tree a95dae334bcbade4d2a4aac3cc9aed73e263be8a
parent c744ab276b8398363f2d8067700e332a14d98ac2
author David Chisnall <github@theravensnest.org> 1723652724 +0100
committer David Chisnall <davidchisnall@users.noreply.github.com> 1723725936 +0100

Reduce the permissions on hazard pointers.

The allocator is happy with just load + capability permissions.  Without
store, it can't accidentally damage hazard lists.  Without load-mutable,
it can't accidentally load a writeable capability.

This is purely defence in depth.  The allocator can still write to any
heap memory, so not being able to load mutable capabilities doesn't
restrict what it can do.  The allocator can still ignore hazard
pointers, so not being able to write them is also no reduction in
ability.  It simply constrains where bugs must be.