git: 47f7345baba0 - main - linux: fix PTRACE_POKEDATA and PTRACE_POKETEXT.

[Konstantin Belousov]

On Tue, Jan 19, 2021 at 12:25:36PM +0000, Edward Tomasz Napierala wrote:
> On 0119T1314, Konstantin Belousov wrote:
> > On Tue, Jan 19, 2021 at 10:53:38AM +0000, Edward Tomasz Napierala wrote:
> > > The branch main has been updated by trasz:
> > > 
> > > URL: https://cgit.FreeBSD.org/src/commit/?id=47f7345baba01121e29c22b43f68345399a32912
> > > 
> > > commit 47f7345baba01121e29c22b43f68345399a32912
> > > Author:     Edward Tomasz Napierala <trasz at FreeBSD.org>
> > > AuthorDate: 2021-01-15 16:57:24 +0000
> > > Commit:     Edward Tomasz Napierala <trasz at FreeBSD.org>
> > > CommitDate: 2021-01-19 10:30:55 +0000
> > > 
> > >     linux: fix PTRACE_POKEDATA and PTRACE_POKETEXT.
> > >     
> > >     Sponsored by:   The FreeBSD Foundation
> > > ---
> > >  sys/amd64/linux/linux_ptrace.c | 9 +++++++--
> > >  1 file changed, 7 insertions(+), 2 deletions(-)
> > > 
> > > diff --git a/sys/amd64/linux/linux_ptrace.c b/sys/amd64/linux/linux_ptrace.c
> > > index a14155ed7e97..c1d05db5bc42 100644
> > > --- a/sys/amd64/linux/linux_ptrace.c
> > > +++ b/sys/amd64/linux/linux_ptrace.c
> > > @@ -594,10 +594,15 @@ linux_ptrace(struct thread *td, struct linux_ptrace_args *uap)
> > >  		error = linux_ptrace_peekuser(td, pid, addr, (void *)uap->data);
> > >  		break;
> > >  	case LINUX_PTRACE_POKETEXT:
> > > -		error = kern_ptrace(td, PT_WRITE_I, pid, addr, uap->data);
> > > -		break;
> > This is wrong. You should access text AS if linux request was for text.
> 
> Do we actually want to maintain that distinction?  Looking
> at sys/kern/sys_process.c, they are synonyms.
It started on PDP-11 were text and data address spaces could be
separate. Right now I think this distinction might be useful for
applying different policy in addition to the plain mapping permissions,
at least.

I would prefer to not break the feature until we decide to, instead of
doing it silently and on case by case.

> 
> > >  	case LINUX_PTRACE_POKEDATA:
> > >  		error = kern_ptrace(td, PT_WRITE_D, pid, addr, uap->data);
> > > +		if (error != 0)
> > > +			return (error);
> > > +		/*
> > > +		 * Linux expects this syscall to write 64 bits, not 32.
> > > +		 */
> > > +		error = kern_ptrace(td, PT_WRITE_D, pid,
> > > +		    (void *)(uap->addr + 4), uap->data >> 32);
> > >  		break;
> > You should use PT_IO there instead of doing two accesses (to the wrong AS).
> 
> Hm, you're right.  The only problem I can see is that PT_IO fetches
> struct ptrace_io_desc from userspace, which makes wrapping somewhat
> hard.  How about introducing PT_READ64 and PT_WRITE64 request types
> and using them instead?
Are you sure?  I see that the structure is copied in and out in sys_ptrace(9).
Doing it in kern_ptrace(9) would require one more SV_ILP32 check, but it
seems to be done right.