diff options
| author | maxv <maxv@NetBSD.org> | 2017-10-19 10:01:09 +0000 |
|---|---|---|
| committer | maxv <maxv@NetBSD.org> | 2017-10-19 10:01:09 +0000 |
| commit | 961a3f96032b29afca4e304d3d33daa05f56afb4 (patch) | |
| tree | 21ade66494407acac0c7c43b4d3d3fb0d3d9fafc /sys/compat/linux | |
| parent | b4d75fd824e383f99c48c3b07df400af91f23b15 (diff) | |
Always mask the 16 bits of the segregs in the trapframe. We don't zero-
extend the uint64_t's when building it, so we're leaking 48 bits of kernel
stack to userland.
Having said that, it appears that I unintentionally fixed most of this
issue in locore.S::rev1.127 - by building the frame with interrupts
disabled, we are implicitly guaranteeing that the structure doesn't get
overwritten by the kernel. Which means, we are leaking to userland data
that comes from userland anyway.
(still other places with this issue, but I'll fix them differently)
Diffstat (limited to 'sys/compat/linux')
| -rw-r--r-- | sys/compat/linux/arch/amd64/linux_machdep.c | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/sys/compat/linux/arch/amd64/linux_machdep.c b/sys/compat/linux/arch/amd64/linux_machdep.c index a91164f8081..0c0db638d14 100644 --- a/sys/compat/linux/arch/amd64/linux_machdep.c +++ b/sys/compat/linux/arch/amd64/linux_machdep.c @@ -1,4 +1,4 @@ -/* $NetBSD: linux_machdep.c,v 1.53 2017/10/15 12:49:53 maxv Exp $ */ +/* $NetBSD: linux_machdep.c,v 1.54 2017/10/19 10:01:09 maxv Exp $ */ /*- * Copyright (c) 2005 Emmanuel Dreyfus, all rights reserved. @@ -33,7 +33,7 @@ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: linux_machdep.c,v 1.53 2017/10/15 12:49:53 maxv Exp $"); +__KERNEL_RCSID(0, "$NetBSD: linux_machdep.c,v 1.54 2017/10/19 10:01:09 maxv Exp $"); #include <sys/param.h> #include <sys/types.h> @@ -366,15 +366,15 @@ linux_sys_rt_sigreturn(struct lwp *l, const void *v, register_t *retval) mctx->__gregs[_REG_RCX] = lsigctx->rcx; mctx->__gregs[_REG_RIP] = lsigctx->rip; mctx->__gregs[_REG_RFLAGS] = lsigctx->eflags; - mctx->__gregs[_REG_CS] = lsigctx->cs; - mctx->__gregs[_REG_GS] = lsigctx->gs; - mctx->__gregs[_REG_FS] = lsigctx->fs; + mctx->__gregs[_REG_CS] = lsigctx->cs & 0xFFFF; + mctx->__gregs[_REG_GS] = lsigctx->gs & 0xFFFF; + mctx->__gregs[_REG_FS] = lsigctx->fs & 0xFFFF; mctx->__gregs[_REG_ERR] = lsigctx->err; mctx->__gregs[_REG_TRAPNO] = lsigctx->trapno; - mctx->__gregs[_REG_ES] = tf->tf_es; - mctx->__gregs[_REG_DS] = tf->tf_ds; + mctx->__gregs[_REG_ES] = tf->tf_es & 0xFFFF; + mctx->__gregs[_REG_DS] = tf->tf_ds & 0xFFFF; mctx->__gregs[_REG_RSP] = lsigctx->rsp; /* XXX */ - mctx->__gregs[_REG_SS] = tf->tf_ss; + mctx->__gregs[_REG_SS] = tf->tf_ss & 0xFFFF; /* * FPU state |
