免费注册 查看新帖 |

Chinaunix

  平台 论坛 博客 文库
最近访问板块 发新帖
查看: 2044 | 回复: 1
打印 上一主题 下一主题

[内核模块] 2.6.38内核中截获execve系统调用出现段错误?? [复制链接]

论坛徽章:
0
跳转到指定楼层
1 [收藏(0)] [报告]
发表于 2013-05-03 16:31 |只看该作者 |倒序浏览
在ubuntu11.04系统上(内核是2.6.38) 截获execve系统调用出现下面的错误,是什么原因导致的?

[  208.366011] BUG: unable to handle kernel paging request at c151418c
[  208.366051] IP: [<f83810a4>] this_init+0xa4/0x1000 [allprotect]
[  208.366085] *pde = 32921063 *pte = 01514161
[  208.366111] Oops: 0003 [#1] SMP
[  208.366133] last sysfs file: /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_map
[  208.366171] Modules linked in: allprotect(+) binfmt_misc snd_hda_codec_realtek usbhid snd_hda_intel i915 snd_hda_codec snd_hwdep snd_pcm snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer snd_seq_device hid ppdev snd drm_kms_helper psmouse drm parport_pc serio_raw soundcore i2c_algo_bit video snd_page_alloc lp parport r8169
[  208.366381]
[  208.366391] Pid: 1723, comm: insmod Not tainted 2.6.38-16-generic #67-Ubuntu ECS G31T-M5/G31T-M5
[  208.366444] EIP: 0060:[<f83810a4>] EFLAGS: 00010286 CPU: 1
[  208.366472] EIP is at this_init+0xa4/0x1000 [allprotect]
[  208.366498] EAX: c1514160 EBX: eefcbe50 ECX: c173bba8 EDX: 00000000
[  208.366528] ESI: f837d020 EDI: 00040000 EBP: eefcbf58 ESP: eefcbe38
[  208.366558]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[  208.366585] Process insmod (pid: 1723, ti=eefca000 task=eeee3f20 task.ti=eefca000)
[  208.366620] Stack:
[  208.366631]  f837c11f c100319c f837c1c4 00000306 f837c02e c1514160 6f682f3c 762f656d
[  208.366684]  612f7373 72706c6c 6365746f 6c612f74 6568746c 746f7270 2e746365 37373a63
[  208.366736]  68743e34 695f7369 2074696e 67202d2d 73207465 63207379 206c6c61 6c626174
[  208.366788] Call Trace:
[  208.366804]  [<c100319c>] ? ptregs_execve+0x0/0x18
[  208.366830]  [<c10833a4>] ? smp_call_function_many+0x1d4/0x230
[  208.366860]  [<f8381000>] ? this_init+0x0/0x1000 [allprotect]
[  208.366889]  [<c102f540>] ? __cpa_flush_range+0x0/0x30
[  208.366915]  [<c102f540>] ? __cpa_flush_range+0x0/0x30
[  208.366940]  [<c102f565>] ? __cpa_flush_range+0x25/0x30
[  208.366967]  [<f8381000>] ? this_init+0x0/0x1000 [allprotect]
[  208.366996]  [<c102fde2>] ? change_page_attr_set_clr+0x152/0x2b0
[  208.367026]  [<c10cfe3f>] ? trace_module_notify+0x2f/0x170
[  208.367055]  [<f8381000>] ? this_init+0x0/0x1000 [allprotect]
[  208.367083]  [<c1001255>] do_one_initcall+0x35/0x170
[  208.367109]  [<f8381000>] ? this_init+0x0/0x1000 [allprotect]
[  208.367138]  [<c1088c4b>] sys_init_module+0xdb/0x230
[  208.367163]  [<c1125e45>] ? sys_close+0x75/0xd0
[  208.367187]  [<c150ac54>] syscall_call+0x7/0xb
[  208.367209] Code: ff a3 c4 d1 37 f8 48 75 3d a1 c8 d1 37 f8 8b 40 2c c7 04 24 1f c1 37 f8 a3 e8 d1 37 f8 89 44 24 04 e8 13 71 18 c9 a1 c8 d1 37 f8 <c7> 40 2c 50 b1 37 f8 c7 44 24 04 50 b1 37 f8 c7 04 24 2c c1 37
[  208.367435] EIP: [<f83810a4>] this_init+0xa4/0x1000 [allprotect] SS:ESP 0068:eefcbe38
[  208.367478] CR2: 00000000c151418c
[  208.392767] ---[ end trace e950e4c0e47569aa ]---

论坛徽章:
0
2 [报告]
发表于 2013-05-03 16:33 |只看该作者
新写的execve函数为:
long new_execve(const char __user *name,
        const char __user *const __user *argv,
        const char __user *const __user *envp, struct pt_regs *regs)
{
    printk("new execve.................\n");
    long error;
    char *filename;

    filename = getname(name);
    error = PTR_ERR(filename);
    if (IS_ERR(filename))
        return error;
    error = new_do_execve(filename, argv, envp, regs);

#ifdef CONFIG_X86_32
    if (error == 0) {
        /* Make sure we don't return using sysenter.. */
               set_thread_flag(TIF_IRET);
        }
#endif

    putname(filename);
    return error;
}
您需要登录后才可以回帖 登录 | 注册

本版积分规则 发表回复

  

北京盛拓优讯信息技术有限公司. 版权所有 京ICP备16024965号-6 北京市公安局海淀分局网监中心备案编号:11010802020122 niuxiaotong@pcpop.com 17352615567
未成年举报专区
中国互联网协会会员  联系我们:huangweiwei@itpub.net
感谢所有关心和支持过ChinaUnix的朋友们 转载本站内容请注明原作者名及出处

清除 Cookies - ChinaUnix - Archiver - WAP - TOP