Comment Re:TFA does a poor job of defining what's happenin (Score 4, Informative) 470
The TFA links to the actual paper. Maybe you should read that.
Towards Optimization-Safe Systems:Analyzing the Impact of Undefined Behavior
struct tun_struct *tun =
...;
struct sock *sk = tun->sk;
if (!tun)
return POLLERR;/* write to address based on tun */
For example, when gcc first sees the dereference tun->sk, it concludes that the pointer tun must be non-null, because the C standard states that dereferencing a null pointer is undefined [24:6.5.3]. Since tun is non-null, gcc further determines that the null pointer check is unnecessary and eliminates the check, making a privilege escalation exploit possible that would not otherwise be.