doc/share/security/patches/SA-12:04/sysret-81-correction.patch
Bjoern A. Zeeb 3571e53040 Import FreeBSD Security Advisories and Errata Notices, as well as their
patches for easier mirroring, to eliminate a special copy, to make
www.freebsd.org/security a full copy of security.freebsd.org and be
eventually be the same.

For now files are just sitting there.   The symlinks are missing.

Discussed on:	www (repository location)
Discussed with:	simon (so)
2012-08-15 06:19:40 +00:00

48 lines
1.5 KiB
Diff

--- releng/8.1/sys/amd64/amd64/trap.c 2012/06/18 20:19:07 237240
+++ releng/8.1/sys/amd64/amd64/trap.c 2012/06/18 20:48:21 237241
@@ -972,23 +972,6 @@
ksi.ksi_code = TRAP_TRACE;
ksi.ksi_addr = (void *)frame->tf_rip;
trapsignal(td, &ksi);
-
- /*
- * If the user-supplied value of %rip is not a canonical
- * address, then some CPUs will trigger a ring 0 #GP during
- * the sysret instruction. However, the fault handler would
- * execute with the user's %gs and %rsp in ring 0 which would
- * not be safe. Instead, preemptively kill the thread with a
- * SIGBUS.
- */
- if (td->td_frame->tf_rip >= VM_MAXUSER_ADDRESS) {
- ksiginfo_init_trap(&ksi);
- ksi.ksi_signo = SIGBUS;
- ksi.ksi_code = BUS_OBJERR;
- ksi.ksi_trapno = T_PROTFLT;
- ksi.ksi_addr = (void *)td->td_frame->tf_rip;
- trapsignal(td, &ksi);
- }
}
/*
@@ -1027,4 +1010,21 @@
STOPEVENT(p, S_SCX, sa.code);
PTRACESTOP_SC(p, td, S_PT_SCX);
+
+ /*
+ * If the user-supplied value of %rip is not a canonical
+ * address, then some CPUs will trigger a ring 0 #GP during
+ * the sysret instruction. However, the fault handler would
+ * execute with the user's %gs and %rsp in ring 0 which would
+ * not be safe. Instead, preemptively kill the thread with a
+ * SIGBUS.
+ */
+ if (td->td_frame->tf_rip >= VM_MAXUSER_ADDRESS) {
+ ksiginfo_init_trap(&ksi);
+ ksi.ksi_signo = SIGBUS;
+ ksi.ksi_code = BUS_OBJERR;
+ ksi.ksi_trapno = T_PROTFLT;
+ ksi.ksi_addr = (void *)td->td_frame->tf_rip;
+ trapsignal(td, &ksi);
+ }
}