On Wed, Apr 1, 2020 at 4:51 PM Linus Torvalds torvalds@linux-foundation.org wrote:
It's literally testing a sequence counter for equality. If you get tearing in the high bits on the write (or the read), you'd still need to have the low bits turn around 4G times to get a matching value.
Put another way: first you'd have to work however many weeks to do 4 billion execve() calls, and then you need to hit basically a single-instruction race to take advantage of it.
Good luck with that. If you have that kind of God-like capability, whoever you're attacking stands no chance in the first place.
Linus