arch/i386|x86_64/kernel/ptrace.c linux-2.6.7

Hi Andi,

In linux-2.6.7, I would like to suggest a few small changes to the error checking the PTRACE_GETREGS and PTRACE_SETREGS processing in sys_ptrace().

While working on our own linux debugger, we noticed that if an invalid user-space address is passed in, then the ptrace() call would return success even though the registers were not properly read (PTRACE_GETREGS) or written (PTRACE_SETREGS).

Since the access_ok() check only ensures that the user-space address is within the range of valid user space addresses, the subsequent __put_user() or __get_user() calls can still fail if the user-space address is not current a valid address within the caller's address space.

The suggested fix below for i386 and x86_64 is to logically OR the returned value into 'ret' from the __put_user() or __get_user() calls, in the same way that the arch/x86_64/ia32/ptrace32.c code does.

Additionally, for x86_64 only, the access_ok() size parameter should really be sizeof(struct user_regs_struct) instead of FRAME_SIZE, since on x86_64 the user_regs_struct being read/written is actually a bit larger than the FRAME_SIZE define.

Thank you.

diff -ru linux-2.6.7/arch/i386/kernel/ptrace.c
linux/arch/i386/kernel/ptrace.c
--- linux-2.6.7/arch/i386/kernel/ptrace.c 2004-06-16
01:19:03.000000000 -0400
+++ linux/arch/i386/kernel/ptrace.c 2004-07-12 13:09:33.000000000 -0400
@@ -428,11 +428,11 @@

                        ret = -EIO;
                        break;
                }
+               ret = 0;
                for ( i = 0; i < FRAME_SIZE*sizeof(long); i += 
sizeof(long) ) {
-                       __put_user(getreg(child, i), datap);
+                       ret |= __put_user(getreg(child, i), datap);
                        datap++;
                }
-               ret = 0;
                break;
        }

@@ -442,12 +442,12 @@

                        ret = -EIO;
                        break;
                }
+               ret = 0;
                for ( i = 0; i < FRAME_SIZE*sizeof(long); i += 
sizeof(long) ) {
-                       __get_user(tmp, datap);
+                       ret |=__get_user(tmp, datap);
                        putreg(child, i, tmp);
                        datap++;
                }
-               ret = 0;
                break;
        }

diff -ru linux-2.6.7/arch/x86_64/kernel/ptrace.c
linux/arch/x86_64/kernel/ptrace.c
--- linux-2.6.7/arch/x86_64/kernel/ptrace.c 2004-06-16
01:19:09.000000000 -0400
+++ linux/arch/x86_64/kernel/ptrace.c 2004-07-12 16:03:35.584411668 -0400
@@ -429,30 +429,30 @@
break;

case PTRACE_GETREGS: { /* Get all gp regs from the child. */
- if (!access_ok(VERIFY_WRITE, (unsigned __user *)data,
FRAME_SIZE)) {
+ if (!access_ok(VERIFY_WRITE, (unsigned __user *)data,

sizeof(struct user_regs_struct))) {
                        ret = -EIO;
                        break;
                }
+               ret = 0;
                for (ui = 0; ui < sizeof(struct user_regs_struct); ui += 

sizeof(long)) {
- __put_user(getreg(child, ui),(unsigned long
__user *) data);
+ ret |= __put_user(getreg(child, ui),(unsigned

long __user *) data);
                        data += sizeof(long);
                }
-               ret = 0;
                break;
        }

        case PTRACE_SETREGS: { /* Set all gp regs in the child. */
                unsigned long tmp;
-               if (!access_ok(VERIFY_READ, (unsigned __user *)data, 
FRAME_SIZE)) {
+               if (!access_ok(VERIFY_READ, (unsigned __user *)data, 
sizeof(struct user_regs_struct))) {
                        ret = -EIO;
                        break;
                }
+               ret = 0;
                for (ui = 0; ui < sizeof(struct user_regs_struct); ui += 
sizeof(long)) {
-                       __get_user(tmp, (unsigned long __user *) data);
+                       ret |= __get_user(tmp, (unsigned long __user *) 
data);
                        putreg(child, ui, tmp);
                        data += sizeof(long);
                }
-               ret = 0;
                break;
        }