On Tue, Jun 25, 2019 at 1:08 PM Kees Cook [off-list ref] wrote:
On Tue, Jun 25, 2019 at 05:15:27PM +0200, Florian Weimer wrote:
quoted
Should we try mapping something at the magic address (without MAP_FIXED)
and see if we get back a different address? Something in the auxiliary
vector would work for us, too, but nothing seems to exists there
unfortunately.
It seems like mmap() won't even work because it's in the high memory
area. I can't map something a page under the vsyscall page either, so I
can't distinguish it with mmap, mprotect, madvise, or msync. :(
I keep contemplating making munmap() work on it. That would nicely
answer the question: if munmap() fails, it's not there, and, if
munmap() succeeds, it's not there :)