‫Hello, everybody, and in this lecture, we're going to unmap the memory that we mapped with mallock,
‫as explained in the last lecture.
‫So the first thing I want us to do is I want to go to Blank Tazi and this little example we did.
‫I want us to just do free on it, OK?
‫And now I want us to be I want us to be funny about this.
‫I want us to still access the pointer and watch what happens.
‫So if I go point to zero equals B now the truth is that with the current design, this is undefined
‫behavior.
‫Maybe the kernel just allocated some memory for itself and we just changed it.
‫Right.
‫You know, if this was a multitasking system, that would be the case maybe as very serious.
‫So if we do make clean and we just go build that S.H..
‫And we run.
‫Let's just do a print under here as well, ABC, so that we can see that it still works.
‫I just want us to go to that site again, and we're going to a city band and we're going to run Kumu.
‫Now, just do blank else to run the program we see.
‫Hello, World ABC.
‫Now look what we've been able to do.
‫We have freed the memory and we're still able to change it.
‫That's dangerous.
‫Another process might have that memory because we freed it here.
‫Another process might have that memory address now.
‫So what we need to do is we need to go to process Stazi and task and we need to change our process free
‫to basically do a paging map to on all of the memory that this pointer represents and essentially take
‫off the flag that allows access from all the paging access from all it needs to remove that flag.
‫OK, and then if we try to do something like.
‫Point to zero equals B after we freed the pointer, it would cause a paging fault and we wouldn't be
‫able to do it.
‫So that's what we're going to do in this lecture.
‫It's not so straightforward because we need to change.
‫We need to change how this works.
‫OK, so just go to page engage because we're going to need to change how these allocations look.
‫So up here, we're going to go struct process allocation, OK?
‫And that's going to have a size T of size and avoid pointer.
‫OK, now using just this, we can we can determine the size of any pointer.
‫So, um, pass passes to us for K free.
‫OK, but this is very important and we do need it guys.
‫OK, so we're going to start by changing the process allocation here to a structure of process allocation.
‫OK.
‫And this is no longer going to be a pointer variable, guys.
‫It's going to just be an array like that.
‫OK, as the pointer itself will be stored in the structure now here represented by Peter.
‫OK, so we have a number of process applications in the process.
‫OK, good.
‫Go the process.
‫See, because we need to change our process mallock now and how that works.
‫So our process Mallak will find the free allocation index.
‫OK, and then we go process allocations index equals pointer.
‫This is now wrong.
‫We need to change it to Peter equals Peter.
‫OK, like that and we need to go process allocations.
‫Index dot dot size equals size.
‫OK, so that's the new implementation for that.
‫All right guys, if we look at five three three allocation index, we can see this is also wrong now
‫because we can no longer rely on the null pointer because it's no longer an array of pointers, it's
‫an array of allocations.
‫So what we need to do instead is allocations.
‫A pointer equals equals zero.
‫OK, so that's that's the new thing that we need to do to find that.
‫All right.
‫So that's very important.
‫And now if we.
‫Look for the.
‫The enjoying, OK, we can see the enjoying and the processes process points it needs to change as well.
‫So here we're going to say process reallocations, dot pointer equals equals pointer.
‫And again, process allocations I pointer equals equals pointer.
‫Now you're all competent programmers.
‫You understand what I'm doing here.
‫OK, and again, here we're going to go pointer equals zero zero zero.
‫OK, uh and here we're going to go process applications.
‫I dot size equals zero.
‫OK, because we're um joining.
‫OK, so once you've done all of that then let's try to make and clean that and build.
‫OK, and we can see that works fine, let's just run it to check our program still works and we haven't
‫damaged anything.
‫So we're going to go blank out and we see how the world A.B.C..
‫So everything now works with this changed implementation.
‫OK, so now that we've changed the implementation, we know the size for any process allocation, for
‫any pointers provided to us.
‫We now know the size.
‫And that's so important because it means in our process free.
