Messages in this thread | | | Date | Tue, 15 Nov 2011 07:20:23 -0800 | From | Tejun Heo <> | Subject | Re: [PATCH 1/4] Routine for generating an safe ID for kernel pointer |
| |
On Tue, Nov 15, 2011 at 03:36:33PM +0400, Pavel Emelyanov wrote: > +unsigned long gen_object_id(void *ptr) > +{ > + if (!ptr) > + return 0; > + > + if (unlikely(!ptr_poison)) { > + spin_lock(&ptr_poison_lock); > + if (!ptr_poison) > + get_random_bytes(&ptr_poison, sizeof(ptr_poison)); > + spin_unlock(&ptr_poison_lock); > + }
One thing that worries me about this is that there's one ptr_poison for all id's and any single leak of a pointer value will make all ids vulnerable. If we're going to do this, let's segregate different id spaces and use different poison values for each.
Thank you.
-- tejun
| |