RE: FW: i386 Linux kernel DoS (clarification)

From: Alan Cox (alan@lxorguk.ukuu.org.uk)
Date: Wed Nov 13 2002 - 16:36:54 EST


Try this

(In the Linus Torvalds tradition its not tested)

--- arch/i386/kernel/entry.S~ 2002-11-13 21:30:37.000000000 +0000
+++ arch/i386/kernel/entry.S 2002-11-13 21:29:47.000000000 +0000
@@ -126,6 +126,7 @@
 ENTRY(lcall7)
         pushfl # We get a different stack layout with call
                                 # gates, which has to be cleaned up later..
+ andl $~0x4500, (%esp) # Clear NT since we are doing an iret
         pushl %eax
         SAVE_ALL
         movl EIP(%esp), %eax # due to call gates, this is eflags, not eip..
@@ -148,6 +149,7 @@
 ENTRY(lcall27)
         pushfl # We get a different stack layout with call
                                 # gates, which has to be cleaned up later..
+ andl $~0x4500, (%esp) # Clear NT since we are doing an iret
         pushl %eax
         SAVE_ALL
         movl EIP(%esp), %eax # due to call gates, this is eflags, not eip..
@@ -390,6 +392,9 @@
         pushl $do_divide_error
         ALIGN
 error_code:
+ pushfl
+ andl $~0x4500, (%esp) # NT must be clear, do a cld for free
+ popfl
         pushl %ds
         pushl %eax
         xorl %eax, %eax
@@ -400,7 +405,6 @@
         decl %eax # eax = -1
         pushl %ecx
         pushl %ebx
- cld
         movl %es, %ecx
         movl ORIG_EAX(%esp), %esi # get the error code
         movl ES(%esp), %edi # get the function address
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Fri Nov 15 2002 - 22:00:30 EST