lkml.org 
[lkml]   [1998]   [Aug]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [patch] Re: [2.1.117] GPF in APM while using WINE


On Tue, 25 Aug 1998, Linus Torvalds wrote:

> > But this was not my main point, now that all segment register loads and
> > even the iret is protected from exceptions, it might be time to remove
> > the bogus checks for selectors in restore_sigcontext. Hence the attached
> > patch (perhaps too aggressive, I'll admit). It will hopefully make
> > signal return faster and some thread libraries happier.
>
> There wasn't any patch..

Ok, this time appended and not as an attachment.

> Anyway, we _do_ have to check certain security things. The exception
> vector only checks that the selector is valid and loadable, but we have to
> verify that nobody can load a kernel selector (which _is_ allowed in
> kernel mode, and as such wouldn't trigger an exception).

Please look carefully at the description of iret: any segment register
(%[defg]s for this matter since %cs and %ss are reloaded by iret) whose
DPL is lower then the new CPL is automatically cleared. This is already in
my old 386 doc, explicitly mentioned to avoid a potential security hole.
Hopefully no processor running Linux is buggy in this respect.

And then there is a second security barrier: PTE attributes, which use
_current_ CPL and not the segment DPL (at least you cannot force force
page faults on a kernel only page by using a DPL=3 selector in the
kernel).

Maybe you are not yet convinced, but I tried my best.

And now the patch (again perhaps too aggressive), but it makes
restore_sigcontext almost branchless.

Gabriel.

--- linux-2.1.117-vanilla/arch/i386/kernel/signal.c Mon Aug 24 10:56:01 1998
+++ linux-2.1.117/arch/i386/kernel/signal.c Tue Aug 25 09:52:14 1998
@@ -184,26 +184,17 @@

#define COPY_SEG(seg) \
{ unsigned short tmp; \
- err |= __get_user(tmp, &sc->seg); \
- if ((tmp & 0xfffc) /* not a NULL selectors */ \
- && (tmp & 0x4) != 0x4 /* not a LDT selector */ \
- && (tmp & 3) != 3) /* not a RPL3 GDT selector */ \
- goto badframe; \
+ err |= __get_user(tmp, &sc->seg); \
regs->x##seg = tmp; }

#define COPY_SEG_STRICT(seg) \
{ unsigned short tmp; \
err |= __get_user(tmp, &sc->seg); \
- if ((tmp & 0xfffc) && (tmp & 3) != 3) goto badframe; \
- regs->x##seg = tmp; }
+ regs->x##seg = tmp|3; }

#define GET_SEG(seg) \
{ unsigned short tmp; \
err |= __get_user(tmp, &sc->seg); \
- if ((tmp & 0xfffc) /* not a NULL selectors */ \
- && (tmp & 0x4) != 0x4 /* not a LDT selector */ \
- && (tmp & 3) != 3) /* not a RPL3 GDT selector */ \
- goto badframe; \
loadsegment(seg,tmp); }

GET_SEG(gs);


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

\
 
 \ /
  Last update: 2005-03-22 13:44    [W:0.041 / U:0.532 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site