]> bbs.cooldavid.org Git - net-next-2.6.git/commit
arch/tile: don't allow user code to set the PL via ptrace or signal return
authorChris Metcalf <cmetcalf@tilera.com>
Thu, 28 Oct 2010 19:47:06 +0000 (15:47 -0400)
committerChris Metcalf <cmetcalf@tilera.com>
Mon, 1 Nov 2010 19:31:17 +0000 (15:31 -0400)
commit1deb9c5dfb179819ecdbf80a1d121e26c63caab3
treec6f6ec6030eb22f094a65c07e63312758d079794
parent34a89d26bdc4ba46a406fa3842239e921c493d44
arch/tile: don't allow user code to set the PL via ptrace or signal return

The kernel was allowing any component of the pt_regs to be updated either
by signal handlers writing to the stack, or by processes writing via
PTRACE_POKEUSR or PTRACE_SETREGS, which meant they could set their PL
up from 0 to 1 and get access to kernel code and data (or, in practice,
cause a kernel panic).  We now always reset the ex1 field, allowing the
user to set their ICS bit only.

Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
arch/tile/kernel/ptrace.c
arch/tile/kernel/signal.c