RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 06:37:35 +00:00
Code Issues Activity Actions

Kernel: Fail with EFAULT for any address+size that would wrap around

Browse source 
Previously we were only checking that each of the virtual pages in the
specified range were valid.

This made it possible to pass in negative buffer sizes to some syscalls
as long as (address) and (address+size) were on the same page.
This commit is contained in:
Andreas Kling 2020-01-29 12:39:27 +01:00
parent 03837e37a3
commit a27c5d2fb7
2 changed files with 16 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
Userland/test_efault.cpp
View file

@ -47,6 +47,14 @@
} \
} while(0)
#define EXPECT_EFAULT_NO_FD(syscall, address, size) \
do { \
rc = syscall((address), (size_t)(size)); \
if (rc >= 0 || errno != EFAULT) { \
fprintf(stderr, "Expected EFAULT: " #syscall "(%p, %zu), got rc=%d, errno=%d\n", (void*)(address), (size_t)(size), rc, errno); \
} \
} while(0)
int main(int, char**)
{
@ -81,6 +89,9 @@ int main(int, char**)
EXPECT_EFAULT(read, (void*)kernel_address, 1);
}
char buffer[4096];
EXPECT_EFAULT_NO_FD(dbgputstr, buffer, 0xffffff00);
// Test the page just below where the kernel VM begins.
u8* jerk_page = (u8*)mmap((void*)(0xc0000000 - PAGE_SIZE), PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, 0, 0);
ASSERT(jerk_page == (void*)(0xc0000000 - PAGE_SIZE));