RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 15:17:36 +00:00
Code Issues Activity Actions

Kernel: Crash on memory access in non-readable regions

Browse source 
This patch makes it possible to make memory regions non-readable.
This is enforced using the "present" bit in the page tables.
A process that hits an not-present page fault in a non-readable
region will be crashed.
This commit is contained in:
Andreas Kling 2019-12-02 19:14:16 +01:00
parent ddd5411472
commit f41ae755ec
5 changed files with 41 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

23
Userland/crash.cpp
View file

@ -26,6 +26,8 @@ int main(int argc, char** argv)
InvalidStackPointerOnSyscall,
InvalidStackPointerOnPageFault,
SyscallFromWritableMemory,
WriteToFreedMemoryStillCachedByMalloc,
ReadFromFreedMemoryStillCachedByMalloc,
};
Mode mode = SegmentationViolation;
@ -56,6 +58,10 @@ int main(int argc, char** argv)
mode = InvalidStackPointerOnPageFault;
else if (String(argv[1]) == "-S")
mode = SyscallFromWritableMemory;
else if (String(argv[1]) == "-x")
mode = ReadFromFreedMemoryStillCachedByMalloc;
else if (String(argv[1]) == "-y")
mode = WriteToFreedMemoryStillCachedByMalloc;
else
print_usage_and_exit();
@ -161,6 +167,23 @@ int main(int argc, char** argv)
((void(*)())buffer)();
}
if (mode == ReadFromFreedMemoryStillCachedByMalloc) {
auto* ptr = (u8*)malloc(1024);
free(ptr);
dbgprintf("ptr = %p\n", ptr);
volatile auto foo = *ptr;
(void)foo;
ASSERT_NOT_REACHED();
}
if (mode == WriteToFreedMemoryStillCachedByMalloc) {
auto* ptr = (u8*)malloc(1024);
free(ptr);
dbgprintf("ptr = %p\n", ptr);
*ptr = 'x';
ASSERT_NOT_REACHED();
}
ASSERT_NOT_REACHED();
return 0;
}