Re: [PATCH 3/3] x86/sigreturn: Reject system segements

[Linus Torvalds]

On Sun, 17 Dec 2023 at 13:08, H. Peter Anvin <hpa@xxxxxxxxx> wrote:
>
> On December 13, 2023 10:54:00 AM PST, Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxx> wrote:
]> >Side note: the SS/CS checks could be stricter than the usual selector tests.
> >
> >In particular, normal segments can be Null segments. But CS/SS must not be.
> >
> >Also, since you're now checking the validity, maybe we shouldn't do
> >the "force cpl3" any more, and just make it an error to try to load a
> >non-cpl3 segment at sigreturn..
> >
> >That forcing was literally just because we weren't checking it for sanity...
> >
> >           Linus
>
> Not to mention that changing a null descriptor to 3 is wrong.

I don't think it is. All of 0-3 are "Null selectors". The RPL of the
selector simply doesn't matter when the index is zero, afaik.

But we obviously only do this for CS/SS, which can't be (any kind of)
Null selector and iret will GP on them regardless of the RPL in the
selector.

              Linus