Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 2 Aug 2017 11:54:24 -0700
From: Kees Cook <>
To: Ingo Molnar <>
Cc: Peter Zijlstra <>, Josh Poimboeuf <>, 
	Christoph Hellwig <>, "Eric W. Biederman" <>, 
	Andrew Morton <>, Jann Horn <>, 
	Eric Biggers <>, Elena Reshetova <>, 
	Hans Liljestrand <>, Greg KH <>, 
	Alexey Dobriyan <>, "Serge E. Hallyn" <>,, 
	Davidlohr Bueso <>, Manfred Spraul <>, 
	"" <>, James Bottomley <>, 
	"" <>, Arnd Bergmann <>, "David S. Miller" <>, 
	Rik van Riel <>, LKML <>, 
	linux-arch <>, 
	"" <>
Subject: Re: [PATCH v9] x86/asm: Implement fast refcount overflow protection

On Tue, Jul 25, 2017 at 1:55 PM, Kees Cook <> wrote:
> This implements refcount_t overflow protection on x86 without a noticeable
> performance impact, though without the fuller checking of REFCOUNT_FULL.
> This is done by duplicating the existing atomic_t refcount implementation
> but with normally a single instruction added to detect if the refcount
> has gone negative (e.g. wrapped past INT_MAX or below zero). When detected,
> the handler saturates the refcount_t to INT_MIN / 2. With this overflow
> protection, the erroneous reference release that would follow a wrap back
> to zero is blocked from happening, avoiding the class of refcount-overflow
> use-after-free vulnerabilities entirely.

Hi Ingo,

Friendly ping. Is there anything remaining for this patch to go into -tip?



Kees Cook
Pixel Security

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.