summaryrefslogtreecommitdiff
path: root/sys/compat/linux
diff options
context:
space:
mode:
authormaxv <maxv@NetBSD.org>2017-10-19 10:01:09 +0000
committermaxv <maxv@NetBSD.org>2017-10-19 10:01:09 +0000
commit961a3f96032b29afca4e304d3d33daa05f56afb4 (patch)
tree21ade66494407acac0c7c43b4d3d3fb0d3d9fafc /sys/compat/linux
parentb4d75fd824e383f99c48c3b07df400af91f23b15 (diff)
Always mask the 16 bits of the segregs in the trapframe. We don't zero-
extend the uint64_t's when building it, so we're leaking 48 bits of kernel stack to userland. Having said that, it appears that I unintentionally fixed most of this issue in locore.S::rev1.127 - by building the frame with interrupts disabled, we are implicitly guaranteeing that the structure doesn't get overwritten by the kernel. Which means, we are leaking to userland data that comes from userland anyway. (still other places with this issue, but I'll fix them differently)
Diffstat (limited to 'sys/compat/linux')
-rw-r--r--sys/compat/linux/arch/amd64/linux_machdep.c16
1 files changed, 8 insertions, 8 deletions
diff --git a/sys/compat/linux/arch/amd64/linux_machdep.c b/sys/compat/linux/arch/amd64/linux_machdep.c
index a91164f8081..0c0db638d14 100644
--- a/sys/compat/linux/arch/amd64/linux_machdep.c
+++ b/sys/compat/linux/arch/amd64/linux_machdep.c
@@ -1,4 +1,4 @@
-/* $NetBSD: linux_machdep.c,v 1.53 2017/10/15 12:49:53 maxv Exp $ */
+/* $NetBSD: linux_machdep.c,v 1.54 2017/10/19 10:01:09 maxv Exp $ */
/*-
* Copyright (c) 2005 Emmanuel Dreyfus, all rights reserved.
@@ -33,7 +33,7 @@
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: linux_machdep.c,v 1.53 2017/10/15 12:49:53 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: linux_machdep.c,v 1.54 2017/10/19 10:01:09 maxv Exp $");
#include <sys/param.h>
#include <sys/types.h>
@@ -366,15 +366,15 @@ linux_sys_rt_sigreturn(struct lwp *l, const void *v, register_t *retval)
mctx->__gregs[_REG_RCX] = lsigctx->rcx;
mctx->__gregs[_REG_RIP] = lsigctx->rip;
mctx->__gregs[_REG_RFLAGS] = lsigctx->eflags;
- mctx->__gregs[_REG_CS] = lsigctx->cs;
- mctx->__gregs[_REG_GS] = lsigctx->gs;
- mctx->__gregs[_REG_FS] = lsigctx->fs;
+ mctx->__gregs[_REG_CS] = lsigctx->cs & 0xFFFF;
+ mctx->__gregs[_REG_GS] = lsigctx->gs & 0xFFFF;
+ mctx->__gregs[_REG_FS] = lsigctx->fs & 0xFFFF;
mctx->__gregs[_REG_ERR] = lsigctx->err;
mctx->__gregs[_REG_TRAPNO] = lsigctx->trapno;
- mctx->__gregs[_REG_ES] = tf->tf_es;
- mctx->__gregs[_REG_DS] = tf->tf_ds;
+ mctx->__gregs[_REG_ES] = tf->tf_es & 0xFFFF;
+ mctx->__gregs[_REG_DS] = tf->tf_ds & 0xFFFF;
mctx->__gregs[_REG_RSP] = lsigctx->rsp; /* XXX */
- mctx->__gregs[_REG_SS] = tf->tf_ss;
+ mctx->__gregs[_REG_SS] = tf->tf_ss & 0xFFFF;
/*
* FPU state