Re: [PATCH v9] x86/asm: Implement fast refcount overflow protection

[Kees Cook]

On Tue, Jul 25, 2017 at 1:55 PM, Kees Cook <keescook@xxxxxxxxxxxx> wrote:
> This implements refcount_t overflow protection on x86 without a noticeable
> performance impact, though without the fuller checking of REFCOUNT_FULL.
> This is done by duplicating the existing atomic_t refcount implementation
> but with normally a single instruction added to detect if the refcount
> has gone negative (e.g. wrapped past INT_MAX or below zero). When detected,
> the handler saturates the refcount_t to INT_MIN / 2. With this overflow
> protection, the erroneous reference release that would follow a wrap back
> to zero is blocked from happening, avoiding the class of refcount-overflow
> use-after-free vulnerabilities entirely.

Hi Ingo,

Friendly ping. Is there anything remaining for this patch to go into -tip?

Thanks!

-Kees

-- 
Kees Cook
Pixel Security