mirror of
				https://github.com/RGBCube/serenity
				synced 2025-10-31 05:32:44 +00:00 
			
		
		
		
	Kernel: Prevent executing I/O instructions in userspace
All threads were running with iomapbase=0 in their TSS, which the CPU interprets as "there's an I/O permission bitmap starting at offset 0 into my TSS". Because of that, any bits that were 1 inside the TSS would allow the thread to execute I/O instructions on the port with that bit index. Fix this by always setting the iomapbase to sizeof(TSS32), and also setting the TSS descriptor's limit to sizeof(TSS32), effectively making the I/O permissions bitmap zero-length. This should make it no longer possible to do I/O from userspace. :^)
This commit is contained in:
		
							parent
							
								
									37329c2009
								
							
						
					
					
						commit
						f598bbbb1d
					
				
					 5 changed files with 21 additions and 6 deletions
				
			
		|  | @ -33,6 +33,7 @@ kinds of crashes. | |||
| * `-y`: Write to recently freed memory. (Tests an opportunistic malloc guard.) | ||||
| * `-X`: Attempt to execute non-executable memory. (Not mapped with PROT\_EXEC.) | ||||
| * `-U`: Attempt to trigger an x86 User Mode Instruction Prevention fault. | ||||
| * `-I`: Use an x86 I/O instruction in userspace. | ||||
| 
 | ||||
| ## Examples | ||||
| 
 | ||||
|  |  | |||
		Loading…
	
	Add table
		Add a link
		
	
		Reference in a new issue
	
	 Andreas Kling
						Andreas Kling