[PATCH v2] ptrace: reject out of range error values in PTRACE_SET_SYSCALL_INFO

[Renzo Davoli]

With is_error set, PTRACE_SET_SYSCALL_INFO passes info.exit.rval to
syscall_set_return_value() as an "int" error without checking it: a
positive value, or on 64-bit one outside the "int" range, turns the
error into a success or is truncated.

Reject with -ERANGE any error value outside [-MAX_ERRNO, -1].

Fixes: 26bb32768fe6 ("ptrace: introduce PTRACE_SET_SYSCALL_INFO request")
Signed-off-by: Renzo Davoli <renzo@xxxxxxxxxxx>
---
v2: shorter commit message and comment, dropped Assisted-by (Bradley Morgan)
v1: https://lore.kernel.org/lkml/20261114184842.373304-1-renzo@xxxxxxxxxxx/

Tested on x86_64: rval 0, 1, 3, -4096, INT_MIN and 0x100000000 with
is_error set are now rejected with -ERANGE; -ESRCH and -4095 still work.

 kernel/ptrace.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 3f2fe68ccb14..1ffacfcef8d4 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -1111,6 +1111,10 @@ ptrace_set_syscall_info_exit(struct task_struct *child, struct pt_regs *regs,
 	if (rval != info->exit.rval)
 		return -ERANGE;
 
+	/* An error must be a negative errno value. */
+	if (info->exit.is_error && (rval < -MAX_ERRNO || rval >= 0))
+		return -ERANGE;
+
 	if (info->exit.is_error)
 		syscall_set_return_value(child, regs, rval, 0);
 	else

base-commit: 7e1392a42ea288d70a266f6553fe06f57f8647ea
-- 
2.47.3