In some cases 'data' should be considered as a user pointer but it requires
cast with additional __force markup which was missing. Rather than add the
markups wherever needed, make use of a temporary variable of user pointer.
This patch is based on compat_ptrace_request() implementation.
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Namhyung Kim <namhyung@gmail.com>
---
kernel/ptrace.c | 13 +++++++------
1 files changed, 7 insertions(+), 6 deletions(-)
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 4afd9b8..7547b1c 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -564,6 +564,7 @@ int ptrace_request(struct task_struct *child, long request,
{
int ret = -EIO;
siginfo_t siginfo;
+ unsigned long __user *datap = (unsigned long __user __force *) data;
switch (request) {
case PTRACE_PEEKTEXT:
@@ -580,18 +581,18 @@ int ptrace_request(struct task_struct *child, long request,
ret = ptrace_setoptions(child, data);
break;
case PTRACE_GETEVENTMSG:
- ret = put_user(child->ptrace_message, (unsigned long __user *) data);
+ ret = put_user(child->ptrace_message, datap);
break;
case PTRACE_GETSIGINFO:
ret = ptrace_getsiginfo(child, &siginfo);
if (!ret)
- ret = copy_siginfo_to_user((siginfo_t __user *) data,
+ ret = copy_siginfo_to_user((siginfo_t __user *) datap,
&siginfo);
break;
case PTRACE_SETSIGINFO:
- if (copy_from_user(&siginfo, (siginfo_t __user *) data,
+ if (copy_from_user(&siginfo, (siginfo_t __user *) datap,
sizeof siginfo))
ret = -EFAULT;
else
@@ -623,7 +624,7 @@ int ptrace_request(struct task_struct *child, long request,
}
mmput(mm);
- ret = put_user(tmp, (unsigned long __user *) data);
+ ret = put_user(tmp, datap);
break;
}
#endif
@@ -652,7 +653,7 @@ int ptrace_request(struct task_struct *child, long request,
case PTRACE_SETREGSET:
{
struct iovec kiov;
- struct iovec __user *uiov = (struct iovec __user *) data;
+ struct iovec __user *uiov = (struct iovec __user *) datap;
if (!access_ok(VERIFY_WRITE, uiov, sizeof(*uiov)))
return -EFAULT;
@@ -742,7 +743,7 @@ int generic_ptrace_peekdata(struct task_struct *tsk, long addr, long data)
copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
if (copied != sizeof(tmp))
return -EIO;
- return put_user(tmp, (unsigned long __user *)data);
+ return put_user(tmp, (unsigned long __user __force *)data);
}
int generic_ptrace_pokedata(struct task_struct *tsk, long addr, long data)
--
1.7.0.4
--
