lkml.org 
[lkml]   [2000]   [Nov]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: SETFPXREGS fix
Andrea Arcangeli wrote:
>
> --- 2.4.0-test10/arch/i386/kernel/i387.c Thu Nov 2 20:58:58 2000
> +++ PIII/arch/i386/kernel/i387.c Thu Nov 2 18:44:36 2000
> @@ -440,8 +436,25 @@
> int set_fpxregs( struct task_struct *tsk, struct user_fxsr_struct *buf )
> {
> if ( HAVE_FXSR ) {
> - __copy_from_user( &tsk->thread.i387.fxsave, (void *)buf,
> - sizeof(struct user_fxsr_struct) );
> + long mxcsr;
> +
> + if (__copy_from_user(&tsk->thread.i387.fxsave, (void *)buf,
> + (long) &((struct user_fxsr_struct *)
> + 0)->mxcsr))
> + return -EFAULT;
> + if (__get_user(mxcsr,
> + &((struct user_fxsr_struct *) buf)->mxcsr))
> + return -EFAULT;
> + /* bit 6 and 31-16 must be zero for security reasons */
> + mxcsr &= 0xffbf;
> + tsk->thread.i387.fxsave.mxcsr = mxcsr;
> + if (__copy_from_user(&tsk->thread.i387.fxsave.reserved,
> + &((struct user_fxsr_struct *)
> + buf)->reserved,
> + sizeof(struct user_fxsr_struct)-
> + (long) &((struct user_fxsr_struct *)
> + 0)->reserved))
> + return -EFAULT;
> return 0;
> } else {
> return -EIO;

Why do all three copies? Why not copy it once and mask out the mxcsr
value when it's in tsk->thread.i387.fxsave.mxcsr? Seems to be an overly
complex fix.

if ( HAVE_FXSR ) {
if ( __copy_from_user( &tsk->thread.i387.fxsave, (void *)buf,
sizeof(struct user_fxsr_struct) ) )
return -EFAULT;
/* bit 6 and 31-16 must be zero for security reasons */
tsk->thread.i387.fxsave.mxcsr &= 0x0000ffbf;
return 0;
}

-- Gareth
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 12:51    [W:0.044 / U:20.148 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site