CODEWITHSUNDEEP
memorylinux-kernelkernelvirtual-memoryfaults
Jesus Ramos
Jesus Ramos

Reputation: 23268

Changing page mapping for a user process in the linux kernel

So lets say I have access to a process and its mm_struct, is there a way that I can change one of the mappings or remove a mapping and create a temporary one so that I can allocate an amount smaller than a page and have memory written to that?

For instance, process write faults on an ADD instruction. I can get the address and size of the fault with relative ease. I allocate 8 bytes locally (largest single instruction size) and mess with the mappings so that the virtual address that faulted points to the first byte of those 8 bytes. Then single step the instruction to get the data that was intended for another page and then restore the original page back to the mapping. I'm just curious as to whether something other than a page can be used in the virtual memory area for a process.

Upvotes: 1

Views: 647

Answers (1)

Karmastan
Karmastan

Reputation: 5696

The underlying architecture of your computer defines what you can and can't do with virtual memory. You haven't specified your architecture, but I'm pretty confident that it won't allow you to manage a unit any smaller than a page.

But to address a larger issue, why does the memory size matter? You need this allocation once per thread, only if its is faulty, and it will be allocated for a single user-space instruction. Just use a new, clean page to temporarily map into your process to get the written value. It's probably easier to write, and it has better security: it will avoid exposing kernel data to an untrusted (and obviously faulty) application.

Upvotes: 2

Related Questions