is_at_popf() needs to test for the iret instruction as well as
popf. So add that test and rename it to is_setting_trap_flag().
Also change max insn length from 16 to 15 to match reality.
LAHF / SAHF can't affect TF, so the comment in x86_64 is removed.
Signed-off-by: Chuck Ebbert <[email protected]>
---
Tested on x86_64.
--- 2.6.18-rc3-64.orig/arch/i386/kernel/ptrace.c
+++ 2.6.18-rc3-64/arch/i386/kernel/ptrace.c
@@ -185,17 +185,17 @@ static unsigned long convert_eip_to_line
return addr;
}
-static inline int is_at_popf(struct task_struct *child, struct pt_regs *regs)
+static inline int is_setting_trap_flag(struct task_struct *child, struct pt_regs *regs)
{
int i, copied;
- unsigned char opcode[16];
+ unsigned char opcode[15];
unsigned long addr = convert_eip_to_linear(child, regs);
copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
for (i = 0; i < copied; i++) {
switch (opcode[i]) {
- /* popf */
- case 0x9d:
+ /* popf and iret */
+ case 0x9d: case 0xcf:
return 1;
/* opcode and address size prefixes */
case 0x66: case 0x67:
@@ -247,7 +247,7 @@ static void set_singlestep(struct task_s
* don't mark it as being "us" that set it, so that we
* won't clear it by hand later.
*/
- if (is_at_popf(child, regs))
+ if (is_setting_trap_flag(child, regs))
return;
child->ptrace |= PT_DTRACE;
--- 2.6.18-rc3-64.orig/arch/x86_64/kernel/ptrace.c
+++ 2.6.18-rc3-64/arch/x86_64/kernel/ptrace.c
@@ -116,17 +116,17 @@ unsigned long convert_rip_to_linear(stru
return addr;
}
-static int is_at_popf(struct task_struct *child, struct pt_regs *regs)
+static int is_setting_trap_flag(struct task_struct *child, struct pt_regs *regs)
{
int i, copied;
- unsigned char opcode[16];
+ unsigned char opcode[15];
unsigned long addr = convert_rip_to_linear(child, regs);
copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
for (i = 0; i < copied; i++) {
switch (opcode[i]) {
- /* popf */
- case 0x9d:
+ /* popf and iret */
+ case 0x9d: case 0xcf:
return 1;
/* CHECKME: 64 65 */
@@ -189,10 +189,8 @@ static void set_singlestep(struct task_s
* ..but if TF is changed by the instruction we will trace,
* don't mark it as being "us" that set it, so that we
* won't clear it by hand later.
- *
- * AK: this is not enough, LAHF and IRET can change TF in user space too.
*/
- if (is_at_popf(child, regs))
+ if (is_setting_trap_flag(child, regs))
return;
child->ptrace |= PT_DTRACE;
--
Chuck
On Wednesday 02 August 2006 14:37, Chuck Ebbert wrote:
> is_at_popf() needs to test for the iret instruction as well as
> popf. So add that test and rename it to is_setting_trap_flag().
Do you have a single real example where anybody is actually using IRET
in user space?
-Andi
In-Reply-To: <[email protected]>
On Wed, 2 Aug 2006 14:54:33 +0200. Andi Kleen wrote:
> > is_at_popf() needs to test for the iret instruction as well as
> > popf. So add that test and rename it to is_setting_trap_flag().
>
> Do you have a single real example where anybody is actually using IRET
> in user space?
No, but Albert Cahalan complained so I figured it should be fixed.
--
Chuck
Andi Kleen <[email protected]> wrote:
> On Wednesday 02 August 2006 14:37, Chuck Ebbert wrote:
>> is_at_popf() needs to test for the iret instruction as well as
>> popf. So add that test and rename it to is_setting_trap_flag().
>
> Do you have a single real example where anybody is actually using IRET
> in user space?
It might be used by malicious software, so unless it can't be abused,
it must be checked.
--
Ich danke GMX daf?r, die Verwendung meiner Adressen mittels per SPF
verbreiteten L?gen zu sabotieren.
http://david.woodhou.se/why-not-spf.html
On Wednesday 02 August 2006 15:35, Chuck Ebbert wrote:
> In-Reply-To: <[email protected]>
>
> On Wed, 2 Aug 2006 14:54:33 +0200. Andi Kleen wrote:
>
> > > is_at_popf() needs to test for the iret instruction as well as
> > > popf. So add that test and rename it to is_setting_trap_flag().
> >
> > Do you have a single real example where anybody is actually using IRET
> > in user space?
>
> No, but Albert Cahalan complained so I figured it should be fixed.
I suppose he just collected all the obscure FIXMEs in the code he could find.
Ok I merged it, but only because it is so little code.
-Andi