Re: Mapping to 0x0

[Jan Engelhardt <jengelh@linux01.gwdg.de>]

>> int main(void) {
>>    int fd   = open("badcode.bin", O_RDONLY);
>      int fd   = open("/dev/mem", O_RDWR);
>
>>    mmap(NULL, 4096, PROT_READ | PROT_EXEC, MAP_FIXED, fd, 0);
>> }
>>
>No. In your demo code, page 0 gets memory-mapped into user space.
>This allows user-mode code to access the first page of memory
>and even read/write offset 0, still in user mode, with the
>root privs that allowed you access to that page in the
>first place.

Only root can map to 0x0?

>Everything you do, is still in user-mode.
>You just own some physical memory that the kernel didn't
>care about anyway.

So you can't accidentally call a place in userspace from kernel context?
(Including the case where set_fs(USER_DS) was used.)


Jan Engelhardt
-- 
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/