Messages in this thread | | | Date | Thu, 23 Feb 2006 18:14:29 +0100 (MET) | From | Jan Engelhardt <> | Subject | Re: Mapping to 0x0 |
| |
>> int main(void) { >> int fd = open("badcode.bin", O_RDONLY); > int fd = open("/dev/mem", O_RDWR); > >> mmap(NULL, 4096, PROT_READ | PROT_EXEC, MAP_FIXED, fd, 0); >> } >> >No. In your demo code, page 0 gets memory-mapped into user space. >This allows user-mode code to access the first page of memory >and even read/write offset 0, still in user mode, with the >root privs that allowed you access to that page in the >first place.
Only root can map to 0x0?
>Everything you do, is still in user-mode. >You just own some physical memory that the kernel didn't >care about anyway.
So you can't accidentally call a place in userspace from kernel context? (Including the case where set_fs(USER_DS) was used.)
Jan Engelhardt -- - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |