michaelh/zephyr
1
0
Fork 0
Code Releases Activity

arch: arc: fix the bug of blt in syscall

Browse source 
blt is signed comparsion, if r6 is a negative number created by
malicious code, it will pass the check, bring a secure risk.

use blo (unsinged comparison) to do the check.

Signed-off-by: Wayne Ren <wei.ren@synopsys.com>
This commit is contained in:
Wayne Ren 2020-03-07 12:41:47 +08:00 • committed by Johan Hedberg
commit 5f0650b596
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
arch/arc/core/fault_s.S
View file

@ -206,7 +206,7 @@ SECTION_SUBSEC_FUNC(TEXT,__fault,__ev_trap)
/* do sys_call */ /* do sys_call */
mov_s ilink, K_SYSCALL_LIMIT mov_s ilink, K_SYSCALL_LIMIT
cmp r6, ilink cmp r6, ilink
blt valid_syscall_id blo valid_syscall_id
mov_s r0, r6 mov_s r0, r6
mov_s r6, K_SYSCALL_BAD mov_s r6, K_SYSCALL_BAD