Attachment 37412 Details for Bug 84078

[patch] Patch

ptrace-boundary (text/plain), 1.05 KB, created by Andreas Kleen on 2005-05-19 06:13:13 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andreas Kleen

Created: 2005-05-19 06:13:13 UTC

Size: 1.05 KB

patch

obsolete

>Don't allow accesses below register frame in ptrace
>
>There was a "off by one quad word" error in there. I don't think
>it is exploitable because it will only store into a unused area,
>but better to plug it.
>
>Found and fixed by John Blackwood
>
>Signed-off-by: Andi Kleen <ak@suse.de>
>
>Index: linux/arch/x86_64/kernel/ptrace.c
>===================================================================
>--- linux.orig/arch/x86_64/kernel/ptrace.c
>+++ linux/arch/x86_64/kernel/ptrace.c
>@@ -380,7 +380,7 @@ asmlinkage long sys_ptrace(long request,
> 			break;
> 
> 		switch (addr) { 
>-		case 0 ... sizeof(struct user_regs_struct):
>+		case 0 ... sizeof(struct user_regs_struct) - sizeof(long):
> 			tmp = getreg(child, addr);
> 			break;
> 		case offsetof(struct user, u_debugreg[0]):
>@@ -425,7 +425,7 @@ asmlinkage long sys_ptrace(long request,
> 			break;
> 
> 		switch (addr) { 
>-		case 0 ... sizeof(struct user_regs_struct): 
>+		case 0 ... sizeof(struct user_regs_struct) - sizeof(long):
> 			ret = putreg(child, addr, data);
> 			break;
> 		/* Disallows to set a breakpoint into the vsyscall */

Actions: View | Diff

Attachments on bug 84078: 37412 | 38387