Messages in this thread | | | From | Bryan Donlan <> | Date | Thu, 18 Mar 2010 21:06:12 -0400 | Subject | Re: Kernel vs user memory |
| |
On Thu, Mar 18, 2010 at 20:47, Siddhartha Chhabra <siddhartha.chhabra@gmail.com> wrote: > On Thu, Mar 18, 2010 at 8:28 PM, Bryan Donlan <bdonlan@gmail.com> wrote: >> >> > If the kernel's doing a copy_from_user or copy_to_user family of calls >> > (ie, the calls used in system call handlers when accessing user space >> > buffers referenced in the arguments), this will trigger a page fault >> > exactly like the userspace process would, and the PF handler will then >> > deal with any copy on write or whatever may be needed. Of course, if a >> > userspace access wouldn't trigger a PF, the kernel access won't >> > either. >> >> > For the actual copy-on-write process itself, it would be a Bad Thing >> > to trigger a recursive page fault, so instead the kernel will directly >> > access the page via the direct mapped section of the address space - >> > this will never cause a PF (on x86, this may require creating a >> > temporary mapping for memory at a high physical address, but this >> > still won't be a PF as it will be set up before the first access). >> > Additionally, memory mapped IO involves direct DMA to/from pages that >> > are simultaneously in use by userspace - this won't cause a PF in >> > kernel mode either. Same with swap. >> >> > In short, some kernel accesses to user space do go through normal >> > channels which may or may not PF; other accesses will never PF. So >> > it's a bad idea to rely on all kernel accesses triggering a page >> > fault. > > >> >> > Hope this helps, >> >> > Bryan > > In other words, without tying the kernel access to any specific operation > (like COW, or copy-from/to-user, DMA, Memory mapped IO etc.), is it safe to > say that a possibly compromised kernel wanting to read application's pages > can do so without mapping the page to its address space, that is, without > resulting in a page fault in the kernel mode on an attempt to access a page > ? > > For example: > > Lets say for App A frame 5 on physical memory is mapped to its address space > and its currently using it. The OS does a context switch, however, A's > frames are still in the main memory. Now can the OS read these page frames > (frame 5 in main memory) without mapping them to its address space, maybe > just to read the application's contents and send it out to a potential > attacker wanting to compromise the system's security ?
That is correct. The kernel can avoid a PF if it wants to by ensuring the page tables are set up properly from the start; and physical addresses below a certain value (which varies by architecture) can be accessed directly without any setup at all.
| |