diff options
| author | Andi Kleen <ak@suse.de> | 2005-05-16 21:53:30 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@ppc970.osdl.org> | 2005-05-17 07:59:15 -0700 |
| commit | f6b8d4778c04148729cc0b0dcd335a4411c44276 (patch) | |
| tree | 04ebfb8aba4f0354a2840886b2d06972faf18a2d /arch | |
| parent | d1099e8a18960693c04507bdd7b9403db70bfd97 (diff) | |
| download | op-kernel-dev-f6b8d4778c04148729cc0b0dcd335a4411c44276.zip op-kernel-dev-f6b8d4778c04148729cc0b0dcd335a4411c44276.tar.gz | |
[PATCH] x86_64: Fix canonical checking for segment registers in ptrace
Allowed user programs to set a non canonical segment base, which would cause
oopses in the kernel later.
Credit-to: Alexander Nyberg <alexn@dsv.su.se>
For identifying and reporting this bug.
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/x86_64/kernel/ptrace.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/arch/x86_64/kernel/ptrace.c b/arch/x86_64/kernel/ptrace.c index 8922121..60dc9b9 100644 --- a/arch/x86_64/kernel/ptrace.c +++ b/arch/x86_64/kernel/ptrace.c @@ -257,13 +257,13 @@ static int putreg(struct task_struct *child, value &= 0xffff; return 0; case offsetof(struct user_regs_struct,fs_base): - if (!((value >> 48) == 0 || (value >> 48) == 0xffff)) - return -EIO; + if (value >= TASK_SIZE) + return -EIO; child->thread.fs = value; return 0; case offsetof(struct user_regs_struct,gs_base): - if (!((value >> 48) == 0 || (value >> 48) == 0xffff)) - return -EIO; + if (value >= TASK_SIZE) + return -EIO; child->thread.gs = value; return 0; case offsetof(struct user_regs_struct, eflags): |
