On Tue, Feb 26, 2019 at 11:45:51AM +0100, Peter Zijlstra wrote:
> On Tue, Feb 26, 2019 at 10:30:09AM +0100, Peter Zijlstra wrote:
> > On Mon, Feb 25, 2019 at 09:55:17AM -0800, Paul E. McKenney wrote:
> > > But if you know of any code in the Linux kernel that needs to compare
> > > pointers, one of which might be in the process of being freed, please
> > > do point me at it.
> >
> > I'm having the utmost difficulty of understanding why that would be a
> > problem. It's just a value. Freeing memory does not affect the actual
> > memory or any pointers to it.
> >
> > *confusion*
> >
> > None of this makes any kind of sense.
>
> I found and started to read:
>
> www.open-std.org/jtc1/sc22/wg14/www/docs/n2311.pdf
>
> and that's all massive bong-hits. That's utterly insane.
>
> Even the proposed semantics are crazy; they include UB and are therefore
> broken on principle. But also; the provenance ID has words like:
> "allocated storage duration", how is that well defined in the context of
> concurrent execution?
>
> Also, isn't the kernel filled with inter-object pointer arithmetic?
>
> PNVI also looks like something that simply cannot work; how are we at
> compile time supposed to know the active (concurrent modified) heap
> layout. What is a 'live' object?
Also; we need to find a GCC person to find/give us a knob to kill this
entire class of nonsense. This is just horrible broken shit:
~/tmp# gcc -O2 -fno-strict-aliasing -o ptr ptr.c ; ./ptr
p=0x5635dd3d5034 q=0x5635dd3d5034
x=1 y=2 *p=11 *q=2
~/tmp# cat ptr.c
#include <stdio.h>
#include <string.h>
int y = 2, x = 1;
int main (int argc, char **argv) {
int *p = &x + argc;
int *q = &y;
printf("p=%p q=%p\n", p, q);
if (!memcmp(&p, &q, sizeof(p))) {
*p = 11;
printf("x=%d y=%d *p=%d *q=%d\n", x, y, *p, *q);
}
}
