linux-kernel - Re: [PATCH 1/2] ARC: gdbserver breakage in Big-Endian configuration #1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <C2D7FE5348E1B147BCA15975FBA2307513FD98@IN01WEMBXA.internal.synopsys.com>
Date:	Mon, 19 Aug 2013 09:08:49 +0000
From:	Vineet Gupta <Vineet.Gupta1@...opsys.com>
To:	greg Kroah-Hartman <gregkh@...uxfoundation.org>
CC:	"stable@...r.kernel.org" <stable@...r.kernel.org>,
	"noamc@...hip.com" <noamc@...hip.com>,
	Anton Kolesov <Anton.Kolesov@...opsys.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 1/2] ARC: gdbserver breakage in Big-Endian configuration
 #1

Hi Greg,

I'd posted these patches for stable backport. Do I need to do anything more to get them included.

https://patchwork.kernel.org/patch/2841153/  [1/2] ARC: gdbserver breakage in Big-Endian configuration #1<https://patchwork.kernel.org/patch/2841153/>]
https://patchwork.kernel.org/patch/2841158/  [2/2] ARC: gdbserver breakage in Big-Endian configuration #2<https://patchwork.kernel.org/patch/2841158/>

Thx,
-Vineet


On 08/08/2013 07:23 PM, Vineet Gupta wrote:

Exception handling keeps additional state (whether exception was Trap
and if it was due to a breakpoint) in pt_regs->event, a bitfield member

        unsigned long orig_r8:16, event:16;

A bitfield esentially has an "offset" and a "length". What I wasn't
aware of was that, bitfields in a union loose the "offset" attribute
and all of them are laid out at offset 0.

This obviously means that both @event and @orig_r8 will be incorrectly
referenced to at same "0" offset by "C" generated code which is
certainly wrong, not because both members are accessed, but because asm
code updates it at different address.

In Little Endian config, @event is at offset 0 and @orig_r8 (not
actively used at all) clashing with it is OK. However in Big Endian
config,

        ST 0xNNNN_EEEE, [addr]

writes 0xEEEE to @event (offset 2 in memory) while "C" code references
it from 0.

Needless to say, this causes ptrace machinery to not detect the breakpoint
scenario (and incorrect stop_pc returned to gdbserver).

------>8---------------
Thi issue is already fixed in mainline 3.11 kernel as part of commit:
502a0c775c7f0a "ARC: pt_regs update #5"

However that patch has lot more changes than I would like backporting,
hence this seperate change.
------>8---------------

Reported-by: Noam Camus <noamc@...hip.com><mailto:noamc@...hip.com>
Cc: <stable@...r.kernel.org><mailto:stable@...r.kernel.org> # [3.9 and 3.10 only]
Tested-by: Anton Kolesov <akolesov@...opsys.com><mailto:akolesov@...opsys.com>
Signed-off-by: Vineet Gupta <vgupta@...opsys.com><mailto:vgupta@...opsys.com>
---
 arch/arc/include/asm/ptrace.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arc/include/asm/ptrace.h b/arch/arc/include/asm/ptrace.h
index 6179de7..2046a89 100644
--- a/arch/arc/include/asm/ptrace.h
+++ b/arch/arc/include/asm/ptrace.h
@@ -52,12 +52,14 @@ struct pt_regs {

        /*to distinguish bet excp, syscall, irq */
        union {
+               struct {
 #ifdef CONFIG_CPU_BIG_ENDIAN
                /* so that assembly code is same for LE/BE */
                unsigned long orig_r8:16, event:16;
 #else
                unsigned long event:16, orig_r8:16;
 #endif
+               };
                long orig_r8_word;
        };
 };


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/