RE: FW: i386 Linux kernel DoS (clarification)

[Alan Cox]

Try this

(In the Linus Torvalds tradition its not tested)

--- arch/i386/kernel/entry.S~	2002-11-13 21:30:37.000000000 +0000
+++ arch/i386/kernel/entry.S	2002-11-13 21:29:47.000000000 +0000
@@ -126,6 +126,7 @@
 ENTRY(lcall7)
 	pushfl			# We get a different stack layout with call
 				# gates, which has to be cleaned up later..
+	andl $~0x4500, (%esp)	# Clear NT since we are doing an iret
 	pushl %eax
 	SAVE_ALL
 	movl EIP(%esp), %eax	# due to call gates, this is eflags, not eip..
@@ -148,6 +149,7 @@
 ENTRY(lcall27)
 	pushfl			# We get a different stack layout with call
 				# gates, which has to be cleaned up later..
+	andl $~0x4500, (%esp)	# Clear NT since we are doing an iret
 	pushl %eax
 	SAVE_ALL
 	movl EIP(%esp), %eax	# due to call gates, this is eflags, not eip..
@@ -390,6 +392,9 @@
 	pushl $do_divide_error
 	ALIGN
 error_code:
+	pushfl
+	andl $~0x4500, (%esp)		# NT must be clear, do a cld for free
+	popfl
 	pushl %ds
 	pushl %eax
 	xorl %eax, %eax
@@ -400,7 +405,6 @@
 	decl %eax			# eax = -1
 	pushl %ecx
 	pushl %ebx
-	cld
 	movl %es, %ecx
 	movl ORIG_EAX(%esp), %esi	# get the error code
 	movl ES(%esp), %edi		# get the function address