I want to demonstrate an out-of-bound memory read exploit for a global variable inside the Linux Kernel's fs module. For this purpose, I want the virtual address space of fs to be static (i.e. not randomized).
I have already disabled CONFIG_RANDOMIZE_BASE. As a result, the physical address of the global variable variable will always be the same. However, since I am executing this exploit through a system call, I can only interact with the virtual address. So I will like the virtual addresses to be deterministic as well.