lkml.org 
[lkml]   [2006]   [Feb]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Mapping to 0x0
>> int main(void) {
>> int fd = open("badcode.bin", O_RDONLY);
> int fd = open("/dev/mem", O_RDWR);
>
>> mmap(NULL, 4096, PROT_READ | PROT_EXEC, MAP_FIXED, fd, 0);
>> }
>>
>No. In your demo code, page 0 gets memory-mapped into user space.
>This allows user-mode code to access the first page of memory
>and even read/write offset 0, still in user mode, with the
>root privs that allowed you access to that page in the
>first place.

Only root can map to 0x0?

>Everything you do, is still in user-mode.
>You just own some physical memory that the kernel didn't
>care about anyway.

So you can't accidentally call a place in userspace from kernel context?
(Including the case where set_fs(USER_DS) was used.)


Jan Engelhardt
--
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2006-02-23 18:16    [W:0.102 / U:0.708 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site