| Message ID | 20160427015611.GA23316@altlinux.org (mailing list archive) |
|---|---|
| State | Accepted, archived |
| Headers | show |
On 27 Apr 2016 04:56, Dmitry V. Levin wrote: > Do not load one entry beyond the end of the syscall table when the > syscall number of a traced process equals to __NR_Linux_syscalls. > Similar bug with regular processes was fixed by commit 3bb457af4fa8 > ("[PARISC] Fix bug when syscall nr is __NR_Linux_syscalls"). > > This bug was found by strace test suite. > > Cc: stable@vger.kernel.org > Signed-off-by: Dmitry V. Levin <ldv@altlinux.org> > --- > arch/parisc/kernel/syscall.S | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S > index c976ebf..57b4836 100644 > --- a/arch/parisc/kernel/syscall.S > +++ b/arch/parisc/kernel/syscall.S > @@ -344,7 +344,7 @@ tracesys_next: > #endif > > cmpib,COND(=),n -1,%r20,tracesys_exit /* seccomp may have returned -1 */ > - comiclr,>>= __NR_Linux_syscalls, %r20, %r0 > + comiclr,>> __NR_Linux_syscalls, %r20, %r0 > b,n .Ltracesys_nosys > > LDREGX %r20(%r19), %r19 i've deployd your fix to hake, so feel free to give the tests another run to try and crash the box :). -mike
On Tue, Apr 26, 2016 at 10:45:11PM -0400, Mike Frysinger wrote: > On 27 Apr 2016 04:56, Dmitry V. Levin wrote: > > Do not load one entry beyond the end of the syscall table when the > > syscall number of a traced process equals to __NR_Linux_syscalls. > > Similar bug with regular processes was fixed by commit 3bb457af4fa8 > > ("[PARISC] Fix bug when syscall nr is __NR_Linux_syscalls"). > > > > This bug was found by strace test suite. > > > > Cc: stable@vger.kernel.org > > Signed-off-by: Dmitry V. Levin <ldv@altlinux.org> > > --- > > arch/parisc/kernel/syscall.S | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S > > index c976ebf..57b4836 100644 > > --- a/arch/parisc/kernel/syscall.S > > +++ b/arch/parisc/kernel/syscall.S > > @@ -344,7 +344,7 @@ tracesys_next: > > #endif > > > > cmpib,COND(=),n -1,%r20,tracesys_exit /* seccomp may have returned -1 */ > > - comiclr,>>= __NR_Linux_syscalls, %r20, %r0 > > + comiclr,>> __NR_Linux_syscalls, %r20, %r0 > > b,n .Ltracesys_nosys > > > > LDREGX %r20(%r19), %r19 > > i've deployd your fix to hake, so feel free to give the tests another > run to try and crash the box :). With this fix the box no longer crashes.
On 27.04.2016 03:56, Dmitry V. Levin wrote: > Do not load one entry beyond the end of the syscall table when the > syscall number of a traced process equals to __NR_Linux_syscalls. > Similar bug with regular processes was fixed by commit 3bb457af4fa8 > ("[PARISC] Fix bug when syscall nr is __NR_Linux_syscalls"). > > This bug was found by strace test suite. > > Cc: stable@vger.kernel.org > Signed-off-by: Dmitry V. Levin <ldv@altlinux.org> Acked-by: Helge Deller <deller@gmx.de> Thanks! Helge > --- > arch/parisc/kernel/syscall.S | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S > index c976ebf..57b4836 100644 > --- a/arch/parisc/kernel/syscall.S > +++ b/arch/parisc/kernel/syscall.S > @@ -344,7 +344,7 @@ tracesys_next: > #endif > > cmpib,COND(=),n -1,%r20,tracesys_exit /* seccomp may have returned -1 */ > - comiclr,>>= __NR_Linux_syscalls, %r20, %r0 > + comiclr,>> __NR_Linux_syscalls, %r20, %r0 > b,n .Ltracesys_nosys > > LDREGX %r20(%r19), %r19 > -- To unsubscribe from this list: send the line "unsubscribe linux-parisc" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S index c976ebf..57b4836 100644 --- a/arch/parisc/kernel/syscall.S +++ b/arch/parisc/kernel/syscall.S @@ -344,7 +344,7 @@ tracesys_next: #endif cmpib,COND(=),n -1,%r20,tracesys_exit /* seccomp may have returned -1 */ - comiclr,>>= __NR_Linux_syscalls, %r20, %r0 + comiclr,>> __NR_Linux_syscalls, %r20, %r0 b,n .Ltracesys_nosys LDREGX %r20(%r19), %r19
Do not load one entry beyond the end of the syscall table when the syscall number of a traced process equals to __NR_Linux_syscalls. Similar bug with regular processes was fixed by commit 3bb457af4fa8 ("[PARISC] Fix bug when syscall nr is __NR_Linux_syscalls"). This bug was found by strace test suite. Cc: stable@vger.kernel.org Signed-off-by: Dmitry V. Levin <ldv@altlinux.org> --- arch/parisc/kernel/syscall.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)