Messages in this thread |  | | Date | Sat, 04 Nov 2000 10:50:00 +1100 | From | Gareth Hughes <> | Subject | Re: SETFPXREGS fix |
| |
Andrea Arcangeli wrote: > > --- 2.4.0-test10/arch/i386/kernel/i387.c Thu Nov 2 20:58:58 2000 > +++ PIII/arch/i386/kernel/i387.c Thu Nov 2 18:44:36 2000 > @@ -440,8 +436,25 @@ > int set_fpxregs( struct task_struct *tsk, struct user_fxsr_struct *buf ) > { > if ( HAVE_FXSR ) { > - __copy_from_user( &tsk->thread.i387.fxsave, (void *)buf, > - sizeof(struct user_fxsr_struct) ); > + long mxcsr; > + > + if (__copy_from_user(&tsk->thread.i387.fxsave, (void *)buf, > + (long) &((struct user_fxsr_struct *) > + 0)->mxcsr)) > + return -EFAULT; > + if (__get_user(mxcsr, > + &((struct user_fxsr_struct *) buf)->mxcsr)) > + return -EFAULT; > + /* bit 6 and 31-16 must be zero for security reasons */ > + mxcsr &= 0xffbf; > + tsk->thread.i387.fxsave.mxcsr = mxcsr; > + if (__copy_from_user(&tsk->thread.i387.fxsave.reserved, > + &((struct user_fxsr_struct *) > + buf)->reserved, > + sizeof(struct user_fxsr_struct)- > + (long) &((struct user_fxsr_struct *) > + 0)->reserved)) > + return -EFAULT; > return 0; > } else { > return -EIO;
Why do all three copies? Why not copy it once and mask out the mxcsr value when it's in tsk->thread.i387.fxsave.mxcsr? Seems to be an overly complex fix.
if ( HAVE_FXSR ) { if ( __copy_from_user( &tsk->thread.i387.fxsave, (void *)buf, sizeof(struct user_fxsr_struct) ) ) return -EFAULT; /* bit 6 and 31-16 must be zero for security reasons */ tsk->thread.i387.fxsave.mxcsr &= 0x0000ffbf; return 0; }
-- Gareth - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org Please read the FAQ at http://www.tux.org/lkml/
|  |