linux-kernel - Re: [-mm patch] ptrace: make {put,get}reg work again for gs and fs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 21 Dec 2006 20:53:11 +0000
From:	Frederik Deweerdt <deweerdt@...e.fr>
To:	Jeremy Fitzhardinge <jeremy@...p.org>
Cc:	Andrew Morton <akpm@...l.org>, linux-kernel@...r.kernel.org
Subject: Re: [-mm patch] ptrace: make {put,get}reg work again for gs and fs

On Thu, Dec 21, 2006 at 11:22:05AM -0800, Jeremy Fitzhardinge wrote:
> Frederik Deweerdt wrote:
> > Following the i386 pda patches, it's not possible to set gs or fs value
> > from gdb anymore. The following patch restores the old behaviour of
> > getting and setting thread.gs of thread.fs respectively.
> > Here's a gdb session *before* the patch:
> > (gdb) info reg
> > [...]
> > fs             0x33     51
> > gs             0x33     51
> > (gdb) set $fs=0xffff
> > (gdb) info reg
> > [...]
> > fs             0x33     51
> > gs             0x33     51
> > (gdb) set $gs=0xffffffff
> > (gdb) info reg
> > [...]
> > fs             0xffff   65535
> > gs             0x33     51
> >
> > Another one *after* the patch:
> > (gdb) info reg
> > [...]
> > fs             0xd8     216
> >   
> 
> This doesn't look right.  This is the kernel's %fs, not usermode's
> (which should be 0).
> 
Right, I missed that.
> > gs             0x33     51
> > (gdb) set $fs=0xffff
> > (gdb) info reg
> > [...]
> > fs             0xffff   65535
> > gs             0x33     51
> > (gdb) set $gs=0xffff
> > (gdb) info reg
> > [...]
> > fs             0xffff   65535
> > gs             0xffff   65535
> >   
> Hm.  This shouldn't be possible since this is a bad selector, but I
> guess ptrace/gdb doesn't really know that.  If you run the target (even
> single step it), these should revert to 0.
I does, my point there is just that in that case gdb would stick the
0xffff value in the right place, which it doesn't without the patch.
> 
> > Andrew, this goes on top of ptrace-fix-efl_offset-value-according-to-i386-pda-changes.patch
> > sent by Jeremy yesterday.
> >   
> 
> Don't think this is quite right yet.  Assuming the %gs->%fs patch has
> been applied, then the target %fs should be on its stack, and target %gs
> will be in thread.gs.  I'm not sure that thread.fs has any use, but I'd
> want to double check vm86 to be sure.
I'm not sure what you mean by the '%gs->%fs patch'. Do you refer to 
convert-i386-pda-code-to-use-%fs-fixes.patch
which is in -mm1?
Or is there another one I might have missed? For the record, I'm running
-mm1 + the efl_offset patch.

Regards,
Frederik
> 
>     J
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
> 
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/