Skip to content

Commit d518e99

Browse files
committed
[Kernel] Only copy a pointer to the IDT table to avoid OOB write
1 parent 65f6d6f commit d518e99

File tree

2 files changed

+12
-1
lines changed

2 files changed

+12
-1
lines changed

docs/todo.md

+8
Original file line numberDiff line numberDiff line change
@@ -312,3 +312,11 @@ Read a config/max_cpus.txt to decide when to stop booting APs
312312
Read a config/resolution.txt to decide the resolution selected by the bootloader
313313

314314
Auto install LLD link? Or llvm with brew? Need lld-link for the UEFI build
315+
316+
// TODO(PT): It'd be nice to have some kind of font API that allowed anyone to retrieve a reference to a
317+
// font from any point, instead of needing to pass references all the way through the control flow.
318+
// Maybe there's an in-process font store that caches scanlines, etc, and fetches fonts from the FS.
319+
// The 'fetch from FS' has a platform-specific implementation. To facilitate this (as the paths will be
320+
// different on each OS), we could have an enum to model the possible font options, with an escape hatch
321+
// 'get from this path' variant, which could perhaps hold different values depending on the OS.
322+

kernel/kernel/smp.c

+4-1
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,11 @@ void smp_init(void) {
5656

5757
// Copy the IDT pointer
5858
idt_pointer_t* current_idt = kernel_idt_pointer();
59+
// Crash because current_idt->table_size == 0xfff, and copying to 0x9400 causes it to write outside the AP bootstrap data page
60+
printf("Current IDT %p size %p dest %p\n", current_idt, current_idt->table_size, AP_BOOTSTRAP_PARAM_IDT);
5961
// It's fine to copy the high-memory IDT as the bootstrap will enable paging before loading it
60-
memcpy((void*)PMA_TO_VMA(AP_BOOTSTRAP_PARAM_IDT), current_idt, sizeof(idt_pointer_t) + current_idt->table_size);
62+
//memcpy((void*)PMA_TO_VMA(AP_BOOTSTRAP_PARAM_IDT), current_idt, sizeof(idt_pointer_t) + current_idt->table_size);
63+
memcpy((void*)PMA_TO_VMA(AP_BOOTSTRAP_PARAM_IDT), current_idt, sizeof(idt_pointer_t*));
6164

6265
// Copy the C entry point
6366
uintptr_t ap_c_entry_point_addr = (uintptr_t)&ap_c_entry;

0 commit comments

Comments
 (0)