linux-kernel - Re: [patch 15/21] ptrace changes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <49133665.8090701@redhat.com>
Date:	Thu, 06 Nov 2008 12:24:37 -0600
From:	David Smith <dsmith@...hat.com>
To:	schwidefsky@...ibm.com
CC:	linux-kernel@...r.kernel.org, linux-s390@...r.kernel.org,
	Heiko Carstens <heiko.carstens@...ibm.com>
Subject: Re: [patch 15/21] ptrace changes

Martin Schwidefsky wrote:
> On Mon, 2008-11-03 at 11:14 -0600, David Smith wrote: 
> 
>> Is this correct, or should the 1st syscall argument be found in
>> regs->orig_gpr2 by syscall_get_arguments()/syscall_set_arguments()?
> 
> The question is when do syscall_get_arguments and syscall_set_arguments
> functions get called? If they are called on a call chain that started
> from do_syscall_trace_enter then we'd have to use orig_gpr2 instead of
> gprs[2] but if the functions are not called via do_syscall_trace_enter
> the first argument is located in grprs[2]. As far as I can see the sole
> user of syscall_get_arguments is collect_syscall which is used to get
> the registers of a blocked process. In this case the kernel call chain
> does not include do_syscall_trace_enter, therefore the first argument is
> in gprs[2], no?

But, collect_syscall() also calls syscall_get_nr():

	*callno = syscall_get_nr(target, regs);
	if (*callno != -1L && maxargs > 0)
		syscall_get_arguments(target, regs, 0, maxargs, args);

Both syscall_get_nr() *and* syscall_get_arguments() returning gprs[2]
can't be right, can it?

-- 
David Smith
dsmith@...hat.com
Red Hat
http://www.redhat.com
256.217.0141 (direct)
256.837.0057 (fax)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/