aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorVlad Malov <Vlad.Malov@caviumnetworks.com>2008-11-18 15:05:46 -0800
committerRalf Baechle <ralf@linux-mips.org>2008-12-04 17:47:26 +0000
commite807f9574e37a3f202e677feaaad1b7c5d2c0db8 (patch)
treea9b61e4d8f4e53a81df3bb14df0a4c2b037d8d81
parentfeaf3848a813a106f163013af6fcf6c4bfec92d9 (diff)
MIPS: Fix potential DOS by untrusted user app.
On a 64 bit kernel if an o32 syscall was made with a syscall number less than 4000, we would read the function from outside of the bounds of the syscall table. This led to non-deterministic behavior including system crashes. While we were at it we reworked the 32 bit version as well to use fewer instructions. Both 32 and 64 bit versions are use the same code now. Signed-off-by: Vlad Malov <Vlad.Malov@caviumnetworks.com> Signed-off-by: David Daney <ddaney@caviumnetworks.com> Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
-rw-r--r--arch/mips/kernel/scall32-o32.S5
-rw-r--r--arch/mips/kernel/scall64-o32.S12
2 files changed, 6 insertions, 11 deletions
diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
index 759f68066b5..34a4dbd76f2 100644
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -262,14 +262,11 @@ bad_alignment:
LEAF(sys_syscall)
subu t0, a0, __NR_O32_Linux # check syscall number
sltiu v0, t0, __NR_O32_Linux_syscalls + 1
+ beqz t0, einval # do not recurse
sll t1, t0, 3
beqz v0, einval
-
lw t2, sys_call_table(t1) # syscall routine
- li v1, 4000 - __NR_O32_Linux # index of sys_syscall
- beq t0, v1, einval # do not recurse
-
/* Some syscalls like execve get their arguments from struct pt_regs
and claim zero arguments in the syscall table. Thus we have to
assume the worst case and shuffle around all potential arguments.
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index 6c7ef8313eb..facb41a76d1 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -174,14 +174,12 @@ not_o32_scall:
END(handle_sys)
LEAF(sys32_syscall)
- sltu v0, a0, __NR_O32_Linux + __NR_O32_Linux_syscalls + 1
+ subu t0, a0, __NR_O32_Linux # check syscall number
+ sltiu v0, t0, __NR_O32_Linux_syscalls + 1
+ beqz t0, einval # do not recurse
+ dsll t1, t0, 3
beqz v0, einval
-
- dsll v0, a0, 3
- ld t2, (sys_call_table - (__NR_O32_Linux * 8))(v0)
-
- li v1, 4000 # indirect syscall number
- beq a0, v1, einval # do not recurse
+ ld t2, sys_call_table(t1) # syscall routine
move a0, a1 # shift argument registers
move a1, a2