mirror of
https://github.com/RGBCube/serenity
synced 2025-07-25 16:27:35 +00:00
Kernel: Fail with EFAULT for any address+size that would wrap around
Previously we were only checking that each of the virtual pages in the specified range were valid. This made it possible to pass in negative buffer sizes to some syscalls as long as (address) and (address+size) were on the same page.
This commit is contained in:
parent
03837e37a3
commit
a27c5d2fb7
2 changed files with 16 additions and 0 deletions
|
@ -47,6 +47,14 @@
|
|||
} \
|
||||
} while(0)
|
||||
|
||||
#define EXPECT_EFAULT_NO_FD(syscall, address, size) \
|
||||
do { \
|
||||
rc = syscall((address), (size_t)(size)); \
|
||||
if (rc >= 0 || errno != EFAULT) { \
|
||||
fprintf(stderr, "Expected EFAULT: " #syscall "(%p, %zu), got rc=%d, errno=%d\n", (void*)(address), (size_t)(size), rc, errno); \
|
||||
} \
|
||||
} while(0)
|
||||
|
||||
|
||||
int main(int, char**)
|
||||
{
|
||||
|
@ -81,6 +89,9 @@ int main(int, char**)
|
|||
EXPECT_EFAULT(read, (void*)kernel_address, 1);
|
||||
}
|
||||
|
||||
char buffer[4096];
|
||||
EXPECT_EFAULT_NO_FD(dbgputstr, buffer, 0xffffff00);
|
||||
|
||||
// Test the page just below where the kernel VM begins.
|
||||
u8* jerk_page = (u8*)mmap((void*)(0xc0000000 - PAGE_SIZE), PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, 0, 0);
|
||||
ASSERT(jerk_page == (void*)(0xc0000000 - PAGE_SIZE));
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue