diff options
| author | Andi Kleen <ak@suse.de> | 2005-05-17 04:53:30 +0000 |
|---|---|---|
| committer | <chrisw@vas.sous-sol.org> | 2005-05-26 21:20:11 -0700 |
| commit | f51f3c46d7deaf3b957fefdce0c7e55d930f1c9f (patch) | |
| tree | 7387c97e3dafc359eba872b8159d6bf7d566a9e9 | |
| parent | 63a4a4f228c0de221779cd18c7ed9511d42c557b (diff) | |
| download | linux-stable-f51f3c46d7deaf3b957fefdce0c7e55d930f1c9f.tar.gz linux-stable-f51f3c46d7deaf3b957fefdce0c7e55d930f1c9f.tar.bz2 linux-stable-f51f3c46d7deaf3b957fefdce0c7e55d930f1c9f.zip | |
[PATCH] x86_64: Fix canonical checking for segment registers in ptrace
Allowed user programs to set a non canonical segment base, which would cause
oopses in the kernel later.
Credit-to: Alexander Nyberg <alexn@dsv.su.se>
For identifying and reporting this bug.
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@osdl.org>
| -rw-r--r-- | arch/x86_64/kernel/ptrace.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/arch/x86_64/kernel/ptrace.c b/arch/x86_64/kernel/ptrace.c index b2b7e347a671..cddc37a5415a 100644 --- a/arch/x86_64/kernel/ptrace.c +++ b/arch/x86_64/kernel/ptrace.c @@ -129,13 +129,13 @@ static int putreg(struct task_struct *child, value &= 0xffff; return 0; case offsetof(struct user_regs_struct,fs_base): - if (!((value >> 48) == 0 || (value >> 48) == 0xffff)) - return -EIO; + if (value >= TASK_SIZE) + return -EIO; child->thread.fs = value; return 0; case offsetof(struct user_regs_struct,gs_base): - if (!((value >> 48) == 0 || (value >> 48) == 0xffff)) - return -EIO; + if (value >= TASK_SIZE) + return -EIO; child->thread.gs = value; return 0; case offsetof(struct user_regs_struct, eflags): |