Messages in this thread | | | Date | Tue, 20 May 2008 18:47:58 +0200 | From | Pavel Machek <> | Subject | Re: [PATCH] Make LIST_POISON less deadly |
| |
On Sun 2008-05-18 18:38:14, Avi Kivity wrote: > The list macros use LIST_POISON1 and LIST_POISON2 as undereferencable > pointers in order to trap erronous use of freed list_heads. Unfortunately > userspace can arrange for those pointers to actually be dereferencable, > potentially turning an oops to an expolit. > > To avoid this allow architectures (currently x86_64 only) to override > the default values for these pointers with truly-undereferncable values. > This is easy on x86_64 as the virtual address space is smaller than > the range spanned by pointer values.
"Security hole unless arch maintainer does _foo_" sounds scary. Especially when i386 is hard to fix...
(And very nice catch, btw). Pavel
-- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
| |