Commit 2e2aa4ce authored by Andi Kleen's avatar Andi Kleen Committed by Linus Torvalds

[PATCH] Fix ugly hole in x86-64 interrupt gates

There was a quite nasty long standing bug in the x86-64 port.  The
interrupt gates had a DPL of 3, allowing user space to trigger any
interrupt.  I have not found a way to exploit it this to crash the
kernel, but it definitely shouldn't happen.  It could e.g.  cause
problems with drivers that do not handle shared interrupt properly.

This also broke some programs who assumed that int <random number>
causes a signal.
parent 27da03fc
......@@ -822,7 +822,7 @@ void __init trap_init(void)
set_intr_gate(19,&simd_coprocessor_error);
#ifdef CONFIG_IA32_EMULATION
set_intr_gate(IA32_SYSCALL_VECTOR, ia32_syscall);
set_system_gate(IA32_SYSCALL_VECTOR, ia32_syscall);
#endif
set_intr_gate(KDB_VECTOR, call_debug);
......
......@@ -95,12 +95,12 @@ static inline void _set_gate(void *adr, unsigned type, unsigned long func, unsig
static inline void set_intr_gate(int nr, void *func)
{
_set_gate(&idt_table[nr], GATE_INTERRUPT, (unsigned long) func, 3, 0);
_set_gate(&idt_table[nr], GATE_INTERRUPT, (unsigned long) func, 0, 0);
}
static inline void set_intr_gate_ist(int nr, void *func, unsigned ist)
{
_set_gate(&idt_table[nr], GATE_INTERRUPT, (unsigned long) func, 3, ist);
_set_gate(&idt_table[nr], GATE_INTERRUPT, (unsigned long) func, 0, ist);
}
static inline void set_system_gate(int nr, void *func)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment