On Wed, Mar 24, 2010 at 03:54:23PM -0600, Jonathan Corbet wrote: > Ah, but that's the point: these NULL pointer dereferences were not DoS > vulnerabilities - they were full privilege-escalation affairs. Since > then, some problems have been fixed and some distributors have started > shipping smarter configurations. But, on quite a few systems a NULL > dereference still has the potential to be fully exploitable; if there's > a possibility of it happening I think we should test for it. A DoS is > a much better outcome... You're pointing the finger at lack of VM_BUG_ON but the finger should be pointed in the code that shall enforce mmap_min_addr. That is the exploitable bug. I can't imagine any other ways VM_BUG_ON could help in preventing an exploit. Let's concentrate on mmap_min_addr and leave the code fast. If it's a small structure (<4096 bytes) we're talking about, I stand that VM_BUG_ON() is just pure CPU overhead. I do agree however for structures that may grow larger than 4096 bytes VM_BUG_ON isn't bad idea, and furthermore I think it's wrong to keep the min address at only 4096 bytes, it shall be like 100M or something. Then all of them can go away. That is way more effective than having to remember to add VM_BUG_ON(!null) when cpu can do it zero cost. -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxxx For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>