_save_fp_context corrupts kernel sp

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi all,
this bug was triggered by the 'crashme' program, which deliberately does
various bad things.

The problem occurs when _save_fp_context cannot write to the user stack.
Since the fixup
routine for this lacks a nop at the end, the following "random"
instruction is executed (in
my case it adjusted the stack pointer, which is pretty lethal).

The patch below corrects this.

Regards,
Tommy S. Christensen, Eicon Networks


--- r4k_fpu.S.orig      Sun Dec 10 08:56:02 2000
+++ r4k_fpu.S   Mon Apr  9 10:55:27 2001
@@ -94,6 +94,7 @@
         ctc1   t0,fcr31
        END(_restore_fp_context)
 
+       .set    reorder
        .type   fault@function
        .ent    fault
 fault: li      v0, -EFAULT



[Index of Archives]     [Linux MIPS Home]     [LKML Archive]     [Linux ARM Kernel]     [Linux ARM]     [Linux]     [Git]     [Yosemite News]     [Linux SCSI]     [Linux Hams]

  Powered by Linux