Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1644547

[PATCH 3.18 14/49] um: Fix PTRACE_POKEUSER on x86_64

Show all headers | View raw

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Richard Weinberger <richard@nod.at>

commit 9abc74a22d85ab29cef9896a2582a530da7e79bf upstream.

This is broken since ever but sadly nobody noticed.
Recent versions of GDB set DR_CONTROL unconditionally and
UML dies due to a heap corruption. It turns out that
the PTRACE_POKEUSER was copy&pasted from i386 and assumes
that addresses are 4 bytes long.

Fix that by using 8 as address size in the calculation.

Reported-by: jie cao <cj3054@gmail.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/um/ptrace_64.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/um/ptrace_64.c
+++ b/arch/x86/um/ptrace_64.c
@@ -120,7 +120,7 @@ int poke_user(struct task_struct *child,
 	else if ((addr >= offsetof(struct user, u_debugreg[0])) &&
 		(addr <= offsetof(struct user, u_debugreg[7]))) {
 		addr -= offsetof(struct user, u_debugreg[0]);
-		addr = addr >> 2;
+		addr = addr >> 3;
 		if ((addr == 4) || (addr == 5))
 			return -EIO;
 		child->thread.arch.debugregs[addr] = data;

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.18 00/49] 3.18.54-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200
  [PATCH 3.18 22/49] SMB3: Work around mount failure when using SMB3 dialect to Macs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200
  [PATCH 3.18 01/49] target/fileio: Fix zero-length READ and WRITE handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200
  [PATCH 3.18 41/49] ppp: defer netns reference release for ppp channel Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200
  [PATCH 3.18 09/49] staging: comedi: jr3_pci: cope with jiffies wraparound Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200
  [PATCH 3.18 31/49] perf: Fix event->ctx locking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200
  [PATCH 3.18 11/49] usb: hub: Do not attempt to autosuspend disconnected devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200
  [PATCH 3.18 07/49] staging: gdm724x: gdm_mux: fix use-after-free on module unload Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200
  [PATCH 3.18 44/49] sched: panic on corrupted stack end Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200
  [PATCH 3.18 06/49] staging: vt6656: use off stack for out buffer USB transfers. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200
  [PATCH 3.18 08/49] staging: comedi: jr3_pci: fix possible null pointer dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 32/49] arm64: perf: reject groups spanning multiple HW PMUs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 42/49] HID: core: prevent out-of-bound readings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 05/49] staging: vt6656: use off stack for in buffer USB transfers. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 04/49] USB: Proper handling of Race Condition when two USB class drivers try to call init_usb_class simultaneously Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 17/49] IB/mlx4: Fix ib device initialization error flow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 39/49] ipv6: sctp: fix lockdep splat in sctp_v6_get_dst() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 33/49] perf: Fix race in swevent hash Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 26/49] md/raid1: avoid reusing a resync bio after error handling. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 38/49] ipv6: sctp: add rcu protection around np->opt Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 29/49] Bluetooth: Fix user channel for 32bit userspace on 64bit kernel Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 37/49] sg: Fix double-free when drives detach during SG_IO Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 36/49] ext4: fix potential use after free in __ext4_journal_stop Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 18/49] fs/xattr.c: zero out memory copied to userspace in getxattr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 03/49] USB: serial: ftdi_sio: add device ID for Microsemi/Arrow SF2PLUS Dev Kit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 34/49] ASN.1: Fix non-match detection failure on data overrun Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 21/49] Set unicode flag on cifs echo request to avoid Mac error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 45/49] ALSA: seq: Fix race at timer setup and close Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 30/49] arm64: make sys_call_table const Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 25/49] padata: free correct variable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 28/49] serial: omap: suspend device on probe errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 40/49] af_unix: Guard against other == sk in unix_dgram_sendmsg Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 02/49] usb: host: xhci: print correct command ring address Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:40 +0200
  [PATCH 3.18 12/49] usb: misc: legousbtower: Fix buffers on stack Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:40 +0200
  [PATCH 3.18 20/49] fs/block_dev: always invalidate cleancache in invalidate_bdev() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:40 +0200
  [PATCH 3.18 16/49] IB/IPoIB: ibX: failed to create mcg debug file Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:40 +0200
  [PATCH 3.18 14/49] um: Fix PTRACE_POKEUSER on x86_64 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:40 +0200
  Re: [PATCH 3.18 00/49] 3.18.54-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-05-18 19:30 +0200
  Re: [PATCH 3.18 00/49] 3.18.54-stable review Guenter Roeck <linux@roeck-us.net> - 2017-05-19 03:10 +0200

csiph-web