It adds range checks to ptrace and to the slow system call path.
I've been feeding this sporadically to Linus for the last couple of months
with no result. If anyone can clue me in as to what would make this more
acceptable, please do so.
Jeff
diff -Naur -X ../exclude-files orig/arch/i386/kernel/entry.S
um/arch/i386/kernel/entry.S
--- orig/arch/i386/kernel/entry.S Sat Sep 25 10:09:14 1999
+++ um/arch/i386/kernel/entry.S Sat Sep 25 10:10:03 1999
@@ -237,9 +237,11 @@
movl $-ENOSYS,EAX(%esp)
call SYMBOL_NAME(syscall_trace)
movl ORIG_EAX(%esp),%eax
+ cmpl $(NR_syscalls),%eax
+ jae 1f
call *SYMBOL_NAME(sys_call_table)(,%eax,4)
movl %eax,EAX(%esp) # save the return value
- call SYMBOL_NAME(syscall_trace)
+1: call SYMBOL_NAME(syscall_trace)
jmp ret_from_sys_call
badsys:
movl $-ENOSYS,EAX(%esp)
diff -Naur -X ../exclude-files orig/arch/i386/kernel/ptrace.c
um/arch/i386/kernel/ptrace.c
--- orig/arch/i386/kernel/ptrace.c Sat Aug 7 22:46:11 1999
+++ um/arch/i386/kernel/ptrace.c Tue Aug 3 13:43:42 1999
@@ -73,7 +73,9 @@
{
switch (regno >> 2) {
case ORIG_EAX:
- return -EIO;
+ if (value >= NR_syscalls)
+ return -EIO;
+ break;
case FS:
if (value && (value & 3) != 3)
return -EIO;
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/