劫持read系统调用出现的bug
本帖最后由 wugj03 于 2015-01-13 10:47 编辑自定义的read函数如下：asmlinkage long new_read(unsigned int fd, char __user *buf, size_t count)
{
long ret;
struct file *file;
char *pathname;
ret = old_read(fd, buf, count);
/*0 represent EOF
* We just collect a 'read' when finished
*/
if(ret == 0){
file = fget(fd);
if(file){
pathname = kmalloc(256, GFP_KERNEL);
if(!pathname)
return ret;
strcpy(pathname, file->f_dentry->d_iname);
pr_info("[%s:%d] READ '%s '\n", current->comm, current->pid, pathname);
kfree(pathname);
fput(file);
}
}
return ret;
}1.bug重现的情况：
#insmod prov.ko (涉及的模块)
...read some files...
#rmmod prov
#insmod prov.ko
点击另一个tty终端上，即获得焦点，系统就崩溃了。
PS：a.在第一次insmod时，点击另外一个tty终端，是不会出错的。
b. 去掉if(ret ==0){...}， 也是不会出现panic的
c.不是每次都会出现，但基本都出现，否则就要多一次rmmod,insmod，才出现panic
2. kdump的结果log信息如下：
3. crash工具上的信息
被这个bug折磨几天了，求大神拯救
同样的记录信息的办法，劫持write系统调用，是没有问题的 pathname = kmalloc(256, GFP_KERNEL);
strcpy(pathname, file->f_dentry->d_iname);
pr_info("[%s:%d] READ '%s '\n", current->comm, current->pid, pathname);
kfree(prec.p_pathname);
这里的kmalloc和kfree看似不匹配，kfree为何是prec.p_pathname？ 回复 3# humjb_1983
不好意思，忘记改过来就帖上去了，代码是kfree(pathname)的
就是在if(ret == 0){...} 只加fget和fput，都会出现同样的错误
wugj03 发表于 2015-01-12 09:43 static/image/common/back.gif
回复 3# humjb_1983
不好意思，忘记改过来就帖上去了，代码是kfree(pathname)的
如果是这样的话，那应该是其它代码的问题吧，把其它修改的代码也贴来看看？ 回复 5# humjb_1983
获取系统调用表是用 http://bbs.chinaunix.net/thread-1946913-1-1.html 介绍的方法来获取的。
如果不劫持其他系统调用，只劫持了read系统调用，就不行。
请问是要看具体到那一块的代码呢 回复 5# humjb_1983
全部代码如下#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/kprobes.h>
#include <linux/kallsyms.h>
#include <linux/sched.h>
#include <linux/ptrace.h>
#include <linux/mm.h>
#include <linux/fs.h>
#include <linux/file.h>
#include <linux/smp.h>
#include <linux/user.h>
#include <linux/errno.h>
#include <linux/cpu.h>
#include <asm/uaccess.h>
#include <asm/fcntl.h>
#include <asm/unistd.h>
MODULE_DESCRIPTION("Intercept the system call table in Linux");
MODULE_LICENSE("GPL");
/* comment the following line to shut me up */
#define INTERCEPT_DEBUG
#ifdef INTERCEPT_DEBUG
#define dbgprint(format,args...) \
printk("intercept: function:%s-L%d: "format, __FUNCTION__, __LINE__, ##args);
#else
#define dbgprint(format,args...)do {} while(0);
#endif
/**
* * the system call table
* */
void **my_table;
unsigned int orig_cr0;
/**
* * the original syscall functions
* */
asmlinkage long (*old_read) (unsigned int fd, char __user *buf, size_t count);
struct idtr {
unsigned short limit;
unsigned int base;
} __attribute__ ((packed));
struct idt {
unsigned short off1;
unsigned short sel;
unsigned char none, flags;
unsigned short off2;
} __attribute__ ((packed));
/**
* * clear WP bit of CR0, and return the original value
* */
unsigned int clear_and_return_cr0(void)
{
unsigned int cr0 = 0;
unsigned int ret;
asm volatile ("movl %%cr0, %%eax"
: "=a"(cr0)
);
ret = cr0;
/* clear the 20 bit of CR0, a.k.a WP bit */
cr0 &= 0xfffeffff;
asm volatile ("movl %%eax, %%cr0"
:
: "a"(cr0)
);
return ret;
}
/** set CR0 with new value
* *
* * @val : new value to set in cr0
* */
void setback_cr0(unsigned int val)
{
asm volatile ("movl %%eax, %%cr0"
:
: "a"(val)
);
}
/**
* * Return the first appearence of NEEDLE in HAYSTACK.
