RE: FW: i386 Linux kernel DoS (clarification)

[Petr Vandrovec]

On 13 Nov 02 at 21:36, Alan Cox wrote:

> Try this
> 
> (In the Linus Torvalds tradition its not tested)

I'll test it, but before kernel compiles...
 
> --- arch/i386/kernel/entry.S~   2002-11-13 21:30:37.000000000 +0000
> +++ arch/i386/kernel/entry.S    2002-11-13 21:29:47.000000000 +0000
> @@ -126,6 +126,7 @@
>  ENTRY(lcall7)
>     pushfl          # We get a different stack layout with call
>                 # gates, which has to be cleaned up later..
> +   andl $~0x4500, (%esp)   # Clear NT since we are doing an iret

this will clear 'D' and 'T' in caller after we do
iret (if lcall7 returns, of course). I'm not sure that callers
expect that.

> @@ -390,6 +392,9 @@
>     pushl $do_divide_error
>     ALIGN
>  error_code:
> +   pushfl
> +   andl $~0x4500, (%esp)       # NT must be clear, do a cld for free
> +   popfl

I believe that NT should be automagically cleared by int.
                                                Best regards,
                                                      Petr Vandrovec
                                                      [e-mail]