| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sat, 18 Oct 2014 10:22:35 -0700 From: Dave Taht <dave.taht@...il.com> To: David Miller <davem@...emloft.net> Cc: Eric Dumazet <eric.dumazet@...il.com>, roy.qing.li@...il.com, "netdev@...r.kernel.org" <netdev@...r.kernel.org>, ghorbel@...asoftware.com Subject: Re: [PATCH] ipv6: fix a potential use after free in sit.c On Sat, Oct 18, 2014 at 10:07 AM, David Miller <davem@...emloft.net> wrote: > From: Eric Dumazet <eric.dumazet@...il.com> > Indeed, I wish we could somehow automate this. > > Yes, I'm sure we could construct some sparse et al. rules but > I mean at run time. For example, having a special pointer type > that you can't dereference directly. At the time of assignment > the pointer gets some kind of state, and pskb_may_pull() et al. > calls invalidate that "state". > > It probably could just be a 2-bit counter which is incremented > every time skb->data is reallocated. > > The captured 2-bit generation count could be stored in the low > bits of the pointer. > > Anyways, just throwing out ideas... So far as I know, the one machine linux has never been ported to was a LISP machine. With its 36 bit words, and tagging, that would do what you want. I had kind of hoped with 64 bits of addressing some of those ideas would have been reused. /me misses truly oddball architectures -- Dave Täht http://www.bufferbloat.net/projects/bloat/wiki/Upcoming_Talks -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists