patch-2.4.2 linux/arch/i386/kernel/i387.c

• Lines: 18
• Date: Sat Feb 3 12:09:34 2001
• Orig file: v2.4.1/linux/arch/i386/kernel/i387.c
• Orig date: Sat Feb 3 19:51:22 2001

diff -u --recursive --new-file v2.4.1/linux/arch/i386/kernel/i387.c linux/arch/i386/kernel/i387.c
@@ -216,7 +216,7 @@
 void set_fpu_mxcsr( struct task_struct *tsk, unsigned short mxcsr )
 {
 	if ( cpu_has_xmm ) {
-		tsk->thread.i387.fxsave.mxcsr = mxcsr;
+		tsk->thread.i387.fxsave.mxcsr = (mxcsr & 0xffbf);
 	}
 }
 
@@ -354,6 +354,8 @@
 	if ( __copy_from_user( &tsk->thread.i387.fxsave, &buf->_fxsr_env[0],
 			       sizeof(struct i387_fxsave_struct) ) )
 		return 1;
+	/* mxcsr bit 6 and 31-16 must be zero for security reasons */
+	tsk->thread.i387.fxsave.mxcsr &= 0xffbf;
 	return convert_fxsr_from_user( &tsk->thread.i387.fxsave, buf );
 }