Andrea Arcangeli wrote:
>
> --- 2.4.0-test10/arch/i386/kernel/i387.c Thu Nov 2 20:58:58 2000
> +++ PIII/arch/i386/kernel/i387.c Thu Nov 2 18:44:36 2000
> @@ -440,8 +436,25 @@
> int set_fpxregs( struct task_struct *tsk, struct user_fxsr_struct *buf )
> {
> if ( HAVE_FXSR ) {
> - __copy_from_user( &tsk->thread.i387.fxsave, (void *)buf,
> - sizeof(struct user_fxsr_struct) );
> + long mxcsr;
> +
> + if (__copy_from_user(&tsk->thread.i387.fxsave, (void *)buf,
> + (long) &((struct user_fxsr_struct *)
> + 0)->mxcsr))
> + return -EFAULT;
> + if (__get_user(mxcsr,
> + &((struct user_fxsr_struct *) buf)->mxcsr))
> + return -EFAULT;
> + /* bit 6 and 31-16 must be zero for security reasons */
> + mxcsr &= 0xffbf;
> + tsk->thread.i387.fxsave.mxcsr = mxcsr;
> + if (__copy_from_user(&tsk->thread.i387.fxsave.reserved,
> + &((struct user_fxsr_struct *)
> + buf)->reserved,
> + sizeof(struct user_fxsr_struct)-
> + (long) &((struct user_fxsr_struct *)
> + 0)->reserved))
> + return -EFAULT;
> return 0;
> } else {
> return -EIO;
Why do all three copies? Why not copy it once and mask out the mxcsr
value when it's in tsk->thread.i387.fxsave.mxcsr? Seems to be an overly
complex fix.
if ( HAVE_FXSR ) {
if ( __copy_from_user( &tsk->thread.i387.fxsave, (void *)buf,
sizeof(struct user_fxsr_struct) ) )
return -EFAULT;
/* bit 6 and 31-16 must be zero for security reasons */
tsk->thread.i387.fxsave.mxcsr &= 0x0000ffbf;
return 0;
}
-- Gareth
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Tue Nov 07 2000 - 21:00:14 EST