diff options
| author | Andi Kleen <ak@suse.de> | 2005-05-17 00:53:30 -0400 |
|---|---|---|
| committer | Linus Torvalds <torvalds@ppc970.osdl.org> | 2005-05-17 10:59:15 -0400 |
| commit | f6b8d4778c04148729cc0b0dcd335a4411c44276 (patch) | |
| tree | 04ebfb8aba4f0354a2840886b2d06972faf18a2d /arch/x86_64 | |
| parent | d1099e8a18960693c04507bdd7b9403db70bfd97 (diff) | |
[PATCH] x86_64: Fix canonical checking for segment registers in ptrace
Allowed user programs to set a non canonical segment base, which would cause
oopses in the kernel later.
Credit-to: Alexander Nyberg <alexn@dsv.su.se>
For identifying and reporting this bug.
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'arch/x86_64')
| -rw-r--r-- | arch/x86_64/kernel/ptrace.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/arch/x86_64/kernel/ptrace.c b/arch/x86_64/kernel/ptrace.c index 892212161aa8..60dc9b98951d 100644 --- a/arch/x86_64/kernel/ptrace.c +++ b/arch/x86_64/kernel/ptrace.c | |||
| @@ -257,13 +257,13 @@ static int putreg(struct task_struct *child, | |||
| 257 | value &= 0xffff; | 257 | value &= 0xffff; |
| 258 | return 0; | 258 | return 0; |
| 259 | case offsetof(struct user_regs_struct,fs_base): | 259 | case offsetof(struct user_regs_struct,fs_base): |
| 260 | if (!((value >> 48) == 0 || (value >> 48) == 0xffff)) | 260 | if (value >= TASK_SIZE) |
| 261 | return -EIO; | 261 | return -EIO; |
| 262 | child->thread.fs = value; | 262 | child->thread.fs = value; |
| 263 | return 0; | 263 | return 0; |
| 264 | case offsetof(struct user_regs_struct,gs_base): | 264 | case offsetof(struct user_regs_struct,gs_base): |
| 265 | if (!((value >> 48) == 0 || (value >> 48) == 0xffff)) | 265 | if (value >= TASK_SIZE) |
| 266 | return -EIO; | 266 | return -EIO; |
| 267 | child->thread.gs = value; | 267 | child->thread.gs = value; |
| 268 | return 0; | 268 | return 0; |
| 269 | case offsetof(struct user_regs_struct, eflags): | 269 | case offsetof(struct user_regs_struct, eflags): |