summaryrefslogtreecommitdiff
path: root/sys/arch/i386/i386/sys_machdep.c
diff options
context:
space:
mode:
Diffstat (limited to 'sys/arch/i386/i386/sys_machdep.c')
-rw-r--r--sys/arch/i386/i386/sys_machdep.c11
1 files changed, 11 insertions, 0 deletions
diff --git a/sys/arch/i386/i386/sys_machdep.c b/sys/arch/i386/i386/sys_machdep.c
index b4bba0601c2..b1fb6877cfc 100644
--- a/sys/arch/i386/i386/sys_machdep.c
+++ b/sys/arch/i386/i386/sys_machdep.c
@@ -240,6 +240,17 @@ i386_set_ldt(p, args, retval)
break;
case SDT_SYS286CGT:
case SDT_SYS386CGT:
+ /*
+ * Only allow call gates targeting a segment
+ * in the LDT or a user segment in the fixed
+ * part of the gdt. Segments in the LDT are
+ * constrained (below) to be user segments.
+ */
+ if (desc.gd.gd_p != 0 && !ISLDT(desc.gd.gd_selector) &&
+ ((IDXSEL(desc.gd.gd_selector) >= NGDT) ||
+ (gdt[IDXSEL(desc.gd.gd_selector)].sd.sd_dpl !=
+ SEL_UPL)))
+ return (EACCES);
/* Can't replace in use descriptor with gate. */
if (n == fsslot || n == gsslot)
return (EBUSY);