mirror of
https://github.com/RGBCube/serenity
synced 2025-05-31 11:58:12 +00:00
Kernel: Prevent executing I/O instructions in userspace
All threads were running with iomapbase=0 in their TSS, which the CPU interprets as "there's an I/O permission bitmap starting at offset 0 into my TSS". Because of that, any bits that were 1 inside the TSS would allow the thread to execute I/O instructions on the port with that bit index. Fix this by always setting the iomapbase to sizeof(TSS32), and also setting the TSS descriptor's limit to sizeof(TSS32), effectively making the I/O permissions bitmap zero-length. This should make it no longer possible to do I/O from userspace. :^)
This commit is contained in:
parent
37329c2009
commit
f598bbbb1d
5 changed files with 21 additions and 6 deletions
|
@ -33,6 +33,7 @@ kinds of crashes.
|
|||
* `-y`: Write to recently freed memory. (Tests an opportunistic malloc guard.)
|
||||
* `-X`: Attempt to execute non-executable memory. (Not mapped with PROT\_EXEC.)
|
||||
* `-U`: Attempt to trigger an x86 User Mode Instruction Prevention fault.
|
||||
* `-I`: Use an x86 I/O instruction in userspace.
|
||||
|
||||
## Examples
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue