From: Pavel Machek <pavel@suse.cz>
To: Avi Kivity <avi@qumranet.com>
Cc: Andrew Morton <akpm@osdl.org>, Ingo Molnar <mingo@elte.hu>,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] Make LIST_POISON less deadly
Date: Tue, 20 May 2008 18:47:58 +0200 [thread overview]
Message-ID: <20080520164758.GA8531@elf.ucw.cz> (raw)
In-Reply-To: <1211125094-32167-1-git-send-email-avi@qumranet.com>
On Sun 2008-05-18 18:38:14, Avi Kivity wrote:
> The list macros use LIST_POISON1 and LIST_POISON2 as undereferencable
> pointers in order to trap erronous use of freed list_heads. Unfortunately
> userspace can arrange for those pointers to actually be dereferencable,
> potentially turning an oops to an expolit.
>
> To avoid this allow architectures (currently x86_64 only) to override
> the default values for these pointers with truly-undereferncable values.
> This is easy on x86_64 as the virtual address space is smaller than
> the range spanned by pointer values.
"Security hole unless arch maintainer does _foo_" sounds
scary. Especially when i386 is hard to fix...
(And very nice catch, btw).
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
next prev parent reply other threads:[~2008-05-20 16:47 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-05-18 15:38 [PATCH] Make LIST_POISON less deadly Avi Kivity
2008-05-19 13:01 ` Ingo Molnar
2008-05-19 13:18 ` Avi Kivity
2008-05-19 13:22 ` Ingo Molnar
2008-05-19 13:35 ` Avi Kivity
2008-05-19 13:45 ` Avi Kivity
2008-05-19 19:04 ` Sam Ravnborg
2008-05-20 7:06 ` Avi Kivity
2008-05-20 11:24 ` Andi Kleen
2008-05-20 11:34 ` Avi Kivity
2008-05-20 11:49 ` Andi Kleen
2008-05-20 11:52 ` Avi Kivity
2008-05-20 12:04 ` Andi Kleen
2008-05-20 12:04 ` Ingo Molnar
2008-05-20 16:47 ` Pavel Machek [this message]
2008-05-20 16:50 ` Avi Kivity
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20080520164758.GA8531@elf.ucw.cz \
--to=pavel@suse.cz \
--cc=akpm@osdl.org \
--cc=avi@qumranet.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@elte.hu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox