DF-0115
sys_ptrace discards copyout error returning PT_IO descriptor
Summary
PT_IO post-processing copyout(&r.piod,...)(:114) explicitly discards error via (void)cast. If user unmaps uap->addr between copyin(:99) and copyout, transfer completes, syscall returns 0, but updated piod_len never delivered. Tracer desync. No memory safety impact.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0115 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | sys_ptrace discards copyout error returning PT_IO descriptor | 351 B | view raw |
Fix verification
fixedbaseline reproducedβ patch + rebuild βpatched clean
fix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
β fix.diffcombined build rc=0
Confirmed kernel references
β
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/sys_process.c:112: sys_ptrace discards copyout error returning PT_IO descriptor
Verified recommended fix
Source-confirmed at sys/kern/sys_process.c:112: sys_ptrace discards copyout error returning PT_IO descriptor
Verdict
Source-confirmed at sys/kern/sys_process.c:112: sys_ptrace discards copyout error returning PT_IO descriptor
No comments yet.