Messages in this thread | | | Date | Tue, 10 Nov 2009 08:57:38 -0800 | From | Kees Cook <> | Subject | Re: [PATCH v4] [x86] detect and report lack of NX protections |
| |
On Tue, Nov 10, 2009 at 08:47:23AM -0800, H. Peter Anvin wrote: > On 11/10/2009 07:49 AM, Kees Cook wrote: > >> > >> The second clause can only get executed if CONFIG_X86_PAE is unset, > >> which in turn means _PAGE_NX == 0... so that piece of code is meaningless. > > > > CONFIG_X86_PAE is unset for x86_64, where _PAGE_NX is valid. (This was > > the main situation I was trying to address.) So that chunk runs for > > non-pae 32bit, and all 64bit: > > > > In reality, X86_PAE really should have been defined for 64 bits, since > 64 bits really is PAE in most aspects. > > Anyway, for the 64-bit case it looks like the proper place for any of > this is in check_efer() just below, not in this null routine.
64-bit does not set nx_enabled to "1" by default anywhere. And setting the default to 1 in check_efer() seemed out of place to me.
-Kees
-- Kees Cook Ubuntu Security Team
| |