lkml.org 
[lkml]   [2017]   [Apr]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH] x86/refcount: Implement fast refcount_t handling
On 25 Apr 2017 at 12:23, Peter Zijlstra wrote:

> So what avoids this:

simple, you noted it yourself in your previous mail:

> Well, your setup (panic_on_warn et al) would have it panic the box. That
> will effectively stop the exploit by virtue of stopping everything.

with that in mind the actual code looks like this:

> CPU0 CPU1
>
>
> lock inc %[val]; # 0x7fffffff
> jo 2f
>1: ...
>
> lock dec %[val]; # 0x80000000
> jo 2f
> 1: ...
>
>
>
>
>2: mov $0x7fffffff, %[val]

panic()

> jmp 1b
>
> 2: mov $0x80000000, %[val]

panic()

> jmp 1b
>

... and we never get this far.

\
 
 \ /
  Last update: 2017-04-25 13:28    [W:2.248 / U:0.016 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site