Created attachment 115326 [details]
close another path to the same hole
Aargh! David Mosberger e-mailed me last night with a concern that Matt's fix
only closed one code path that allowed ar.rsc to be set. He's right.
Here's my attempt at closing the ptrace_setregs() path too. Fresh out of the
tree. Untested (apart from that it compiles). No reviews yet either.
I have an ACK from David Mosberger that the new patch is OK.
But now Chris Wright has pointed out that restore_sigcontext() will also load
an arbitrary value into ar.rsc from userspace. So I'm stopping trying to rush
this into 2.6.12. It will go into 2.6.12.y.
Created attachment 115375 [details]
Fix restore_sigcontext() path too
This should be the final version. If there are no problems with it, then I
will release this on Wed June 22nd at noon PDT.
commit from 2.6.12 stable:
CAN-2005-1761 ptrace crasher
HP reported via Intel a way that on ia64 a local user could
write to the pl field via ptrace and therefore read/write
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.