From: Andi Kleen <andi@firstfloor.org>
To: castet.matthieu@free.fr
Cc: linux-kernel@vger.kernel.org
Subject: Re: Using x86 segments against NULL pointer deference exploit
Date: Fri, 06 Nov 2009 21:18:58 +0100 [thread overview]
Message-ID: <87eiob76fh.fsf@basil.nowhere.org> (raw)
In-Reply-To: <1257512389.4af41dc504e1b@imp.free.fr> (castet matthieu's message of "Fri, 06 Nov 2009 13:59:49 +0100")
castet.matthieu@free.fr writes:
> Hi,
>
> I am wondering why we can't set the KERNEL_DS data segment to not contain the
> first page, ie changing it from R/W flat model to R/W expand down from
> 0xffffffff to 4096.
As Alan pointed out setting segment limits/bases has large penalties.
This has been already addressed by the mmap limit defaults
on the VM level by disallowing to place something on the zero page.
In fact a lot of systems should already run with that default.
> PS : why x86_64 segment got access bit set and x86_32 doesn't ?
It's a extremly minor optimization, but the CPU sets it on the first
access anyways.
-Andi
--
ak@linux.intel.com -- Speaking for myself only.
next prev parent reply other threads:[~2009-11-06 20:18 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-11-06 12:59 Using x86 segments against NULL pointer deference exploit castet.matthieu
2009-11-06 13:13 ` Alan Cox
2009-11-06 20:35 ` matthieu castet
2009-11-09 6:30 ` H. Peter Anvin
2009-11-06 20:18 ` Andi Kleen [this message]
2009-11-08 14:38 ` matthieu castet
2009-11-08 19:41 ` Andi Kleen
2009-11-06 20:58 ` Jiri Kosina
2009-11-06 22:54 ` H. Peter Anvin
2009-11-07 10:20 ` Jiri Kosina
[not found] <dDwJH-3PE-7@gated-at.bofh.it>
2009-11-10 16:46 ` Markku Savela
2009-11-11 14:11 ` Jiri Kosina
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87eiob76fh.fsf@basil.nowhere.org \
--to=andi@firstfloor.org \
--cc=castet.matthieu@free.fr \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.