6

This value was appeared in the poison.h (linux source\include\linux\poison.h):

/*
 * Architectures might want to move the poison pointer offset
 * into some well-recognized area such as 0xdead000000000000,
 * that is also not mappable by user-space exploits:
 */

I just curious about the special of the value 0xdead000000000000?

Magnilex
  • 11,584
  • 9
  • 62
  • 84
T-tssxuan
  • 83
  • 4

1 Answers1

10

Pretty sure this is just a variant of deadbeef; i.e. it's just an easily identified signal value (see http://en.wikipedia.org/wiki/Hexspeak for deadbeef)

The idea of pointer poisoning is to ensure that a poisoned list pointer can't be used without causing a crash. Say you unlink a structure from the list it was in. You then want to invalidate the pointer value to make sure it's not used again for traversing the list. If there's a bug somewhere in the code -- a dangling pointer reference -- you want to make sure that any code trying to follow the list through this now-unlinked node crashes immediately (rather than later in some possibly unrelated area of code).

Of course you can poison the pointer simply by putting a null value in it or any other invalid address. Using 0xdead000000000000 as the base value just makes it easier to distinguish an explicitly poisoned value from one that was initialized with zero or got overwritten with zeroes. And it can be used with an offset (LIST_POISON{1,2}) to create multiple distinct poison values that all point into unusable areas of the virtual address space and are identifiable as invalid at a glance.

Gil Hamilton
  • 11,973
  • 28
  • 51
  • So it just used when we debug the program. And I just wonder it it's any advantage comparing with the null value in capability? thanks, very much~(my English is not well, hope you can get it ^_^). – T-tssxuan Jan 07 '15 at 14:31
  • 1
    It's just easier to identify IMO. Also I believe the NULL address is mappable in user-space on some systems which violates `not mappable by user-space exploits` – tangrs Jan 08 '15 at 00:54