On Tuesday 08 November 2005 05:39, Zachary Amsden wrote: > IA-32 linear address translation is loads of fun. Thanks for doing that audit work. Can you please double check x86-64 code is ok? Actually giving all that complexity maybe it would be better to just stop handling the case and remove all that. I'm not sure what kprobes needs it for - it doesn't even handle user space yet and even if it ever does it is unlikely that handling 16bit code makes much sense. And the prefetch workaround does it, but 16bit DOS code is unlikely to contain prefetches anyways. And for ptrace - well, who cares? I suppose dosemu has an own debugger anyways and it could be handled in user space (i suppose they still have that code from 2.4 anyways) > While cleaning up the LDT code, I noticed that kprobes code was very bogus > with respect to segment handling. Many, many bugs are fixed here. I chose > to combine the three separate functions that try to do linear address > conversion into one, nice and working functions. All of the versions had > bugs. > > 1) Taking an int3 from v8086 mode could cause the kprobes code to read a > non-existent LDT. > > 2) The CS value was not truncated to 16 bit, which could cause an access > beyond the bounds of the LDT. That's a (small) security hole, isn't it? -Andi
