linux-kernel - Re: [PATCH] LoongArch: Fix missing fcsr in ptrace's fpr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAAhV-H6NWYG1ChLRyK-EAGAmhDvP-x+z9BgBo3a=GAbQ-2bKig@mail.gmail.com>
Date:   Thu, 14 Jul 2022 21:12:20 +0800
From:   Huacai Chen <chenhuacai@...nel.org>
To:     Qi Hu <huqi@...ngson.cn>
Cc:     WANG Xuerui <kernel@...0n.name>, Oleg Nesterov <oleg@...hat.com>,
        Xu Li <lixu@...ngson.cn>, loongarch@...ts.linux.dev,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] LoongArch: Fix missing fcsr in ptrace's fpr_set

Hi,

On Thu, Jul 14, 2022 at 2:26 PM Qi Hu <huqi@...ngson.cn> wrote:
>
> In file ptrace.c, function fpr_set does not copy fcsr data from ubuf
> to kbuf. That's the reason why fcsr cannot be modified by ptrace.
>
> This patch fixs this problem and allows users using ptrace to modify
> the fcsr.
>
> Signed-off-by: Qi Hu <huqi@...ngson.cn>
> Signed-off-by: Xu Li <lixu@...ngson.cn>
> ---
>  arch/loongarch/kernel/ptrace.c | 12 +++++++-----
>  1 file changed, 7 insertions(+), 5 deletions(-)
>
> diff --git a/arch/loongarch/kernel/ptrace.c b/arch/loongarch/kernel/ptrace.c
> index e6ab87948e1d..dc2b82ea894c 100644
> --- a/arch/loongarch/kernel/ptrace.c
> +++ b/arch/loongarch/kernel/ptrace.c
> @@ -193,7 +193,7 @@ static int fpr_set(struct task_struct *target,
>                    const void *kbuf, const void __user *ubuf)
>  {
>         const int fcc_start = NUM_FPU_REGS * sizeof(elf_fpreg_t);
> -       const int fcc_end = fcc_start + sizeof(u64);
> +       const int fcsr_start = fcc_start + sizeof(u64);
>         int err;
>
>         BUG_ON(count % sizeof(elf_fpreg_t));
> @@ -209,10 +209,12 @@ static int fpr_set(struct task_struct *target,
>         if (err)
>                 return err;
>
> -       if (count > 0)
> -               err |= user_regset_copyin(&pos, &count, &kbuf, &ubuf,
> -                                         &target->thread.fpu.fcc,
> -                                         fcc_start, fcc_end);
> +       err |= user_regset_copyin(&pos, &count, &kbuf, &ubuf,
> +                                 &target->thread.fpu.fcc, fcc_start,
> +                                 fcc_start + sizeof(u64));
> +       err |= user_regset_copyin(&pos, &count, &kbuf, &ubuf,
> +                                 &target->thread.fpu.fcsr, fcsr_start,
> +                                 fcsr_start + sizeof(u32));
You shouldn't remove (count > 0) here, because  the above
user_regset_copyin() will modify count inside, and so "count == 0" is
possible.

Huacai
>
>         return err;
>  }
> --
> 2.37.0
>