Messages in this thread | | | Subject | Re: [PATCH] kprobe : fix out-of-bounds in register_kretprobe when parsing negative data_size | From | "chengjian (D)" <> | Date | Wed, 13 Dec 2017 20:25:06 +0800 |
| |
Hi
The demo is like:
#include <linux/kernel.h> #include <linux/module.h> #include <linux/moduleparam.h> #include <linux/kprobes.h> #include <linux/version.h>
static int data_size=0; module_param(data_size, int, 0644);
static struct kretprobe rp;
static int ret_handler(struct kretprobe_instance *ri, struct pt_regs *regs) { printk(KERN_DEBUG "ret_handler\n"); return 0; } static int entry_handler(struct kretprobe_instance *ri, struct pt_regs *regs) { printk(KERN_DEBUG "entry_handler\n"); return 0; } static int __init kretprobe_init(void) { int ret; printk(KERN_DEBUG"size = %ld\n", sizeof(struct kretprobe_instance) - 1); #if LINUX_VERSION_CODE >= KERNEL_VERSION(4,2,0) rp.kp.addr = (kprobe_opcode_t *)kallsyms_lookup_name("_do_fork"); #else rp.kp.addr = (kprobe_opcode_t *)kallsyms_lookup_name("do_fork"); #endif
rp.handler = ret_handler; rp.entry_handler = entry_handler; rp.data_size = data_size; rp.maxactive = 1;
ret = register_kretprobe(&rp); if (ret < 0) { printk(KERN_DEBUG "register_kretprobe failed, returned %d\n", ret); return -1; } printk(KERN_DEBUG "register_kretprobe pass\n"); return 0; }
static void __exit kretprobe_exit(void) { unregister_kretprobe(&rp); printk(KERN_DEBUG "kretprobe unregistered\n"); }
module_init(kretprobe_init) module_exit(kretprobe_exit) MODULE_LICENSE("GPL");
insmod this module
sudo insmod testRegKretprobe.ko data_size=-1
Thanks. CHENG Jian
| |