2005-04-17 06:20:36 +08:00
|
|
|
#ifndef _PTRACE32_H
|
|
|
|
#define _PTRACE32_H
|
|
|
|
|
2009-03-26 22:24:40 +08:00
|
|
|
#include <asm/ptrace.h> /* needed for NUM_CR_WORDS */
|
2008-07-14 15:58:54 +08:00
|
|
|
#include "compat_linux.h" /* needed for psw_compat_t */
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2011-01-05 19:48:10 +08:00
|
|
|
struct compat_per_struct_kernel {
|
|
|
|
__u32 cr9; /* PER control bits */
|
|
|
|
__u32 cr10; /* PER starting address */
|
|
|
|
__u32 cr11; /* PER ending address */
|
|
|
|
__u32 bits; /* Obsolete software bits */
|
|
|
|
__u32 starting_addr; /* User specified start address */
|
|
|
|
__u32 ending_addr; /* User specified end address */
|
|
|
|
__u16 perc_atmid; /* PER trap ATMID */
|
|
|
|
__u32 address; /* PER trap instruction address */
|
|
|
|
__u8 access_id; /* PER trap access identification */
|
|
|
|
};
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2011-01-05 19:48:10 +08:00
|
|
|
struct compat_user_regs_struct
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
2008-07-14 15:58:54 +08:00
|
|
|
psw_compat_t psw;
|
2005-04-17 06:20:36 +08:00
|
|
|
u32 gprs[NUM_GPRS];
|
|
|
|
u32 acrs[NUM_ACRS];
|
|
|
|
u32 orig_gpr2;
|
[S390] CVE-2008-1514: prevent ptrace padding area read/write in 31-bit mode
When running a 31-bit ptrace, on either an s390 or s390x kernel,
reads and writes into a padding area in struct user_regs_struct32
will result in a kernel panic.
This is also known as CVE-2008-1514.
Test case available here:
http://sources.redhat.com/cgi-bin/cvsweb.cgi/~checkout~/tests/ptrace-tests/tests/user-area-padding.c?cvsroot=systemtap
Steps to reproduce:
1) wget the above
2) gcc -o user-area-padding-31bit user-area-padding.c -Wall -ggdb2 -D_GNU_SOURCE -m31
3) ./user-area-padding-31bit
<panic>
Test status
-----------
Without patch, both s390 and s390x kernels panic. With patch, the test case,
as well as the gdb testsuite, pass without incident, padding area reads
returning zero, writes ignored.
Nb: original version returned -EINVAL on write attempts, which broke the
gdb test and made the test case slightly unhappy, Jan Kratochvil suggested
the change to return 0 on write attempts.
Signed-off-by: Jarod Wilson <jarod@redhat.com>
Tested-by: Jan Kratochvil <jan.kratochvil@redhat.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2008-09-09 18:38:56 +08:00
|
|
|
/* nb: there's a 4-byte hole here */
|
2005-04-17 06:20:36 +08:00
|
|
|
s390_fp_regs fp_regs;
|
|
|
|
/*
|
|
|
|
* These per registers are in here so that gdb can modify them
|
|
|
|
* itself as there is no "official" ptrace interface for hardware
|
|
|
|
* watchpoints. This is the way intel does it.
|
|
|
|
*/
|
2011-01-05 19:48:10 +08:00
|
|
|
struct compat_per_struct_kernel per_info;
|
2010-10-25 22:10:41 +08:00
|
|
|
u32 ieee_instruction_pointer; /* obsolete, always 0 */
|
2005-04-17 06:20:36 +08:00
|
|
|
};
|
|
|
|
|
2011-01-05 19:48:10 +08:00
|
|
|
struct compat_user {
|
2005-04-17 06:20:36 +08:00
|
|
|
/* We start with the registers, to mimic the way that "memory"
|
|
|
|
is returned from the ptrace(3,...) function. */
|
2011-01-05 19:48:10 +08:00
|
|
|
struct compat_user_regs_struct regs;
|
2005-04-17 06:20:36 +08:00
|
|
|
/* The rest of this junk is to help gdb figure out what goes where */
|
|
|
|
u32 u_tsize; /* Text segment size (pages). */
|
|
|
|
u32 u_dsize; /* Data segment size (pages). */
|
|
|
|
u32 u_ssize; /* Stack segment size (pages). */
|
|
|
|
u32 start_code; /* Starting virtual address of text. */
|
|
|
|
u32 start_stack; /* Starting virtual address of stack area.
|
|
|
|
This is actually the bottom of the stack,
|
|
|
|
the top of the stack is always found in the
|
|
|
|
esp register. */
|
|
|
|
s32 signal; /* Signal that caused the core dump. */
|
|
|
|
u32 u_ar0; /* Used by gdb to help find the values for */
|
|
|
|
/* the registers. */
|
|
|
|
u32 magic; /* To uniquely identify a core file */
|
|
|
|
char u_comm[32]; /* User command that was responsible */
|
|
|
|
};
|
|
|
|
|
|
|
|
typedef struct
|
|
|
|
{
|
|
|
|
__u32 len;
|
|
|
|
__u32 kernel_addr;
|
|
|
|
__u32 process_addr;
|
2011-01-05 19:48:10 +08:00
|
|
|
} compat_ptrace_area;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
#endif /* _PTRACE32_H */
|