Suppose all the telephone companies and ISPs announce clearly the days/weeks/years when they *don't* get NSLs. Would they be breaking the terms of the NSLs then? Or do we know that they all get NSLs, and we just don't know how many, or more importantly, what they say.

And Amazon is guaranteed to last forever and never change the terms of service.

Good point. The boundary would be any structure member offset from 0, like in the example. Otherwise, it could be the architectural page size (for x86 it'd be 4K).

But it doesn't need a boundary if checked at a stage where the original construct is still accessible. if ptr->member is used before ptr is checked for NULL, throw the warning. Most coding is not going to make a structure that starts at zero. I can imagine doing it in 16-bit real mode code, maybe, but not sure it'd happen even then, and then the warning could be disabled.

This would be useful, and in the kernel, most coders would be surprised by such an optimization and would rather fix the problem or, as has been the case with some truly unnecessary checks, remove them from the source.

I agree that gcc should make it a warning. It may be that it identifies it too late (in optimization) and no longer has line number info?

I also agree this is due to a kernel bug, but a warning could've eliminated that.

Why do we still allow users to map stuff at page 0? This compiler optimization is clever and useful, but it assumes that 0 is an invalid address (as it should be and usually is). The exploit is taking advantage of the fact that mmap to address 0 is allowed. To answer my own question: mmap to 0 might be useful for emulation sometimes, for example, if emulating an IBM-PC BIOS in 16-bit mode where physical memory 0 is valid. Also, it'd break things to change it now. We could require a special system setting before allowing users to do that, but that would also break things. However, there's hope for the NULL deref bugs in the kernel. I've seen patches to fix such problems which seem to be identified by static analysis tools, so someone's running them. Very interesting exploit, though.

Point taken, but perhaps "view source" doesn't show you the original source. It makes sense that they would strip comments before putting it on the server. I

Well, lah-di-dah. I didn't choose the place of my birth, but I think I come from an OK place, too.
And I have two engineering degrees, so there! :-)

I don't think the units had as much to do with it as the ambiguity of area vs. dimensional size.
Since the original posting had said "measured 25 mm square" it wasn't clear whether it
was referring to it's area or actual dimensions. Go have a pint of ale on me.