Re: [PATCH] [57/99] exec: delay address limit change until point of no return

[halfdog <me@halfdog.net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This should be continuation of http://lkml.org/lkml/2011/7/27/488

Andi Kleen wrote:
> On Thu, Jul 28, 2011 at 07:52:57AM +0000, halfdog wrote:
>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>> 
>> Hello Mr. Kleen,
>> 
>> I saw your posting on lkml. Currently, I have no deep enough 
>> understanding of kernel memory management, so do you think, that 
>> delaying could make a otherwise irrelevant timerace in exec arg
>> handling somehow problematic?
> 
> I guess it would be better to fix it. Can you post your analysis to
> linux-kernel@vger.kernel.org ?  Feel free to cc me.

Please see
https://bugzilla.kernel.org/show_bug.cgi?id=39222
for analysis (Timerace in sys_execve when copying argv/env data from
userspace)

Seems to be historic, but not critical timerace (POC available, but no
crash, mem-leaks, ..).

- From my opinion, it should be possible to make the argv ptr go over the
0xc0000000 kernel/user split on x86 architectures, but I do not know if
the patch in discussion would worsen the situation. Until now, I failed
to trouble the kernel using this.

- -- 
http://www.halfdog.net/
PGP: 156A AE98 B91F 0114 FE88  2BD8 C459 9386 feed a bee
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFOMbgIxFmThv7tq+4RAqckAJoCeYCAdrxzWk4UXWtklubfvGR1RwCeMG+J
Yj6zC0mawHkthGGA3kEPEa4=
=SLlm
-----END PGP SIGNATURE-----