Changeset 4fc93d5 in mainline

Timestamp:

2012-07-26T21:46:57Z (13 years ago)

Author:

Jakub Jermar <jakub@…>

Branches:

lfn, master, serial, ticket/834-toolchain-update, topic/msim-upgrade, topic/simplify-dev-export

Children:

d30b14f

Parents:

8f4f444

Message:

Sanitize the SYSRET vulnerability on Intel amd64 processors.

File:

• kernel/arch/amd64/src/asm.S (modified) (2 diffs)

kernel/arch/amd64/src/asm.S

@@ -362 +362 @@
          */
         call syscall_handler
-        
+
+        /*
+         * Test if the saved return address is canonical and not-kernel.
+         * We do this by looking at the 16 most significant bits
+         * of the saved return address (two bytes at offset 6).
+         */
+        testw $0xffff, ISTATE_OFFSET_RIP+6(%rsp)
+        jnz bad_rip 
+
         cli
         
@@ -388 +396 @@
         sysretq
 
+bad_rip:
+        movq %rsp, %rdi
+        movabs $bad_rip_msg, %rsi
+        callq fault_from_uspace
+        /* not reached */
+        
+bad_rip_msg:
+        .asciz "Invalid instruction pointer."
+
 /** Print Unicode character to EGA display.
  *