From: "Andi Kleen" Allowed user programs to set a non canonical segment base, which would cause oopses in the kernel later. Credit-to: Alexander Nyberg For identifying and reporting this bug. Signed-off-by: Andi Kleen Signed-off-by: Andrew Morton --- arch/x86_64/kernel/ptrace.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff -puN arch/x86_64/kernel/ptrace.c~x86_64-fix-canonical-checking-for-segment-registers-in arch/x86_64/kernel/ptrace.c --- 25/arch/x86_64/kernel/ptrace.c~x86_64-fix-canonical-checking-for-segment-registers-in 2005-05-13 22:54:55.000000000 -0700 +++ 25-akpm/arch/x86_64/kernel/ptrace.c 2005-05-13 22:54:55.000000000 -0700 @@ -257,13 +257,13 @@ static int putreg(struct task_struct *ch value &= 0xffff; return 0; case offsetof(struct user_regs_struct,fs_base): - if (!((value >> 48) == 0 || (value >> 48) == 0xffff)) - return -EIO; + if (value >= TASK_SIZE) + return -EIO; child->thread.fs = value; return 0; case offsetof(struct user_regs_struct,gs_base): - if (!((value >> 48) == 0 || (value >> 48) == 0xffff)) - return -EIO; + if (value >= TASK_SIZE) + return -EIO; child->thread.gs = value; return 0; case offsetof(struct user_regs_struct, eflags): _