On Wed, 24 Mar 2010 22:47:42 +0100
Andrea Arcangeli <aarcange@xxxxxxxxxx> wrote:
> I think you mistaken a VM_BUG_ON for a:
>
> if (could_be_null->something) {
> WARN_ON(1);
> return -ESOMETHING;
> }
>
> adding a VM_BUG_ON(inode->something) would _still_ be as exploitable
> as the null pointer deference, because it's a DoS. It's not really a
> big deal of an exploit but it _sure_ need fixing.
Ah, but that's the point: these NULL pointer dereferences were not DoS
vulnerabilities - they were full privilege-escalation affairs. Since
then, some problems have been fixed and some distributors have started
shipping smarter configurations. But, on quite a few systems a NULL
dereference still has the potential to be fully exploitable; if there's
a possibility of it happening I think we should test for it. A DoS is
a much better outcome...
jon
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@xxxxxxxxxx For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>