Index: sys_machdep.c
===================================================================
RCS file: /cvsroot/syssrc/sys/arch/i386/i386/sys_machdep.c,v
retrieving revision 1.54
retrieving revision 1.55
diff -c -r1.54 -r1.55
*** sys_machdep.c       2001/01/16 01:50:36     1.54
- --- sys_machdep.c     2001/01/16 23:32:21     1.55
***************
*** 222,227 ****
- --- 222,238 ----
                        break;
                case SDT_SYS286CGT:
                case SDT_SYS386CGT:
+                       /*
+                        * Only allow call gates targeting a segment
+                        * in the LDT or a user segment in the fixed
+                        * part of the gdt.  Segments in the LDT are
+                        * constrained (below) to be user segments.
+                        */
+                       if (desc.gd.gd_p != 0 && !ISLDT(desc.gd.gd_selector) &&
+                           ((IDXSEL(desc.gd.gd_selector) >= NGDT) ||
+                            (gdt[IDXSEL(desc.gd.gd_selector)].sd.sd_dpl !=
+                                SEL_UPL)))
+                               return (EACCES);
                        /* Can't replace in use descriptor with gate. */
                        if (n == fsslot || n == gsslot)
                                return (EBUSY);