RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 11:28:12 +00:00
Code Issues Activity Actions

Kernel: AnonymousVMObject::create_for_physical_range() should fail more

Browse source 
Previously it was not possible for this function to fail. You could
exploit this by triggering the creation of a VMObject whose physical
memory range would wrap around the 32-bit limit.

It was quite easy to map kernel memory into userspace and read/write
whatever you wanted in it.

Test: Kernel/bxvga-mmap-kernel-into-userspace.cpp
This commit is contained in:
Andreas Kling 2020-01-28 20:48:07 +01:00
parent bd059e32e1
commit c17f80e720
6 changed files with 109 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Kernel/Devices/MBVGADevice.cpp
View file

@ -55,10 +55,12 @@ KResultOr<Region*> MBVGADevice::mmap(Process& process, FileDescription&, Virtual
ASSERT(offset == 0);
ASSERT(size == framebuffer_size_in_bytes());
auto vmobject = AnonymousVMObject::create_for_physical_range(m_framebuffer_address, framebuffer_size_in_bytes());
if (!vmobject)
return KResult(-ENOMEM);
auto* region = process.allocate_region_with_vmobject(
preferred_vaddr,
framebuffer_size_in_bytes(),
move(vmobject),
vmobject.release_nonnull(),
0,
"MBVGA Framebuffer",
prot);