Andreas Kling c17f80e720 Kernel: AnonymousVMObject::create_for_physical_range() should fail more ...

Previously it was not possible for this function to fail. You could
exploit this by triggering the creation of a VMObject whose physical
memory range would wrap around the 32-bit limit.

It was quite easy to map kernel memory into userspace and read/write
whatever you wanted in it.

Test: Kernel/bxvga-mmap-kernel-into-userspace.cpp

2020-01-28 20:48:07 +01:00

2.7 KiB

Raw Blame History

View Raw