mirrors/ladybird
0
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-06-04 17:33:04 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

Kernel: AnonymousVMObject::create_for_physical_range() should fail more

Browse source 
Previously it was not possible for this function to fail. You could
exploit this by triggering the creation of a VMObject whose physical
memory range would wrap around the 32-bit limit.

It was quite easy to map kernel memory into userspace and read/write
whatever you wanted in it.

Test: Kernel/bxvga-mmap-kernel-into-userspace.cpp
This commit is contained in:
Andreas Kling 2020-01-28 20:48:07 +01:00
parent bd059e32e1
commit c17f80e720
Notes: sideshowbarker 2024-07-19 09:45:30 +09:00
6 changed files with 109 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

7
Kernel/VM/MemoryManager.cpp
View file

@ -313,11 +313,14 @@ OwnPtr<Region> MemoryManager::allocate_kernel_region(PhysicalAddress paddr, size
ASSERT(!(size % PAGE_SIZE));
auto range = kernel_page_directory().range_allocator().allocate_anywhere(size);
ASSERT(range.is_valid());
auto vmobject = AnonymousVMObject::create_for_physical_range(paddr, size);
if (!vmobject)
return nullptr;
OwnPtr<Region> region;
if (user_accessible)
region = Region::create_user_accessible(range, AnonymousVMObject::create_for_physical_range(paddr, size), 0, name, access, cacheable);
region = Region::create_user_accessible(range, vmobject.release_nonnull(), 0, name, access, cacheable);
else
region = Region::create_kernel_only(range, AnonymousVMObject::create_for_physical_range(paddr, size), 0, name, access, cacheable);
region = Region::create_kernel_only(range, vmobject.release_nonnull(), 0, name, access, cacheable);
region->map(kernel_page_directory());
return region;
}