222086967adaab1101360729f746583ae3bcb262
[glsdk/meta-ti-glsdk.git] / recipes-kernel / linux / linux-ti33x-psp-3.2 / 3.2.2 / 0121-score-fix-off-by-one-index-into-syscall-table.patch
1 From 9e5123c755ee15680df171b9b871533faa20bd70 Mon Sep 17 00:00:00 2001
2 From: Dan Rosenberg <drosenberg@vsecurity.com>
3 Date: Fri, 20 Jan 2012 14:34:27 -0800
4 Subject: [PATCH 121/130] score: fix off-by-one index into syscall table
6 commit c25a785d6647984505fa165b5cd84cfc9a95970b upstream.
8 If the provided system call number is equal to __NR_syscalls, the
9 current check will pass and a function pointer just after the system
10 call table may be called, since sys_call_table is an array with total
11 size __NR_syscalls.
13 Whether or not this is a security bug depends on what the compiler puts
14 immediately after the system call table. It's likely that this won't do
15 anything bad because there is an additional NULL check on the syscall
16 entry, but if there happens to be a non-NULL value immediately after the
17 system call table, this may result in local privilege escalation.
19 Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
20 Cc: Chen Liqin <liqin.chen@sunplusct.com>
21 Cc: Lennox Wu <lennox.wu@gmail.com>
22 Cc: Eugene Teo <eugeneteo@kernel.sg>
23 Cc: Arnd Bergmann <arnd@arndb.de>
24 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
25 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
26 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
27 ---
28 arch/score/kernel/entry.S | 2 +-
29 1 file changed, 1 insertion(+), 1 deletion(-)
31 diff --git a/arch/score/kernel/entry.S b/arch/score/kernel/entry.S
32 index 577abba..83bb960 100644
33 --- a/arch/score/kernel/entry.S
34 +++ b/arch/score/kernel/entry.S
35 @@ -408,7 +408,7 @@ ENTRY(handle_sys)
36 sw r9, [r0, PT_EPC]
38 cmpi.c r27, __NR_syscalls # check syscall number
39 - bgtu illegal_syscall
40 + bgeu illegal_syscall
42 slli r8, r27, 2 # get syscall routine
43 la r11, sys_call_table
44 --
45 1.7.9.4