Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752622AbdC1Ozh (ORCPT ); Tue, 28 Mar 2017 10:55:37 -0400 Received: from mx1.redhat.com ([209.132.183.28]:53960 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752066AbdC1Ozf (ORCPT ); Tue, 28 Mar 2017 10:55:35 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 2AC0180479 Authentication-Results: ext-mx04.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx04.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=oleg@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 2AC0180479 Date: Tue, 28 Mar 2017 16:54:32 +0200 From: Oleg Nesterov To: Andrew Morton , Andy Lutomirski , Linus Torvalds Cc: Denys Vlasenko , "H. Peter Anvin" , Ingo Molnar , Jan Kratochvil , Pedro Alves , Thomas Gleixner , x86@kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 1/1] get_nr_restart_syscall() should return __NR_ia32_restart_syscall if __USER32_CS Message-ID: <20170328145432.GA3163@redhat.com> References: <20170328145413.GA3164@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170328145413.GA3164@redhat.com> User-Agent: Mutt/1.5.24 (2015-08-30) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.28]); Tue, 28 Mar 2017 14:54:37 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2253 Lines: 59 get_nr_restart_syscall() checks TS_I386_REGS_POKED but this bit is only set if debugger is 32-bit. If a 64-bit debugger restores the registers of a 32-bit debugee outside of syscall exit path get_nr_restart_syscall() wrongly returns __NR_restart_syscall. Test-case: $ cvs -d :pserver:anoncvs:anoncvs@sourceware.org:/cvs/systemtap co ptrace-tests $ gcc -o erestartsys-trap-debuggee ptrace-tests/tests/erestartsys-trap-debuggee.c --m32 $ gcc -o erestartsys-trap-debugger ptrace-tests/tests/erestartsys-trap-debugger.c -lutil $ ./erestartsys-trap-debugger Unexpected: retval 1, errno 22 erestartsys-trap-debugger: ptrace-tests/tests/erestartsys-trap-debugger.c:421 As Jan explains this is what "(gdb) call func()" actually does: * Tracee calls sleep(2). * Debugger interrupts the tracee by CTRL-C after 1 sec. * Save regs by PTRACE_GETREGS. * Use PTRACE_SETREGS changing %rip to some 'func' and setting %orig_rax=-1 * PTRACE_CONT * func() uses int3. * Debugger catches SIGTRAP. * Restore original regs by PTRACE_SETREGS. * PTRACE_CONT Change get_nr_restart_syscall() to take __USER32_CS into account, to me this looks a bit better than TIF_IA32 check but either way this logic can't be always right as the comment explains. Alternatively we could change putreg() to set TS_I386_REGS_POKED just like putreg32() does if "child" is 32-bit, but this won't fix all the problems too and I think it would be beter to kill TS_I386_REGS_POKED after this change. Reported-by: Jan Kratochvil Signed-off-by: Oleg Nesterov Cc: stable@vger.kernel.org --- arch/x86/kernel/signal.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c index 763af1d..1b05448 100644 --- a/arch/x86/kernel/signal.c +++ b/arch/x86/kernel/signal.c @@ -785,7 +785,8 @@ static inline unsigned long get_nr_restart_syscall(const struct pt_regs *regs) * than the tracee. */ #ifdef CONFIG_IA32_EMULATION - if (current->thread.status & (TS_COMPAT|TS_I386_REGS_POKED)) + if ((current->thread.status & (TS_COMPAT|TS_I386_REGS_POKED)) || + regs->cs == __USER32_CS) return __NR_ia32_restart_syscall; #endif #ifdef CONFIG_X86_X32_ABI -- 2.5.0