exec: delay address limit change until point of no return
A message that is not in the archive (sent off-list or not yet received): [email protected]
A message that is not in the archive (sent off-list or not yet received): [email protected]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This should be continuation of http://lkml.org/lkml/2011/7/27/488
Quoted 5 lines · Andi Kleen
Quoted 4 lines · halfdog
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Hello Mr. Kleen,
Quoted 7 lines
Quoted 4 lines
I saw your posting on lkml. Currently, I have no deep enough understanding of kernel memory management, so do you think, that delaying could make a otherwise irrelevant timerace in exec arg handling somehow problematic?
I guess it would be better to fix it. Can you post your analysis to [email protected] ? Feel free to cc me.
Please see
https://bugzilla.kernel.org/show_bug.cgi?id=39222
for analysis (Timerace in sys_execve when copying argv/env data from userspace)
Seems to be historic, but not critical timerace (POC available, but no crash, mem-leaks, ..).
- From my opinion, it should be possible to make the argv ptr go over the 0xc0000000 kernel/user split on x86 architectures, but I do not know if the patch in discussion would worsen the situation. Until now, I failed to trouble the kernel using this.
- --
http://www.halfdog.net/
PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFOMbgIxFmThv7tq+4RAqckAJoCeYCAdrxzWk4UXWtklubfvGR1RwCeMG+J Yj6zC0mawHkthGGA3kEPEa4=
=SLlm
-----END PGP SIGNATURE-----