mirror of
https://github.com/RGBCube/serenity
synced 2025-07-25 13:57:35 +00:00
Kernel: Validate the full range of user memory passed to syscalls
We now validate the full range of userspace memory passed into syscalls instead of just checking that the first and last byte of the memory are in process-owned regions. This fixes an issue where it was possible to avoid rejection of invalid addresses that sat between two valid ones, simply by passing a valid address and a size large enough to put the end of the range at another valid address. I added a little test utility that tries to provoke EFAULT in various ways to help verify this. I'm sure we can think of more ways to test this but it's at least a start. :^) Thanks to mozjag for pointing out that this code was still lacking! Incidentally this also makes backtraces work again. Fixes #989.
This commit is contained in:
parent
e5ffa960d7
commit
3dcec260ed
4 changed files with 121 additions and 25 deletions
69
Userland/test_efault.cpp
Normal file
69
Userland/test_efault.cpp
Normal file
|
@ -0,0 +1,69 @@
|
|||
#include <AK/Assertions.h>
|
||||
#include <AK/Types.h>
|
||||
#include <fcntl.h>
|
||||
#include <stdio.h>
|
||||
#include <sys/mman.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#define EXPECT_OK(syscall, address, size) \
|
||||
do { \
|
||||
rc = syscall(fd, (void*)(address), (size_t)(size)); \
|
||||
if (rc < 0) { \
|
||||
fprintf(stderr, "Expected success: " #syscall "(%p, %zu), got rc=%d, errno=%d\n", (void*)(address), (size_t)(size), rc, errno); \
|
||||
} \
|
||||
} while(0)
|
||||
|
||||
#define EXPECT_EFAULT(syscall, address, size) \
|
||||
do { \
|
||||
rc = syscall(fd, (void*)(address), (size_t)(size)); \
|
||||
if (rc >= 0 || errno != EFAULT) { \
|
||||
fprintf(stderr, "Expected EFAULT: " #syscall "(%p, %zu), got rc=%d, errno=%d\n", (void*)(address), (size_t)(size), rc, errno); \
|
||||
} \
|
||||
} while(0)
|
||||
|
||||
|
||||
int main(int, char**)
|
||||
{
|
||||
int fd = open("/dev/zero", O_RDONLY);
|
||||
int rc;
|
||||
|
||||
// Test a one-page mapping (4KB)
|
||||
u8* one_page = (u8*)mmap(nullptr, 4096, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);
|
||||
ASSERT(one_page);
|
||||
EXPECT_OK(read, one_page, 4096);
|
||||
EXPECT_EFAULT(read, one_page, 4097);
|
||||
EXPECT_EFAULT(read, one_page - 1, 4096);
|
||||
|
||||
// Test a two-page mapping (8KB)
|
||||
u8* two_page = (u8*)mmap(nullptr, 8192, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);
|
||||
ASSERT(two_page);
|
||||
|
||||
EXPECT_OK(read, two_page, 4096);
|
||||
EXPECT_OK(read, two_page + 4096, 4096);
|
||||
EXPECT_OK(read, two_page, 8192);
|
||||
EXPECT_OK(read, two_page + 4095, 4097);
|
||||
EXPECT_OK(read, two_page + 1, 8191);
|
||||
EXPECT_EFAULT(read, two_page, 8193);
|
||||
EXPECT_EFAULT(read, two_page - 1, 1);
|
||||
|
||||
// Check validation of pages between the first and last address.
|
||||
ptrdiff_t distance = two_page - one_page;
|
||||
EXPECT_EFAULT(read, one_page, (u32)distance + 1024);
|
||||
|
||||
// Test every kernel page just because.
|
||||
for (u64 kernel_address = 0xc0000000; kernel_address <= 0xffffffff; kernel_address += PAGE_SIZE) {
|
||||
EXPECT_EFAULT(read, (void*)kernel_address, 1);
|
||||
}
|
||||
|
||||
// Test the page just below where the kernel VM begins.
|
||||
u8* jerk_page = (u8*)mmap((void*)(0xc0000000 - PAGE_SIZE), PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, 0, 0);
|
||||
ASSERT(jerk_page == (void*)(0xc0000000 - PAGE_SIZE));
|
||||
|
||||
EXPECT_OK(read, jerk_page, 4096);
|
||||
EXPECT_EFAULT(read, jerk_page, 4097);
|
||||
|
||||
// Test something that would wrap around the 2^32 mark.
|
||||
EXPECT_EFAULT(read, jerk_page, 0x50000000);
|
||||
|
||||
return 0;
|
||||
}
|
Loading…
Add table
Add a link
Reference in a new issue