About accessing userspace memory from kernel

Question

I'm doing kext development at XNU kernel, there is KPI function called copyin and its friends, similar to copy_from_user at Linux kernel

So I'm using copyin at most time, it's more secure processing data at kernelspace rather than relatively volatile userspace, but sometime i need process a quite large amount of memory(eg 2MB) from userspace, and i only need to read, could that be a excuse for directly access userspace memory ? (could that cause unexpected problem?)

The data from userspace has entries, so i only need read at least each time, besides I don't need to do any write on this memory neither from userspace process, I list three ways that just i could think about, hope someone could give me advice, i am really appreciate that!

Alloc enough size pageable memory (IOMallocPageable) at kernel space, and calling copyin to copy the whole data from userspace
Alloc also alloc pageable memory, and size is enough for one entry, use copyin to read and process then read again to same memory
Use stac disable smap, directly read from userspace

First way, if i don't do writing, could that be mapping to same physical map, so doesn't need waster memory? Which way is more efficiency?

What kind of data are you processing? What if data is changing while you are processing it? — StaceyGirl
(could that cause unexpected problem?) Depending on what you're doing it can cause all kinds of security issues. If you validate the data for security purposes, the process can then change the data. For example, say your driver will read a file and return data to the process. You read in the file name, and verify the user has permission to open and read it. Then you open it, read it, and pass the data to the process. In between the permission check and the actual reading of data, the process changes the name to /etc/shadow and gets all users' hashed passwords for offline cracking. — Andrew Henle
A list of entry structure, I have to read each of them doing calculation. I ensure proc is locked during the data been read — cocoa
@cocoa Are you sure if you can guarantee userspace threads are stopped? What is someone else resumes them? What if this memory is also available to another process (shared mapping)? — StaceyGirl
@cocoa Even though accessing userspace memory might be possible, it might be hard to do it correctly. Depending on how you process your data, you might consider using statefull API. You situation might or might not be similar to C10k problem which is solved by switching from poll/select to epoll/kqueue. — StaceyGirl

mrdvlpr mrdvlpr · Accepted Answer · 2017-12-09T20:09:35

If you have the userspace address you can remap it to kernel - use IOMemoryDescriptor::withAddressRange with the relevant task (process task) and map it to kernel with IOMemoryDescriptor::createMappingInTask.

Make sure the permissions are correct.

Just a friendly tip - the stac/clac instructions are overwritten by the context switch code handler and you will have to make sure it's not being called during your copying phase. Done it - not very fun.

About accessing userspace memory from kernel

1 Answers