Messages in this thread | | | From | Linus Torvalds <> | Date | Wed, 18 May 2011 03:08:54 -0700 | Subject | Re: [PATCH] x86, x86_64: Fix checks for userspace address limit |
| |
On Mon, May 16, 2011 at 4:42 AM, Ingo Molnar <mingo@elte.hu> wrote: > > Hm, something tickles me about this area that we would reintroduce a security > hole, that we really wanted to treat the last page of user-space as some sort > of guard page but i cannot quite remember it why ... > > IIRC Linus wrote bits of this so i'm Cc:-ing him just in case he remembers.
No, I suspect the patch is correct, and it's just a bug. I think it comes from the "get_user_X()" cases that afaik use "jae" because they add one less than the size (and thus avoid it entirely for the single-byte case). See "getuser.S" in the same directory.
But right now I think I need to do a 2.6.39 release later today (after I get some sleep), so doing it as a stable patch (presumably going back to pretty much the beginning of time) is probably the right thing.
Linus
| |