d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Relax the check for bad LDTE allocations. It turns out that

Browse Source 
there is code that blindly allocates LDTEs starting at slot 6
and I quess it doesn't really matter to us if they overwrite the BSDI
syscall slot, since it isn't a BSDI binary. Also add some code to help track
down other such users (commented out for now).

Reviewed by:	deischen@
This commit is contained in:
julian 2003-08-02 06:52:36 +00:00
parent cd7b955e65
commit 145ea2a06a
1 changed files with 21 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
sys/i386/i386/sys_machdep.c
View File

@ -410,6 +410,11 @@ i386_get_ldt(td, args)
return(error);
}
#ifdef DEBUG
static int ldt_warnings;
#define NUM_LDT_WARNINGS 10
#endif
static int
i386_set_ldt(td, args)
struct thread *td;
@ -441,7 +446,7 @@ i386_set_ldt(td, args)
uap->start = NLDT;
uap->num = MAX_LD - NLDT;
}
if (uap->start < NLDT || uap->num <= 0)
if (uap->start <= LUDATA_SEL || uap->num <= 0)
return (EINVAL);
mtx_lock_spin(&sched_lock);
pldt = mdp->md_ldt;
@ -460,10 +465,18 @@ i386_set_ldt(td, args)
}
if (!(uap->start == 0 && uap->num == 1)) {
#ifdef DEBUG
/* complain a for a while if using old methods */
if (ldt_warnings++ < NUM_LDT_WARNINGS) {
printf("Warning: pid %d used static ldt allocation.\n",
td->td_proc->p_pid);
printf("See the i386_set_ldt man page for more info\n");
}
#endif
/* verify range of descriptors to modify */
largest_ld = uap->start + uap->num;
if (uap->start < NLDT || uap->start >= MAX_LD || uap->num < 0 ||
largest_ld > MAX_LD) {
if (uap->start <= LUDATA_SEL || uap->start >= MAX_LD ||
uap->num < 0 || largest_ld > MAX_LD) {
return (EINVAL);
}
}
@ -562,7 +575,11 @@ i386_set_ldt(td, args)
again:
mtx_lock_spin(&sched_lock);
dp = &((union descriptor *)(pldt->ldt_base))[NLDT];
for (i = NLDT; i < pldt->ldt_len; ++i) {
/*
* start scanning a bit up to leave room for NVidia and
* Wine, which still user the "Blat" method of allocation.
*/
for (i = NLDT + 1; i < pldt->ldt_len; ++i) {
if (dp->sd.sd_type == SDT_SYSNULL)
break;
dp++;