Re: [PATCH v2] ptrace: reject out of range error values in PTRACE_SET_SYSCALL_INFO

["Dmitry V. Levin" <ldv@strace.io>]

On Sun, Nov 15, 2026 at 09:25:39AM +0100, Renzo Davoli wrote:
> With is_error set, PTRACE_SET_SYSCALL_INFO passes info.exit.rval to
> syscall_set_return_value() as an "int" error without checking it: a
> positive value, or on 64-bit one outside the "int" range, turns the
> error into a success or is truncated.
> 
> Reject with -ERANGE any error value outside [-MAX_ERRNO, -1].
> 
> Fixes: 26bb32768fe6 ("ptrace: introduce PTRACE_SET_SYSCALL_INFO request")
> Signed-off-by: Renzo Davoli <renzo@cs.unibo.it>
> ---
> v2: shorter commit message and comment, dropped Assisted-by (Bradley Morgan)
> v1: https://lore.kernel.org/lkml/20261114184842.373304-1-renzo@cs.unibo.it/
> 
> Tested on x86_64: rval 0, 1, 3, -4096, INT_MIN and 0x100000000 with
> is_error set are now rejected with -ERANGE; -ESRCH and -4095 still work.
> 
>  kernel/ptrace.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/kernel/ptrace.c b/kernel/ptrace.c
> index 3f2fe68ccb14..1ffacfcef8d4 100644
> --- a/kernel/ptrace.c
> +++ b/kernel/ptrace.c
> @@ -1111,6 +1111,10 @@ ptrace_set_syscall_info_exit(struct task_struct *child, struct pt_regs *regs,
>  	if (rval != info->exit.rval)
>  		return -ERANGE;
>  
> +	/* An error must be a negative errno value. */
> +	if (info->exit.is_error && (rval < -MAX_ERRNO || rval >= 0))
> +		return -ERANGE;
> +
>  	if (info->exit.is_error)
>  		syscall_set_return_value(child, regs, rval, 0);
>  	else

Reviewed-by: Dmitry V. Levin <ldv@strace.io>

Also worth adding a test case for this issue to
tools/testing/selftests/ptrace/set_syscall_info.c


-- 
ldv