beenull/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-11-22 07:30:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

Kernel: Avoid potential memory info leak when doing mmap on /dev/mem

Browse source 
Although we can still consider this impossible to happen now, because
the mmap syscall entry code verifies that specified offset must be page
aligned, it's still a good practice to VERIFY we actually take a start
address as page-aligned in case of doing mmap on /dev/mem.

As for read(2) on /dev/mem, we don't map anything to userspace so it's
safe to read from whatever offset userspace specified as long as it does
not break the original rules of reading physical memory from /dev/mem.
This commit is contained in:
Liav A 2021-12-23 22:09:19 +02:00 committed by Idan Horowitz
parent ca254699ec
commit f7d1b8cd0c
Notes: sideshowbarker 2024-07-17 21:27:30 +09:00 
Author: https://github.com/supercomputer7
Commit: https://github.com/SerenityOS/serenity/commit/f7d1b8cd0cb
Pull-request: https://github.com/SerenityOS/serenity/pull/11390
Reviewed-by: https://github.com/ADKaster
Reviewed-by: https://github.com/IdanHo ✅
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
Kernel/Devices/MemoryDevice.cpp
View file

@ -49,6 +49,16 @@ ErrorOr<Memory::Region*> MemoryDevice::mmap(Process& process, OpenFileDescriptio
{
auto viewed_address = PhysicalAddress(offset);
// Note: This check happens to guard against possible memory leak.
// For example, if we try to mmap physical memory from 0x1000 to 0x2000 and you
// can actually mmap only from 0x1001, then we would fail as usual.
// However, in such case if we mmap from 0x1002, we are technically not violating
// any rules, besides the fact that we mapped an entire page with two bytes which we
// were not supposed to see. To prevent that, if we use mmap(2) syscall, we should
// always consider the start page to be aligned on PAGE_SIZE, or to be more precise
// is to be set to the page base of that start address.
VERIFY(viewed_address == viewed_address.page_base());
dbgln("MemoryDevice: Trying to mmap physical memory at {} for range of {} bytes", viewed_address, range.size());
if (!MM.is_allowed_to_read_physical_memory_for_userspace(viewed_address, range.size())) {
dbgln("MemoryDevice: Trying to mmap physical memory at {} for range of {} bytes failed due to violation of access", viewed_address, range.size());