2 files changed, 14 insertions(+), 6 deletions(-)

M pc/mem.h
M pc/trap.c

@@ 73,8 73,8 @@
 #define	UESEG	4	/* user executable */
 #define TSSSEG	5	/* task segment */
 
-#define SELGDT	(0<<3)	/* selector is in gdt */
-#define	SELLDT	(1<<3)	/* selector is in ldt */
+#define SELGDT	(0<<2)	/* selector is in gdt */
+#define	SELLDT	(1<<2)	/* selector is in ldt */
 
 #define SELECTOR(i, t, p)	(((i)<<3) | (t) | (p))
 

@@ 483,14 483,22 @@ noted(Ureg* ureg, ulong arg0)
 	/* sanity clause */
 	oureg = (ulong)nureg;
 	if(!okaddr((ulong)oureg-BY2WD, BY2WD+sizeof(Ureg), 0)){
-		pprint("bad ureg in noted or call to noted() when not notified\n");
+		pprint("bad ureg in noted or call to noted when not notified\n");
 		qunlock(&up->debug);
 		pexit("Suicide", 0);
 	}
 
-	/* don't let user change text or stack segments */
-	nureg->cs = ureg->cs;
-	nureg->ss = ureg->ss;
+	/*
+	 * Check the segment selectors are all valid, otherwise
+	 * a fault will be taken on attempting to return to the
+	 * user process.
+	 */
+	if(nureg->cs != UESEL || nureg->ss != UDSEL || nureg->ds != UDSEL
+	  || nureg->es != UDSEL || nureg->fs != UDSEL || nureg->gs != UDSEL){
+		pprint("bad segement selector in noted\n");
+		qunlock(&up->debug);
+		pexit("Suicide", 0);
+	}
 
 	/* don't let user change system flags */
 	nureg->flags = (ureg->flags & ~0xCD5) | (nureg->flags & 0xCD5);