX1;
|
|
#if defined(CONFIG_COMPAT) && defined(__BIG_ENDIAN)
|
|
if (is_compat_task()) /* point at low word */
|
|
ex1_offset += sizeof(compat_long_t);
|
|
#endif
|
|
if (addr == ex1_offset)
|
|
data = PL_ICS_EX1(USER_PL, EX1_ICS(data));
|
|
|
|
#ifdef CONFIG_COMPAT
|
|
if (is_compat_task()) {
|
|
if (addr & (sizeof(compat_long_t)-1))
|
|
break;
|
|
*(compat_long_t *)childreg = data;
|
|
} else
|
|
#endif
|
|
{
|
|
if (addr & (sizeof(long)-1))
|
|
break;
|
|
*(long *)childreg = data;
|
|
}
|
|
ret = 0;
|
|
break;
|
|
|
|
case PTRACE_GETREGS: /* Get all registers from the child. */
|
|
if (copy_to_user(datap, task_pt_regs(child),
|
|
sizeof(struct pt_regs)) == 0) {
|
|
ret = 0;
|
|
}
|
|
break;
|
|
|
|
case PTRACE_SETREGS: /* Set all registers in the child. */
|
|
if (copy_from_user(©regs, datap,
|
|
sizeof(struct pt_regs)) == 0) {
|
|
copyregs.ex1 =
|
|
PL_ICS_EX1(USER_PL, EX1_ICS(copyregs.ex1));
|
|
*task_pt_regs(child) = copyregs;
|
|
ret = 0;
|
|
}
|
|
break;
|
|
|
|
case PTRACE_GETFPREGS: /* Get the child FPU state. */
|
|
case PTRACE_SETFPREGS: /* Set the child FPU state. */
|
|
break;
|
|
|
|
case PTRACE_SETOPTIONS:
|
|
/* Support TILE-specific ptrace options. */
|
|
child->ptrace &= ~PT_TRACE_MASK_TILE;
|
|
tmp = data & PTRACE_O_MASK_TILE;
|
|
data &= ~PTRACE_O_MASK_TILE;
|
|
ret = ptrace_request(child, request, addr, data);
|
|
if (tmp & PTRACE_O_TRACEMIGRATE)
|
|
child->ptrace |= PT_TRACE_MIGRATE;
|
|
break;
|
|
|
|
default:
|
|
#ifdef CONFIG_COMPAT
|
|
if (task_thread_info(current)->status & TS_COMPAT) {
|
|
ret = compat_ptrace_request(child, request,
|
|
addr, data);
|
|
break;
|
|
}
|
|
#endif
|
|
ret = ptrace_request(child, request, addr, data);
|
|
break;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
#ifdef CONFIG_COMPAT
|
|
/* Not used; we handle compat issues in arch_ptrace() directly. */
|
|
long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
|
|
compat_ulong_t addr, compat_ulong_t data)
|
|
{
|
|
BUG();
|
|
}
|
|
#endif
|
|
|
|
void do_syscall_trace(void)
|
|
{
|
|
if (!test_thread_flag(TIF_SYSCALL_TRACE))
|
|
return;
|
|
|
|
if (!(current->ptrace & PT_PTRACED))
|
|
return;
|
|
|
|
/*
|
|
* The 0x80 provides a way for the tracing parent to distinguish
|
|
* between a syscall stop and SIGTRAP delivery
|
|
*/
|
|
ptrace_notify(SIGTRAP|((current->ptrace & PT_TRACESYSGOOD) ? 0x80 : 0));
|
|
|
|
/*
|
|
* this isn't the same as continuing with a signal, but it will do
|
|
* for normal use. strace only continues with a signal if the
|
|
* stopping signal is not SIGTRAP. -brl
|
|
*/
|
|
if (current->exit_code) {
|
|
send_sig(current->exit_code, current, 1);
|
|
current->exit_code = 0;
|
|
}
|
|
}
|
|
|
|
void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs, int error_code)
|
|
{
|
|
struct siginfo info;
|
|
|
|
memset(&info, 0, sizeof(info));
|
|
info.si_signo = SIGTRAP;
|
|
info.si_code = TRAP_BRKPT;
|
|
info.si_addr = (void __user *) regs->pc;
|
|
|
|
/* Send us the fakey SIGTRAP */
|
|
force_sig_info(SIGTRAP, &info, tsk);
|
|
}
|
|
|
|
/* Handle synthetic interrupt delivered only by the simulator. */
|
|
void __kprobes do_breakpoint(struct pt_regs* regs, int fault_num)
|
|
{
|
|
send_sigtrap(current, regs, fault_num);
|
|
}
|