‫We can search our allocation table now and we can find that allocation and we'll know the size, which
‫will allow us to know how many pages that we need to unlink from this process is page directory.
‫OK, so go to Stazi and we're going to create a new function here.
‫Now we're going to go static struct process, allocation process, get allocation and we're going to
‫provide the address so we can call this by address as well, just like that.
‫So we're going to look through all of the program allocations.
‫And we're going to say if the process.
‫Oh, yeah, we need to provide the process here as well, guys, the process and we're going to save
‫the process allocations, I don't point equals the address, then return the address of that point to
‫allocation.
‫Otherwise we're going to return null.
‫OK, so that's how that should look.
‫And we don't need to export this into the head of file because we're only going to be using this in
‫the free function here.
‫So just before we enjoin the allocation, we need to now unlink the page.
‫OK, so we're going to do that here.
‫Uh, unlink the page, the pages from the process for the given address.
‫OK, so we're going to get the process allocation,
‫OK, and we're going to pass in the process and the points are free, OK, and now if we don't have
‫an allocation, then something has gone really wrong.
‫OK, so we can just return here because something went really wrong and you'll see processes process
‫point of.
‫We actually don't need that anymore because we're handling that now here when we get the allocation
‫by address.
‫OK, if we can't find it, then we just return.
‫So so this is now pointless, this little check from one to seven to one three one.
‫So we can delete that now.
‫OK, and then here we can say, oops, it's not our pointer and we can just return.
‫So we will ignore any free attempts for pointers around ours.
‫OK, now after here, we know that it is our allocation.
‫OK, so because we know it's our allocation, we can now unmap it.
‫So we're going to say and it equals paging map to OK, we're going to say process task to page directory
‫and we're going to map the virtual address of allocation pointer to physical address allocation of pointer.
‫Or we can even just map that to zero now if you wanted.
‫I mean, it's not a big deal, but the point is the address that we map it to, it doesn't really matter
‫anymore because we're not planning to use this address again.
‫OK, and if we did happen to do a madlock again and I brought back the same address while the Mallak
‫would change the page table entry again, which would once again allow us to access that page address.
‫So here we are going to say paging a line address and we're just going to go allocation pointer plus
‫allocation size.
‫OK, and the flags here, what are the flags going to be?
‫Well, we can just set them to zero.
‫We don't really need need to use this page, as I said.
‫So it's perfectly acceptable for it to be zero or if you wanted to keep it, as we saw the memory intestacy
‫when we did Task New, which you can see here taskin it.
‫I mean you could just reset it to that if you want.
‫Paging is present, paging access from all.
‫If you really wanted to, that would be OK.
‫However, this paging axis from all is even a vulnerability.
‫By the way, it should really only be paging is present because we don't really want to be giving user
‫programs access to the whole address space, but we won't bother changing that.
‫I just want you to be aware of those things.
‫So I'm going to start C, then we'll just assign it's zero zero zero and that'll mean no access to the
‫page.
‫OK, none at all.
‫And here we're going to say if rest is below zero, then there was an error.
‫So we'll just return.
‫OK, now if we now try that again, make clean bill that SRH.
‫And we run the program.
‫You should see that it crashes, so let's try that blanket out, Ralph.
‫And we only see Hello, World, and then the program crashed, we don't see ABC and that's exactly what
‫we wanted and the reason we no longer see yeah, you see a reset, the whole kernel then because it
‫faltered and the reason it faltered is simple because we no longer have access to that memory.
‫The mallock returned because we freed it and that's how it should be, guys.
‫And our fix fixes the security hole.
‫And I hope you all understand how that's work and you can message me if you don't.
‫But essentially we just map the page again in such a way that we remove the present bit axis from orbit
‫and is right about that.
‫We remove all of that.
‫We just apply zero.
‫And obviously this only applies to the tasks page directory, OK, not not the kernels.
‫So the kernel can still access memory and that just prevents the process from being able to access that
‫memory.
‫OK, so that's basically what's happening there, guys.
‫It's not too difficult to understand if you think logically about about what's going on.