Messages in this thread | | | Date | Mon, 27 Jan 2014 10:01:21 +0800 | From | Ren Qiaowei <> | Subject | Re: [PATCH v3 3/4] x86, mpx: add prctl commands PR_MPX_INIT, PR_MPX_RELEASE |
| |
On 01/26/2014 11:14 PM, Ingo Molnar wrote: > > * Ren, Qiaowei <qiaowei.ren@intel.com> wrote: > >> The size of one bound table is 4M bytes for 64bit, and 16K bytes for >> 32bit. It can not be accessed by user-space, and it will be accessed >> automatically by hardware. > > So, here's the bound-table allocation AFAICS: > > +static bool allocate_bt(unsigned long bd_entry) > +{ > + unsigned long bt_size = 1UL << (MPX_L2_BITS+MPX_L2_SHIFT); > + unsigned long bt_addr, old_val = 0; > + > + bt_addr = sys_mmap_pgoff(0, bt_size, PROT_READ | PROT_WRITE, > + MAP_ANONYMOUS | MAP_PRIVATE | MAP_POPULATE, -1, 0); > > What ensures that user-space cannot access (and in particular, modify) > the pages at bt_addr? It's a read-write anonymous mapping AFAICS. > Looks like that we can not be able to ensure this. I just mean that user-space doesn't know the bound tables, and it should not access them also.
Thanks, Qiaowei
| |