⬢ DragonFlyBSD Kernel Audit
DF-2898 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
diff --git a/sys/platform/pc64/x86_64/trap.c b/sys/platform/pc64/x86_64/trap.c
index 0000000..0000001 100644
--- a/sys/platform/pc64/x86_64/trap.c
+++ b/sys/platform/pc64/x86_64/trap.c
@@ -1402,6 +1402,8 @@ sys_xsyscall(struct sysmsg *sysmsg, const struct nosys_args *uap)
 	code = (u_int)frame->tf_rdi;
 	if (code >= p->p_sysent->sv_size)
 		code = SYS___nosys;
+	else if (code == SYS_syscall || code == SYS___syscall)
+		code = SYS___nosys;	/* DF-2898: no recursion via gateway */
 	argp = (union sysunion *)(&frame->tf_rdi + 1);
 	callp = &p->p_sysent->sv_table[code];
 	narg = callp->sy_narg;
diff --git a/sys/platform/vkernel64/x86_64/trap.c b/sys/platform/vkernel64/x86_64/trap.c
index 0000000..0000002 100644
--- a/sys/platform/vkernel64/x86_64/trap.c
+++ b/sys/platform/vkernel64/x86_64/trap.c
@@ -1228,6 +1228,8 @@ sys_xsyscall(struct sysmsg *sysmsg, const struct nosys_args *uap)
 	code = (u_int)frame->tf_rdi;
 	if (code >= td->td_proc->p_sysent->sv_size)
 		code = SYS___nosys;
+	else if (code == SYS_syscall || code == SYS___syscall)
+		code = SYS___nosys;	/* DF-2898: no recursion via gateway */
 	argp = (union sysunion *)(&frame->tf_rdi + 1);
 	callp = &td->td_proc->p_sysent->sv_table[code];
 	narg = callp->sy_narg;