• Matthew Wilcox's avatar
    [PATCH] parisc: fix security hole · 527fda69
    Matthew Wilcox authored
    The default interruption handler "handle_interruption" does not properly
    check to see if the faulting space is the same as the users space.
    The problem lies in the fact that if a fault happens on the gateway we
    will not deliver signals to the process, the process will not die, and we
    may continue handling the same fault in a loop forever.  Any malicious
    user code can crash the kernel by jumping into the gateway page at an
    inopportune address.
    
    The solution is to check if the user has the right privilege and if the
    spaces match, both faulting and currently active. The best action is to
    force the process back to it's own space of execution at address zero, and
    let it take a SIGSEGV. The process can never recover from this because it
    happens immediately after the return from the interrupt via rfi or rfir.
    Committed-by: default avatarCarlos O'Donell <carlos@parisc-linux.org>
    527fda69
traps.c 19.7 KB