[src/netbsd-1-4]: src/sys/arch/i386/i386 Pull up revision 1.55 (requested by ...

[he <he%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/21a6b66fbe47
branches:  netbsd-1-4
changeset: 471231:21a6b66fbe47
user:      he <he%NetBSD.org@localhost>
date:      Wed Jan 17 16:34:32 2001 +0000

description:
Pull up revision 1.55 (requested by sommerfeld):
  Validate gate targets correctly.

diffstat:

 sys/arch/i386/i386/sys_machdep.c |  13 ++++++++++++-
 1 files changed, 12 insertions(+), 1 deletions(-)

diffs (27 lines):

diff -r a2a1fc1691da -r 21a6b66fbe47 sys/arch/i386/i386/sys_machdep.c
--- a/sys/arch/i386/i386/sys_machdep.c  Thu Dec 14 22:39:02 2000 +0000
+++ b/sys/arch/i386/i386/sys_machdep.c  Wed Jan 17 16:34:32 2001 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: sys_machdep.c,v 1.47 1999/03/24 05:51:01 mrg Exp $     */
+/*     $NetBSD: sys_machdep.c,v 1.47.2.1 2001/01/17 16:34:32 he Exp $  */
 
 /*-
  * Copyright (c) 1998 The NetBSD Foundation, Inc.
@@ -319,6 +319,17 @@
                        break;
                case SDT_SYS286CGT:
                case SDT_SYS386CGT:
+                       /*
+                        * Only allow call gates targeting a segment
+                        * in the LDT or a user segment in the fixed
+                        * part of the gdt.  Segments in the LDT are
+                        * constrained (below) to be user segments.
+                        */
+                       if (desc.gd.gd_p != 0 && !ISLDT(desc.gd.gd_selector) &&
+                           ((IDXSEL(desc.gd.gd_selector) >= NGDT) ||
+                            (gdt[IDXSEL(desc.gd.gd_selector)].sd.sd_dpl !=
+                                SEL_UPL)))
+                               return (EACCES);
                        /* Can't replace in use descriptor with gate. */
                        if (n == fsslot || n == gsslot)
                                return (EBUSY);