kern/146167: ptrace PT_DETACH undocumented behavior

[Gunnar Hinriksson]

>Number:         146167
>Category:       kern
>Synopsis:       ptrace PT_DETACH undocumented behavior
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Apr 30 02:10:01 UTC 2010
>Closed-Date:
>Last-Modified:
>Originator:     Gunnar Hinriksson
>Release:        8.0-RELEASE-p2
>Organization:
>Environment:
FreeBSD knut 8.0-RELEASE-p2 FreeBSD 8.0-RELEASE-p2 #0: Tue Apr 27 04:36:16 UTC 2010     gunnar at knut:/usr/obj/usr/src/sys/GENERIC  amd64
>Description:
When using PT_DETACH on ptrace the (caddr_t addr) parameter is not ignored like the documentation suggests.
Instead it proceeds to change the execution address to the value of the parameter if it is not (void *)1.
This can cause portability problems from other systems that implement ptrace and assume that the parameter is ignored.
>How-To-Repeat:
Write a program that uses ptrace to attach to another process and then detach with the parameter (caddr_t addr) value not equal to 1.
This can cause the child process to segfault.
>Fix:
Attached patch.

Patch attached with submission follows:

--- /usr/src/sys/kern/sys_process.c	2009-10-25 01:10:29.000000000 +0000
+++ sys_process.c	2010-04-30 01:32:52.507274805 +0000
@@ -741,10 +741,13 @@
 			break;
 		}
 
-		if (addr != (void *)1) {
-			error = ptrace_set_pc(td2, (u_long)(uintfptr_t)addr);
-			if (error)
-				break;
+		if (req == PT_CONTINUE)
+		{
+			if (addr != (void *)1) {
+				error = ptrace_set_pc(td2, (u_long)(uintfptr_t)addr);
+				if (error)
+					break;
+			}
 		}
 
 		if (req == PT_DETACH) {


>Release-Note:
>Audit-Trail:
>Unformatted: