• R/O
  • HTTP
  • SSH
  • HTTPS

linux-2.4.36: Commit

2.4.36-stable kernel tree


Commit MetaInfo

Revisione43de1caaa32af8fbdc9714413c6d74476537275 (tree)
Zeit2006-10-03 05:07:05
AutorPaX Team <pageexec@free...>
CommiterWilly Tarreau

Log Message

[PATCH] MIPS: fix long long cast in pte macro

From PaX Team :
the current idiom used for initializing a structure of two unsigned longs
from unsigned long long is wrong, it effectively loses the upper 32 bits
which in this particular case could turn a non-executable PTE into an
executable one on NX capable i386 (i.e., it's a potential security bug).
fortunately the in-tree users in 2.4 (drivers/char/drm-4.0/ffb_drv.c
and arch/mips/baget/baget.c) are not affected.

From Ralf Baechle :
I need a slight change to get this to build without warning for MIPS.
The argument passed to pte() might be just a 32-bit int, so >> 32 will
upset gcc big time. I believe the same problem exists for i386, so
here's the patch with the necessary cast for both architectures.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Ändern Zusammenfassung

Diff

--- a/include/asm-mips/page.h
+++ b/include/asm-mips/page.h
@@ -77,13 +77,16 @@ static inline void copy_user_page(void * to, void * from, unsigned long vaddr)
7777 #ifdef CONFIG_CPU_MIPS32
7878 typedef struct { unsigned long pte_low, pte_high; } pte_t;
7979 #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
80+ #define __pte(x) ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
8081 #else
8182 typedef struct { unsigned long long pte_low; } pte_t;
8283 #define pte_val(x) ((x).pte_low)
84+ #define __pte(x) ((pte_t) { (x) } )
8385 #endif
8486 #else
8587 typedef struct { unsigned long pte_low; } pte_t;
8688 #define pte_val(x) ((x).pte_low)
89+#define __pte(x) ((pte_t) { (x) } )
8790 #endif
8891
8992 typedef struct { unsigned long pmd; } pmd_t;
@@ -96,7 +99,6 @@ typedef struct { unsigned long pgprot; } pgprot_t;
9699
97100 #define ptep_buddy(x) ((pte_t *)((unsigned long)(x) ^ sizeof(pte_t)))
98101
99-#define __pte(x) ((pte_t) { (x) } )
100102 #define __pmd(x) ((pmd_t) { (x) } )
101103 #define __pgd(x) ((pgd_t) { (x) } )
102104 #define __pgprot(x) ((pgprot_t) { (x) } )
Show on old repository browser