Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 15 Mar 2013 01:31:22 +0400
From: "Dmitry V. Levin" <ldv@...linux.org>
To: owl-dev@...ts.openwall.com
Subject: Re: strace

On Thu, Mar 14, 2013 at 09:52:40PM +0100, Pavel Kankovsky wrote:
> On Thu, 14 Mar 2013, Dmitry V. Levin wrote:
> 
> >restart_syscall is syscall number 0.  Could the difference between older
> >and newer asm/ptrace.h versions be so fatal?
> 
> Regrettably, I have not paid much attention the development Owl recently, 
> therefore I do not know what are those older and newer versions but
> some reshuffling of pt_regs happened between 2.6.18 and 2.6.32.
> 
> 2.6.18:
> 
> struct pt_regs {
>         long ebx;
>         long ecx;
>         long edx;
>         long esi;
>         long edi;
>         long ebp;
>         long eax;
>         int  xds;
>         int  xes;
>         long orig_eax;
>         long eip;
>         int  xcs;
>         long eflags;
>         long esp;
>         int  xss;
> };
> 
> 2.6.32:
> 
> struct pt_regs {
>         long ebx;
>         long ecx;
>         long edx;
>         long esi;
>         long edi;
>         long ebp;
>         long eax;
>         int  xds;
>         int  xes;
>         int  xfs;
>         int  xgs;
>         long orig_eax;
>         long eip;
>         int  xcs;
>         long eflags;
>         long esp;
>         int  xss;
> };
> 
> orig_eax (syscall number) has shifted.

That's surely the reason.

> But why would it matter?

The change of orig_eax offset means that there was a change in the ptrace
ABI between 2.6.18 and 2.6.32, and all its users (e.g. strace and gdb)
should be rebuilt.

> strace uses user_regs_struct from user.h that 
> did not change and any changes in pt_regs layout should have been hidden 
> by the kernel.

strace used to fetch registers on x86 with PTRACE_PEEKUSER,
that was slow but no pt_regs was necessary.

strace started to use "struct pt_regs" from asm/ptrace.h with commit
v4.6-124-geb0e3e8 that introduced PTRACE_GETREGS on x86.

Recently (commit v4.7-82-g2550d48) strace was changed on x86* to stop
including asm/ptrace.h and use "struct user_regs_struct" instead.

> PS: De ja vu? <http://www.openwall.com/lists/owl-dev/2012/07/19/1> :)

Yes, exactly the same issue, thanks.


-- 
ldv

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