ptrace bug

From: Gian-Yan Xu (kids@linux.ee.tku.edu.tw)
Date: Mon Oct 15 2001 - 19:12:03 EST


Today I try to get register's value via ptrace(PTRACE_GETREGS, ...),
but only EBX, ECX, EDX, ESI, EDI, EBP, EAX registers are correct.
I notice that file /usr/src/linux/include/asm/ptrace.h:

#define FS 9
#define GS 10

but in the declare of struct pt_regs:
                                                                    
struct pt_regs {
        long ebx;
        long ecx;
        long edx;
        long esi;
        long edi;
        long ebp;
        long eax;
        int xds;
        int xes;
        long orig_eax;
        long eip;
        int xcs;
        long eflags;
        long esp;
        int xss;
};
                                                                    
There is no xfs/xgs member in that struct, and the #define FRAME_SIZE 17
is not match the number of member in the pt_regs struct.
                                                                        
                                                                              
In addition, in the ptrace.c:
                                                                        
   case PTRACE_GETREGS: { /* Get all gp regs from the child. */
   if (!access_ok(VERIFY_WRITE, (unsigned *)data,
FRAME_SIZE*sizeo(long))) {
                        ret = -EIO;
                        break;
   }
   for ( i = 0; i < FRAME_SIZE*sizeof(long); i += sizeof(long) ) {
              __put_user(getreg(child, i),(unsigned long *) data);
             data += sizeof(long);
   }
   ret = 0;
                                                                            
FRAME_SIZE*sizeof(long) is larger than sizeof(struct pt_regs),
the ptrace() will overwrite the data of parent process!
                                                                            
To fix the bug, try this patch:
                                                                            
--- ptrace.h.orig Mon Oct 15 21:00:48 2001
+++ ptrace.h Mon Oct 15 21:05:56 2001
@@ -33,6 +33,8 @@
        long eax;
        int xds;
        int xes;
+ int xfs;
+ int xgs;
        long orig_eax;
        long eip;
        int xcs;
                                 
                                                              

-- 
Best regards,
Gian-Yain Xu. (kids@linux.ee.tku.edu.tw)

- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Mon Oct 15 2001 - 21:00:58 EST