Bug 8765

Most recent kernel where this bug did not occur:
    unknown

Distribution:
    gentoo

Hardware Environment:
    dell latitude d800, 2Ghz Penitum-M, 2GB ram   

Problem Description:
    it is possible to cause the kernel to reference a null pointer with simple ptrace code. the OOPS seems to indicate that it occurs in arch_ptrace. I noticed  when working on my debugger, that if i set the childs CS to certain invalid values, instead of a segfault (i believe this is the correct response to invalid cs). Not only would the ptraced app crash, but so would the debugger. After further investigation, I realized that the debugger crash was the kernel terminating the ptracer due to a null pointer in one of the ptrace functions.

Steps to reproduce:
run the following program:
----snip-test.c----
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/user.h>
#include <sys/wait.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

int main(void) {
        pid_t pid = fork();
        struct user_regs_struct regs;
        int status;
        int retval;

        switch(pid) {
        case 0:
                /* child */
                while(1) {
                        sleep(1);
                }
                break;
        case -1:
                /* error */
                break;
        default:
                /* parent */
                ptrace(PTRACE_ATTACH, pid, 0, 0);
                retval = waitpid(pid, &status, 0);
                printf("[waitpid] %d\n", retval);
                ptrace(PTRACE_GETREGS, pid, 0, &regs);
                regs.xcs = 0xff;
                ptrace(PTRACE_SETREGS, pid, 0, &regs);
                retval = ptrace(PTRACE_SINGLESTEP, pid, 0, 0);
                /* DOESN'T GET HERE */
                printf("[ptrace] %d\n", retval);
                retval = waitpid(pid, &status, 0);
                printf("[waitpid] %d\n", retval);
                ptrace(PTRACE_SINGLESTEP, pid, 0, 0);
                break;
        }
        return 0;
}
----snip-test.c----