| Date | Mon, 12 Dec 2011 18:30:19 +0100 | From | Oleg Nesterov <> | Subject | Re: [PATCH RFC 0/5] uprobes: kill xol vma |
| |
On 11/28, Oleg Nesterov wrote: > > On top of this series, not for inclusion yet, just to explain what > I mean. May be someone can test it ;) > > This series kills xol_vma. Instead we use the per_cpu-like xol slots. > > This is much more simple and efficient. And this of course solves > many problems we currently have with xol_vma. > > For example, we simply can not trust it. We do not know what actually > we are going to execute in UTASK_SSTEP mode. An application can unmap > this area and then do mmap(PROT_EXEC|PROT_WRITE, MAP_FIXED) to fool > uprobes. > > The only disadvantage is that this adds a bit more arch-dependant > code. > > The main question, can this work?
OK, it almost works.
But, this way we can't probe the compat tasks. A __USER32_CS task can't access the fix_to_virt() area, so it can't use uprobe_xol_slots[].
Many thanks to Josh who noticed this.
I'll try to think more, but so far I do not see any simple solution.
Oleg.
|