• Linus Torvalds's avatar
    Merge branch 'regset' (PTRACE_SETREGSET data leakage) · 72c33734
    Linus Torvalds authored
    Merge PTRACE_SETREGSET leakage fixes from Dave Martin:
     "This series is the collection of fixes I proposed on this topic, that
      have not yet appeared upstream or in the stable branches,
    
      The issue can leak kernel stack, but doesn't appear to allow userspace
      to attack the kernel directly.  The affected architectures are c6x,
      h8300, metag, mips and sparc.
    
      [ Mark Salter points out that c6x has no MMU or other mechanism to
        prevent userspace access to kernel code or data on c6x, but it
        doesn't hurt to clean that case up too. ]
    
      The bugs arise from use of user_regset_copyin(). Users of
      user_regset_copyin() can work in one of two ways:
    
       1) Copy directly to thread_struct or equivalent. (This seems to be
          the design assumption of the regset API, and is the most common
          approach.)
    
       2) Copy to a local variable and then transfer to thread_struct. (A
          significant minority of cases.)
    
      Buggy code typically involves approach 2"
    
    * emailed patches from Dave Martin <Dave.Martin@arm.com>:
      sparc/ptrace: Preserve previous registers for short regset write
      mips/ptrace: Preserve previous registers for short regset write
      metag/ptrace: Reject partial NT_METAG_RPIPE writes
      metag/ptrace: Provide default TXSTATUS for short NT_PRSTATUS
      metag/ptrace: Preserve previous registers for short regset write
      h8300/ptrace: Fix incorrect register transfer count
      c6x/ptrace: Remove useless PTRACE_SETREGSET implementation
    72c33734
ptrace.c 21.3 KB