Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934746AbYBVVrQ (ORCPT ); Fri, 22 Feb 2008 16:47:16 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S933452AbYBVVnY (ORCPT ); Fri, 22 Feb 2008 16:43:24 -0500 Received: from mx1.suse.de ([195.135.220.2]:46467 "EHLO mx1.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757933AbYBVVnV (ORCPT ); Fri, 22 Feb 2008 16:43:21 -0500 Date: Fri, 22 Feb 2008 13:40:24 -0800 From: Greg KH To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: Justin Forbes , Zwane Mwaikambo , "Theodore Ts'o" , Randy Dunlap , Dave Jones , Chuck Wolber , Chris Wedgwood , Michael Krufky , Chuck Ebbert , Domenico Andreoli , torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Roland McGrath , Jeff Mahoney , Oliver Pinter Subject: [patch 08/23] Handle bogus %cs selector in single-step instruction decoding (CVE-2007-3731) Message-ID: <20080222214024.GI8686@suse.de> References: <20080222213114.583282464@mini.kroah.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline; filename="handle-bogus-cs-selector-in-single-step-instruction-decoding.patch" In-Reply-To: <20080222213927.GA8686@suse.de> User-Agent: Mutt/1.5.16 (2007-06-09) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2863 Lines: 100 2.6.22-stable review patch. If anyone has any objections, please let us know. ------------------ From: Roland McGrath Handle bogus %cs selector in single-step instruction decoding mainline: 29eb51101c02df517ca64ec472d7501127ad1da8 The code for LDT segment selectors was not robust in the face of a bogus selector set in %cs via ptrace before the single-step was done. Signed-off-by: Roland McGrath Signed-off-by: Linus Torvalds Acked-by: Jeff Mahoney CC: Oliver Pinter Signed-off-by: Greg Kroah-Hartman --- arch/i386/kernel/ptrace.c | 22 +++++++++++++++------- arch/x86_64/kernel/ptrace.c | 23 ++++++++++++++++------- 2 files changed, 31 insertions(+), 14 deletions(-) --- a/arch/i386/kernel/ptrace.c +++ b/arch/i386/kernel/ptrace.c @@ -164,14 +164,22 @@ static unsigned long convert_eip_to_line u32 *desc; unsigned long base; - down(&child->mm->context.sem); - desc = child->mm->context.ldt + (seg & ~7); - base = (desc[0] >> 16) | ((desc[1] & 0xff) << 16) | (desc[1] & 0xff000000); + seg &= ~7UL; - /* 16-bit code segment? */ - if (!((desc[1] >> 22) & 1)) - addr &= 0xffff; - addr += base; + down(&child->mm->context.sem); + if (unlikely((seg >> 3) >= child->mm->context.size)) + addr = -1L; /* bogus selector, access would fault */ + else { + desc = child->mm->context.ldt + seg; + base = ((desc[0] >> 16) | + ((desc[1] & 0xff) << 16) | + (desc[1] & 0xff000000)); + + /* 16-bit code segment? */ + if (!((desc[1] >> 22) & 1)) + addr &= 0xffff; + addr += base; + } up(&child->mm->context.sem); } return addr; --- a/arch/x86_64/kernel/ptrace.c +++ b/arch/x86_64/kernel/ptrace.c @@ -102,16 +102,25 @@ unsigned long convert_rip_to_linear(stru u32 *desc; unsigned long base; - down(&child->mm->context.sem); - desc = child->mm->context.ldt + (seg & ~7); - base = (desc[0] >> 16) | ((desc[1] & 0xff) << 16) | (desc[1] & 0xff000000); + seg &= ~7UL; - /* 16-bit code segment? */ - if (!((desc[1] >> 22) & 1)) - addr &= 0xffff; - addr += base; + down(&child->mm->context.sem); + if (unlikely((seg >> 3) >= child->mm->context.size)) + addr = -1L; /* bogus selector, access would fault */ + else { + desc = child->mm->context.ldt + seg; + base = ((desc[0] >> 16) | + ((desc[1] & 0xff) << 16) | + (desc[1] & 0xff000000)); + + /* 16-bit code segment? */ + if (!((desc[1] >> 22) & 1)) + addr &= 0xffff; + addr += base; + } up(&child->mm->context.sem); } + return addr; } -- -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/