Re: Question about sendpage exploit

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



2009/8/28 fisherman <ipconfigme@xxxxxxxxx>:
> In Process Context, kernel can access user space resource(e.x.p
> address) and execute user space code.  Because cr3 register is not
> modified, kernel can use page table to address the resource.
> Is it right?
>
> Another question:
> If kernel can access user space resource directly, why not use
> copy_to/from_user() ?

If you mean, "why use copy_to/from_user() when the kernel can access
userspace memory directly", the answer is copy_to/from_user do
additional security checks. Specifically, they:

a) Check that the requested range is entirely within the user memory space
b) On older CPUs, verify the range of memory in question is writable
(some old x86 CPUs don't honor WP in supervisor mode)
c) Finally, directly access the userspace pages to copy data to/from then.

Also, normally if a page fault occurs in kernel mode, a BUG will occur
and the process will be killed (and the system might well be expected
to crash after that). However copy_to/from_user have a special
exception in which the fault is instead handled normally, as it would
if it was triggered from userspace. If the fault would result in
SIGSEGV, control returns to a special label in the copy_to/from_user
function which returns -EFAULT (and no signal is raised).

--
To unsubscribe from this list: send an email with
"unsubscribe kernelnewbies" to ecartis@xxxxxxxxxxxx
Please read the FAQ at http://kernelnewbies.org/FAQ



[Index of Archives]     [Newbies FAQ]     [Linux Kernel Mentors]     [Linux Kernel Development]     [IETF Annouce]     [Git]     [Networking]     [Security]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux RAID]     [Linux SCSI]     [Linux ACPI]
  Powered by Linux