Messages in this thread | | | Date | Wed, 24 Mar 2010 15:54:23 -0600 | From | Jonathan Corbet <> | Subject | Re: [PATCH 07/11] Memory compaction core |
| |
On Wed, 24 Mar 2010 22:47:42 +0100 Andrea Arcangeli <aarcange@redhat.com> wrote:
> I think you mistaken a VM_BUG_ON for a: > > if (could_be_null->something) { > WARN_ON(1); > return -ESOMETHING; > } > > adding a VM_BUG_ON(inode->something) would _still_ be as exploitable > as the null pointer deference, because it's a DoS. It's not really a > big deal of an exploit but it _sure_ need fixing.
Ah, but that's the point: these NULL pointer dereferences were not DoS vulnerabilities - they were full privilege-escalation affairs. Since then, some problems have been fixed and some distributors have started shipping smarter configurations. But, on quite a few systems a NULL dereference still has the potential to be fully exploitable; if there's a possibility of it happening I think we should test for it. A DoS is a much better outcome...
jon
| |