[lkml]   [2012]   [Jan]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[121/129] score: fix off-by-one index into syscall table
    3.2-stable review patch.  If anyone has any objections, please let me know.

    Content-Length: 1446
    Lines: 40

    From: Dan Rosenberg <>

    commit c25a785d6647984505fa165b5cd84cfc9a95970b upstream.

    If the provided system call number is equal to __NR_syscalls, the
    current check will pass and a function pointer just after the system
    call table may be called, since sys_call_table is an array with total
    size __NR_syscalls.

    Whether or not this is a security bug depends on what the compiler puts
    immediately after the system call table. It's likely that this won't do
    anything bad because there is an additional NULL check on the syscall
    entry, but if there happens to be a non-NULL value immediately after the
    system call table, this may result in local privilege escalation.

    Signed-off-by: Dan Rosenberg <>
    Cc: Chen Liqin <>
    Cc: Lennox Wu <>
    Cc: Eugene Teo <>
    Cc: Arnd Bergmann <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>

    arch/score/kernel/entry.S | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/arch/score/kernel/entry.S
    +++ b/arch/score/kernel/entry.S
    @@ -408,7 +408,7 @@ ENTRY(handle_sys)
    sw r9, [r0, PT_EPC]

    cmpi.c r27, __NR_syscalls # check syscall number
    - bgtu illegal_syscall
    + bgeu illegal_syscall

    slli r8, r27, 2 # get syscall routine
    la r11, sys_call_table

     \ /
      Last update: 2012-01-24 04:07    [W:0.019 / U:7.556 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site