On Tue, Jul 25, 2017 at 1:55 PM, Kees Cook <keescook@xxxxxxxxxxxx> wrote: > This implements refcount_t overflow protection on x86 without a noticeable > performance impact, though without the fuller checking of REFCOUNT_FULL. > This is done by duplicating the existing atomic_t refcount implementation > but with normally a single instruction added to detect if the refcount > has gone negative (e.g. wrapped past INT_MAX or below zero). When detected, > the handler saturates the refcount_t to INT_MIN / 2. With this overflow > protection, the erroneous reference release that would follow a wrap back > to zero is blocked from happening, avoiding the class of refcount-overflow > use-after-free vulnerabilities entirely. Hi Ingo, Friendly ping. Is there anything remaining for this patch to go into -tip? Thanks! -Kees -- Kees Cook Pixel Security
