https://bugs.kde.org/show_bug.cgi?id=514297

--- Comment #5 from [email protected] ---
Created attachment 189206
  --> https://bugs.kde.org/attachment.cgi?id=189206&action=edit
first experiment

Here is my first experiment that does not explode ;)  For me locally on
kernel-6.17.1-300.fc43.x86_64 it catches the guard page then
ML_(safe_to_deref)( (void*)(Addr)ARG1, 1)) returns false as expected.  My
program (also attached) calls open(p, O_RDONLY), which my glibc-2.42-5.fc43
apparently turns into something like

lseek(3, 274505416616, SEEK_SET)        = 274505416616

where the second arg is an address that in this specific case is a start of a
guard page.  But the patched is_valid_for() needs to work with arbitrary
addresses, so before checking the magic guard page bit 58, it first finds the
corresponding page for given address, and only after that it checks the guard
page status.

-- 
You are receiving this mail because:
You are watching all bug changes.

Reply via email to