[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Fwd: [PATCH] ARM: Fix restoration of IP scratch register when auditing syscalls




-------- Original Message --------
Subject: [PATCH] ARM: Fix restoration of IP scratch register when
auditing syscalls
Date: Sun, 29 Apr 2012 02:38:24 -0400
From: Jon Masters <jcm@xxxxxxxxxxxxxx>
To: Linux ARM Kernel <linux-arm-kernel@xxxxxxxxxxxxxxxxxxx>
CC: Jon Masters <jcm@xxxxxxxxxx>, Al Viro <viro@xxxxxxxxxxxxxxxxxx>,
    Eric Paris <eparis@xxxxxxxxxx>, Jon Masters <jcm@xxxxxxxxxxxxxx>

The audit subsystem builds upon ptrace to record system calls. This is done
in a couple of places (on return from fork into a new task, on exit from
the SWI vector), using calls to syscall_trace. The latter function abuses
the userspace intra-procedure scratch register (regs->ARM_ip, aka r12),
and intends to restore it prior to return to userspace. Unfortunately,
there are cases where we will return to userspace without restoring.

If we are in fact not ptracing but are merely auditing calls, we will
happily trash the content of ip but will exit to userspace without
restoring the value. It just so happens that GLIBC uses ip as a
storage for the TLS thread pointer info, and bad things result.

The fix is simply to have an additional out when not ptracing.

Signed-off-by: Jon Masters <jcm@xxxxxxxxxxxxxx>
---
 arch/arm/kernel/ptrace.c |   10 +++++++---
 1 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index ede6443..7b05b6e 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -928,10 +928,10 @@ asmlinkage int syscall_trace(int why, struct
pt_regs *regs, int scno)
 		audit_syscall_entry(AUDIT_ARCH_NR, scno, regs->ARM_r0,
 				    regs->ARM_r1, regs->ARM_r2, regs->ARM_r3);

-	if (!test_thread_flag(TIF_SYSCALL_TRACE))
-		return scno;
+	if (!test_thread_flag(TIF_SYSCALL_TRACE))
+		goto out_no_ptrace;
 	if (!(current->ptrace & PT_PTRACED))
-		return scno;
+		goto out_no_ptrace;

 	current_thread_info()->syscall = scno;

@@ -951,4 +951,8 @@ asmlinkage int syscall_trace(int why, struct pt_regs
*regs, int scno)
 	regs->ARM_ip = ip;

 	return current_thread_info()->syscall;
+
+out_no_ptrace:
+	regs->ARM_ip = ip;
+	return scno;
 }
_______________________________________________
kernel mailing list
kernel@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/kernel

[Fedora General Discussion]     [Older Fedora Users Archive]     [Fedora Advisory Board]     [Fedora Security]     [Fedora Maintainers]     [Fedora Devel Java]     [Fedora Legacy]     [Fedora Desktop]     [ATA RAID]     [Fedora Marketing]     [Fedora Mentors]     [Fedora Package Announce]     [Fedora Package Review]     [Fedora Music]     [Fedora Packaging]     [Centos]     [Fedora SELinux]     [Deep Creek Hot Springs]     [Coolkey]     [Yum Users]     [Tux]     [Yosemite News]     [Yosemite Photos]     [Linux Apps]     [KDE Users]     [Fedora Tools]     [Fedora Art]     [Fedora Docs]     [USB]     [Asterisk PBX]

Powered by Linux