diff options
| author | Kees Cook <keescook@chromium.org> | 2020-06-19 12:20:15 -0700 |
|---|---|---|
| committer | Kees Cook <keescook@chromium.org> | 2020-07-10 16:01:52 -0700 |
| commit | fe4bfff86ec54773df3db79e8112e3b0f820c799 (patch) | |
| tree | cee16ed72bbd27d395c6394252ec9a9cd0160862 /include | |
| parent | 47e33c05f9f07cac3de833e531bcac9ae052c7ca (diff) | |
seccomp: Use -1 marker for end of mode 1 syscall list
The terminator for the mode 1 syscalls list was a 0, but that could be
a valid syscall number (e.g. x86_64 __NR_read). By luck, __NR_read was
listed first and the loop construct would not test it, so there was no
bug. However, this is fragile. Replace the terminator with -1 instead,
and make the variable name for mode 1 syscall lists more descriptive.
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/asm-generic/seccomp.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/include/asm-generic/seccomp.h b/include/asm-generic/seccomp.h index 1321ac7821d7..6b6f42bc58f9 100644 --- a/include/asm-generic/seccomp.h +++ b/include/asm-generic/seccomp.h @@ -33,7 +33,7 @@ static inline const int *get_compat_mode1_syscalls(void) static const int mode1_syscalls_32[] = { __NR_seccomp_read_32, __NR_seccomp_write_32, __NR_seccomp_exit_32, __NR_seccomp_sigreturn_32, - 0, /* null terminated */ + -1, /* negative terminated */ }; return mode1_syscalls_32; } |