* * */
static void *memmem(const void *haystack, size_t haystack_len,
const void *needle, size_t needle_len)
{/*{{{*/
const char *begin;
const char *const last_possible
= (const char *) haystack + haystack_len - needle_len;
if (needle_len == 0)
/* The first occurrence of the empty string is deemed to occur at
* the beginning of the string.*/
return (void *) haystack;
/* Sanity check, otherwise the loop might search through the whole
* memory.*/
if (__builtin_expect(haystack_len < needle_len, 0))
return NULL;
for (begin = (const char *) haystack; begin <= last_possible;
++begin)
if (begin == ((const char *) needle)
&& !memcmp((const void *) &begin,
(const void *) ((const char *) needle + 1),
needle_len - 1))
return (void *) begin;
return NULL;
}/*}}}*/
/**
* * Find the location of sys_call_table
* */
static unsigned long get_sys_call_table(void)
{/*{{{*/
/* we'll read first 100 bytes of int $0x80 */
#define OFFSET_SYSCALL 100
struct idtr idtr;
struct idt idt;
unsigned sys_call_off;
unsigned retval;
char sc_asm, *p;
/* well, let's read IDTR */
asm("sidt %0":"=m"(idtr)
:
:"memory" );
dbgprint("idtr base at 0x%X\n", (unsigned int)idtr.base);
/* Read in IDT for vector 0x80 (syscall) */
memcpy(&idt, (char *) idtr.base + 8 * 0x80, sizeof(idt));
sys_call_off = (idt.off2 << 16) | idt.off1;
dbgprint("idt80: flags=%X sel=%X off=%X\n",
(unsigned) idt.flags, (unsigned) idt.sel, sys_call_off);
/* we have syscall routine address now, look for syscall table
* dispatch (indirect call) */
memcpy(sc_asm, (void *)sys_call_off, OFFSET_SYSCALL);
/**
* * Search opcode of `call sys_call_table(,eax,4)'
* */
p = (char *) memmem(sc_asm, OFFSET_SYSCALL, "\xff\x14\x85", 3);
if (p == NULL)
return 0;
retval = *(unsigned *) (p + 3);
if (p) {
dbgprint("sys_call_table at 0x%x, call dispatch at 0x%x\n",
retval, (unsigned int) p);
}
return retval;
#undef OFFSET_SYSCALL
}/*}}}*/
asmlinkage long new_read(unsigned int fd, char __user *buf, size_t count)
{
long ret;
struct file *file;
ret = old_read(fd, buf, count);
/*0 represent EOF
* We just collect a 'read' when finished
*/
if(ret == 0){
file = fget(fd);
if(file){
fput(file);
}
}
return ret;
}
static int intercept_init(void)
{
my_table = (void **)get_sys_call_table();
if (my_table == NULL)
return -1;
dbgprint("sys call table address %p\n", (void *) my_table);
#define REPLACE(x) old_##x = my_table;\
my_table = new_##x
REPLACE(read);
#undef REPLACE
return 0;
}
static int __init this_init(void)
{
int ret;
printk("syscall intercept: Hi, poor linux!\n");
orig_cr0 = clear_and_return_cr0();
ret = intercept_init();
setback_cr0(orig_cr0);
return ret;
}
static void __exit this_fini(void)
{
printk("syscall intercept: bye, poor linux!\n");
#define RESTORE(x) my_table = old_##x
orig_cr0 = clear_and_return_cr0();
RESTORE(read);
setback_cr0(orig_cr0);
#undef RESTORE
}
module_init(this_init);
module_exit(this_fini);
没有明显的疑点。代码看似没有大问题。如下一个小问题：
181行long ret;
old_read函数返回值应该是ssize_t类型的，在32位系统中为int型的，建议改改。
从故障最终的表现看，应该是堆栈被**了，EIP指针都不对了，导致堆栈解析不了。不太好直接看出问题。可能是内存越界之类的~
要定位的话，估计得再仔细分析下vmcore，或者进一步打点看看了。 回复 8# humjb_1983
我是以include/linux/syscalls.h的函数原型来定义的，那里就是
asmlinkage long sys_read(unsigned int fd, char __user *buf, size_t count);
这个会有影响吗？:mrgreen:
wugj03 发表于 2015-01-15 14:46 static/image/common/back.gif
回复 8# humjb_1983
我是以include/linux/syscalls.h的函数原型来定义的，那里就是
呵呵，我看我的环境(3.10版本)跟你的可能不一样。
看起来影响也不大，只是暂时没有其它想法了。。。
页:
[1]