Question

Given an untrusted memory address, is there a way in Linux to test whether it points to valid, accessible memory?

For example, in mach you can use vm_read_overwrite() to attempt to copy data from the specified location. If the address is invalid or inaccessible, it will return an error code rather than crashing the process.

Answer 1

This a typical case of TOCTOU – you check at some point that the memory is writeable, then later on you try to write to it, and somehow (e.g. because the application deallocated it), the memory is no longer accessible.

There is only one valid way to actually do this, and that is, trap the fault you get from writing to it when you actually need to use it.

Of course, you can use tricks to try to figure out if the memory “may be writeable”, but there is no way you can actually ensure it is writeable.

You may want to explain slightly more what you are actually trying to do, and maybe we can have some better ideas if you are more specific.