The patch titled
Subject: score: fix off-by-one index into syscall table
has been added to the -mm tree. Its filename is
score-fix-off-by-one-index-into-syscall-table.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/SubmitChecklist when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Dan Rosenberg <drosenberg@xxxxxxxxxxxxx>
Subject: score: fix off-by-one index into syscall table
If the provided system call number is equal to __NR_syscalls, the current
check will pass and a function pointer just after the system call table
may be called, since sys_call_table is an array with total size
__NR_syscalls.
Whether or not this is a security bug depends on what the compiler puts
immediately after the system call table. It's likely that this won't do
anything bad because there is an additional NULL check on the syscall
entry, but if there happens to be a non-NULL value immediately after the
system call table, this may result in local privilege escalation.
Signed-off-by: Dan Rosenberg <drosenberg@xxxxxxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx>
Cc: Chen Liqin <liqin.chen@xxxxxxxxxxxxx>
Cc: Lennox Wu <lennox.wu@xxxxxxxxx>
Cc: Eugene Teo <eugeneteo@xxxxxxxxx>
Cc: Arnd Bergmann <arnd@xxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
arch/score/kernel/entry.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff -puN arch/score/kernel/entry.S~score-fix-off-by-one-index-into-syscall-table arch/score/kernel/entry.S
--- a/arch/score/kernel/entry.S~score-fix-off-by-one-index-into-syscall-table
+++ a/arch/score/kernel/entry.S
@@ -408,7 +408,7 @@ ENTRY(handle_sys)
sw r9, [r0, PT_EPC]
cmpi.c r27, __NR_syscalls # check syscall number
- bgtu illegal_syscall
+ bgeu illegal_syscall
slli r8, r27, 2 # get syscall routine
la r11, sys_call_table
_
Subject: Subject: score: fix off-by-one index into syscall table
Patches currently in -mm which might be from drosenberg@xxxxxxxxxxxxx are
origin.patch
score-fix-off-by-one-index-into-syscall-table.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
