diff options
| author | Chuck Ebbert <76306.1226@compuserve.com> | 2006-06-23 02:04:23 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2006-06-23 07:42:57 -0700 |
| commit | 21528454f6dd18231ae20102f98aa8f51b6ec1b9 (patch) | |
| tree | a167603f42c51c0e1a731ae9629305a11a5b8e44 /arch/i386/kernel/apic.c | |
| parent | 1b61b910e99059abdd54c93aa70e84e076e33d16 (diff) | |
| download | op-kernel-dev-21528454f6dd18231ae20102f98aa8f51b6ec1b9.zip op-kernel-dev-21528454f6dd18231ae20102f98aa8f51b6ec1b9.tar.gz | |
[PATCH] i386: let usermode execute the "enter" instruction
The i386 page fault handler does not allow enough slack when checking for
userspace access below the current stack pointer. This prevents use of the
enter instruction by user code. Fix this by allowing enough slack for
"enter $65535,$31" to execute.
Problem reported by Tomasz Malesinski <tmal@mimuw.edu.pl>
Tested using this program, based on the original from Tomasz:
.file "ovflow.S"
.version "01.01"
gcc2_compiled.:
.section .rodata
.LC0:
.string "asdf\n"
.text
.align 4
.globl main
.type main,@function
main:
nest_level=0
.rept 30
enter $0,$nest_level
nest_level=nest_level+1
.endr
enter $65535,$30
enter $65535,$31
addl $-12,%esp
pushl $.LC0
call printf
addl $16,%esp
.L2:
.rept 32
leave
.endr
ret
.Lfe1:
.size main,.Lfe1-main
.ident "GCC: (GNU) 2.95.4 20011002 (Debian prerelease)"
Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com>
Cc: Andi Kleen <ak@muc.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'arch/i386/kernel/apic.c')
0 files changed, 0 insertions, 0 deletions
