Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 29eb5110 authored by Roland McGrath's avatar Roland McGrath Committed by Linus Torvalds
Browse files

Handle bogus %cs selector in single-step instruction decoding 



The code for LDT segment selectors was not robust in the face of a bogus
selector set in %cs via ptrace before the single-step was done.

Signed-off-by: default avatarRoland McGrath <roland@redhat.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent a267c0a8

arch/i386/kernel/ptrace.c

+15 −7
Original line number Diff line number Diff line
@@ -164,14 +164,22 @@ static unsigned long convert_eip_to_linear(struct task_struct *child, struct pt_ 
		u32 *desc;

		unsigned long base;



		seg &= ~7UL;



		down(&child->mm->context.sem);

		desc = child->mm->context.ldt + (seg & ~7);

		base = (desc[0] >> 16) | ((desc[1] & 0xff) << 16) | (desc[1] & 0xff000000);

		if (unlikely((seg >> 3) >= child->mm->context.size))

			addr = -1L; /* bogus selector, access would fault */

		else {

			desc = child->mm->context.ldt + seg;

			base = ((desc[0] >> 16) |

				((desc[1] & 0xff) << 16) |

				(desc[1] & 0xff000000));



			/* 16-bit code segment? */

			if (!((desc[1] >> 22) & 1))

				addr &= 0xffff;

			addr += base;

		}

		up(&child->mm->context.sem);

	}

	return addr;

arch/x86_64/kernel/ptrace.c

+16 −7
Original line number Diff line number Diff line
@@ -102,16 +102,25 @@ unsigned long convert_rip_to_linear(struct task_struct *child, struct pt_regs *r 
		u32 *desc;

		unsigned long base;



		seg &= ~7UL;



		down(&child->mm->context.sem);

		desc = child->mm->context.ldt + (seg & ~7);

		base = (desc[0] >> 16) | ((desc[1] & 0xff) << 16) | (desc[1] & 0xff000000);

		if (unlikely((seg >> 3) >= child->mm->context.size))

			addr = -1L; /* bogus selector, access would fault */

		else {

			desc = child->mm->context.ldt + seg;

			base = ((desc[0] >> 16) |

				((desc[1] & 0xff) << 16) |

				(desc[1] & 0xff000000));



			/* 16-bit code segment? */

			if (!((desc[1] >> 22) & 1))

				addr &= 0xffff;

			addr += base;

		}

		up(&child->mm->context.sem);

	}



	return addr;

}