From mboxrd@z Thu Jan  1 00:00:00 1970
From: Chris Wright <chrisw@osdl.org>
Subject: Re: [PATCH] proper bounds check in do_set_gdt entry point
Date: Mon, 27 Jun 2005 13:00:53 -0700
Message-ID: <20050627200053.GC9046@shell0.pdx.osdl.net>
References: <20050627184157.GM9157@shell0.pdx.osdl.net>
	<97f95b5ed2852e5d2385e36c03a37e64@cl.cam.ac.uk>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Return-path: <xen-devel-bounces@lists.xensource.com>
Content-Disposition: inline
In-Reply-To: <97f95b5ed2852e5d2385e36c03a37e64@cl.cam.ac.uk>
List-Unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: Keir Fraser <Keir.Fraser@cl.cam.ac.uk>
Cc: Chris Wright <chrisw@osdl.org>, xen-devel@lists.xensource.com
List-Id: xen-devel@lists.xenproject.org

* Keir Fraser (Keir.Fraser@cl.cam.ac.uk) wrote:
> 
> On 27 Jun 2005, at 19:41, Chris Wright wrote:
> 
> >Unless I missed something, not bounds checking entries in do_set_gdt is
> >a security hole.
> >
> >Signed-off-by: Chris Wright <chrisw@osdl.org>
> 
> The check happens in set_gdt(). do_set_gdt is just a wrapper with a 
> copy_from_user plus conditional tlb flush.

I know, but copy_from_user has no sane limits.  This is stack smash.
-chris