Attachment 37111 Details for Bug 83143

[patch] Check segment bases in ptrace correctly

ptrace-check-segment (text/plain), 1004 bytes, created by Andreas Kleen on 2005-05-13 15:35:01 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andreas Kleen

Created: 2005-05-13 15:35:01 UTC

Size: 1004 bytes

patch

obsolete

>Fix canonical checking for segment registers in ptrace
>
>Allowed user programs to set a non canonical segment base,
>which would cause oopses in the kernel later.
>
>Found by Alexander Nyberg
>
>Signed-off-by: Andi Kleen <ak@suse.de>
>
>Index: linux/arch/x86_64/kernel/ptrace.c
>===================================================================
>--- linux.orig/arch/x86_64/kernel/ptrace.c
>+++ linux/arch/x86_64/kernel/ptrace.c
>@@ -257,13 +257,13 @@ static int putreg(struct task_struct *ch
> 			value &= 0xffff;
> 			return 0;
> 		case offsetof(struct user_regs_struct,fs_base):
>-			if (!((value >> 48) == 0 || (value >> 48) == 0xffff))
>-				return -EIO; 
>+			if (value >= TASK_SIZE)
>+				return -EIO;
> 			child->thread.fs = value;
> 			return 0;
> 		case offsetof(struct user_regs_struct,gs_base):
>-			if (!((value >> 48) == 0 || (value >> 48) == 0xffff))
>-				return -EIO; 
>+			if (value >= TASK_SIZE)
>+				return -EIO;
> 			child->thread.gs = value;
> 			return 0;
> 		case offsetof(struct user_regs_struct, eflags):

Actions: View | Diff

Attachments on bug 83143: 36726 | 37111 | 38369