Re: Verify Kernel Pointer

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 4/26/06, Hayim Shaul <hayim@xxxxxxxxxxxxxx> wrote:
>
> > mem_map is an array of page structure, each element of this array is
> > of "page" structure type. Actually mem_map is used for reverse
> > mappeing of physical memory of system. This array represents the
> > physical memory interms of page sturcture. Lets say for simplicity we
> > have total physical memory of 256K and one one physical page of 4K,
> > then in taht case mem_map will have 256/4 = 64 enteries and max_mapnr
> > will be set to 64.
> >
> > So as per the kernel sources (file: include/asm-i386/page.h)
> > #define pfn_valid(pfn)          ((pfn) < max_mapnr)
> > #define virt_addr_valid(kaddr)  pfn_valid(__pa(kaddr) >> PAGE_SHIFT)
> >
> > virt_addr_valid() macro only tells whether the given virtual address
> > can be mapped to any physical page or not. __pa() macro gives the
> > physical address for a given virtual address just by subracting the
> > PAGE_OFFSET from given virtual address. Now then we right shift that
> > physical address by page size which gives us the page number in which
> > our physical adress falls and then we look if this page number is less
> > than the total number of physical pages in system, if yes then it
> > means we can mapped this virtual address to some physical address else
> > our given virtual address can not be mapped to any physical address
> > in system.
>
> I think I get it. You don't have more pages than RAM frames (can't the
> kernel swap its own pages?) so all this check does is make sure the
> address falls in a page you are allowed to use.

Yes, you are right to some extent. Yo think of RAM in terms of in
terms of physical page frames, each frame is of 4K. As I know kernel
occuies the physical contigous memory (I might be wrong here, correct
me if I am wrong here.),so the conversion of kernel virtual address to
physical addresses or vice versa is simple by subtracting or adding
the PAGE_OFFSET (which is set to 0xC0000000).

As kernel occupies contiguous physical memory, virt_addr_valid() only
tells if this virtual address can be mapped to some physical location
in RAM or is it going outside that (means system dont have that much
RAM so that it can map this large virtual address). Lets say we have
pass vitual address 0xC0080000 (PAGE_OFFSET + 512 K) and we only have
physical RAM of 256K (just for keeping the example simple). in this
case total number of physical pages will be 256 / 4 = 64 (each page
being 4K) and the page frame number we will get for our page will be
((virtual address - PAGE_OFFSET) >> 12) = 128. This means our virtual
address will be there in 128th page frame, but 128th page frame does
not exist in our RAM, so its not a valid or rather not at all possible
mappable virtual address. Hope with this example it clears that
virt_addr_valid() function only tells you if virtual address can be
mapped to some physical page or not and nothing more than that.

AFAIK, kernel memory is never swapped out.

>
>
> So if we go back to Talib's original question, the only thing he can do is
> traverse the page table tree to see if the address is indeed valid.
> I think this is what virt_to_page(addr) does.

I dont think he need to traverse the page tables as he has to verify
the kernel virtual address not the user virtual address. He can
definitely use virt_addr_valid() to make sure that the passed virtual
address is atleast mappable to some physical address in RAM and then
over that use his signature and pid matching mechanisum to make sure
that its the same memory location whose pointer he passed back to user
earlier.

>
> > Having understood all this, and applying this information to the
> > actual problem of verifying the virtual address, we can use this macro
> > to just make sure that the kernel virtual address passed by user space
> > back to kernel falls in kernel virtual address space but, we can not
> > be sure if the given address is the same as we passed it to user space
> > earlier, for that as mentioned by some one we need to user some
> > ginature in the structure being pointed by this virtual address.
>
> You have to check first that the virtual address is mapped to real a
> frame, or you'll get a kernel panic. no?
>


--
--
-Gaurav
Email: gauravd.chd@xxxxxxxxx
---------------------------------
Read my blog at: http://lkdp.blogspot.com/
---------------------------------

--
Kernelnewbies: Help each other learn about the Linux kernel.
Archive:       http://mail.nl.linux.org/kernelnewbies/
FAQ:           http://kernelnewbies.org/faq/



[Index of Archives]     [Newbies FAQ]     [Linux Kernel Mentors]     [Linux Kernel Development]     [IETF Annouce]     [Git]     [Networking]     [Security]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux RAID]     [Linux SCSI]     [Linux ACPI]
  Powered by Linux