From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753501AbdK3R2q (ORCPT ); Thu, 30 Nov 2017 12:28:46 -0500 Received: from usa-sjc-mx-foss1.foss.arm.com ([217.140.101.70]:58858 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752367AbdK3R2o (ORCPT ); Thu, 30 Nov 2017 12:28:44 -0500 Date: Thu, 30 Nov 2017 17:28:40 +0000 From: Dave Martin To: "Maciej W. Rozycki" Cc: Ralf Baechle , James Hogan , Paul Burton , Alex Smith , "linux-mips@linux-mips.org" , "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" Subject: Re: [PATCH 4/5] MIPS: Execute any partial write of the last register with PTRACE_SETREGSET Message-ID: <20171130172839.GQ22781@e103592.cambridge.arm.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Nov 29, 2017 at 03:21:14PM +0000, Maciej W. Rozycki wrote: > Fix a commit d614fd58a283 ("mips/ptrace: Preserve previous registers for > short regset write") bug and allow the last register requested with a > ptrace(2) PTRACE_SETREGSET call to be partially written if supplied this > way by the caller, like with other register sets. > > Cc: stable@vger.kernel.org # v4.11+ > Fixes: d614fd58a283 ("mips/ptrace: Preserve previous registers for short regset write") > Signed-off-by: Maciej W. Rozycki > --- > arch/mips/kernel/ptrace.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > linux-mips-nt-prfpreg-count.diff > Index: linux-sfr-test/arch/mips/kernel/ptrace.c > =================================================================== > --- linux-sfr-test.orig/arch/mips/kernel/ptrace.c 2017-11-21 22:12:00.000000000 +0000 > +++ linux-sfr-test/arch/mips/kernel/ptrace.c 2017-11-21 22:13:13.471970000 +0000 > @@ -484,7 +484,7 @@ static int fpr_set_msa(struct task_struc > int err; > > BUILD_BUG_ON(sizeof(fpr_val) != sizeof(elf_fpreg_t)); > - for (i = 0; i < NUM_FPU_REGS && *count >= sizeof(elf_fpreg_t); i++) { > + for (i = 0; i < NUM_FPU_REGS && *count > 0; i++) { > > err = user_regset_copyin(pos, count, kbuf, ubuf, > &fpr_val, i * sizeof(elf_fpreg_t), > (i + 1) * sizeof(elf_fpreg_t)); But mips*_regsets[REGSET_FPR].size == sizeof(elf_fpreg_t), linux/kernel/regset.c:ptrace_regset() polices iov_len % regset->size == 0, and each user_regset_copyout() call here transfers sizeof(elf_fpreg_t) bytes, decrementing *count by that amount unless something goest wrong in which case we return. So how do we end up with *count > 0 && *count < sizeof(elf_fpreg_t) here? If we can't end up with that, then this patch doesn't change ABI- observable behaviour, unless I've missed something. If we can end up with that somehow, then this patch reintroduces the issue d614fd58a283 aims to fix, whereby fpr_val can contain uninitialised kernel stack which userspace can then obtain via PTRACE_GETREGSET. Cheers ---Dave