Red Hat Bugzilla – Bug 245580
CVE-2007-3107 Data buffer miscompare on PowerPC when running HTX
Last modified: 2009-06-19 19:02:16 EDT
This bug has been copied from bug #245332 and has been proposed to be backported
to 5.0 z-stream (EUS).
Any update on the status of IBM testing on with the 2.6.18-8.1.8.el5 kernel ?
Testing of 2.6.18-8.1.8.el5 passed the HTX test-suite successfully.
We think that we are getting a page fault or timer interrupt during one of the
__copy_from_user calls in restore_sigcontext - the ones that write to
current->thread.fpr and current->thread.vr. Since we aren't clearing MSR_FP
and MSR_VEC until after the copy, switching to another process during the copy
will overwrite current->thread.fpr (assuming the signal handler used
floating-point instructions). If we clear those MSR bits before copying into
current->thread.fpr and/or current->thread.vr, like the 32-bit code already
does, we are safe -- and that's what we will do with this patch.
The bad news is that this bug was introduced in 2.6.2, so it is present in
RHEL4, SLES9 and SLES10 as well...
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.