crt0 MD _dl_exit() performs syscall to SYS_exit directly, but then

some of these functions were returning.  That makes the +1word address
a fairly strong and easily located gadget.  Put a hard-trap
instruction after the syscall.  This remains a gadget for 'terminal
system' calls (such as execve), but hey that's why we have pledge w/o
"exec" throughout the tree.
Quite surprisingly, hppa's delay-slot load of SYS_exit makes it the
safest of the bunch, not that this helps anyone.
ok kettenis

0 files changed, 0 insertions, 0 deletions