lkml.org 
[lkml]   [2021]   [Oct]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v1 08/10] lkdtm: Really write into kernel text in WRITE_KERN
    Date
    WRITE_KERN is supposed to overwrite some kernel text, namely
    do_overwritten() function.

    But at the time being it overwrites do_overwritten() function
    descriptor, not function text.

    Fix it by dereferencing the function descriptor to obtain
    function text pointer.

    And make do_overwritten() noinline so that it is really
    do_overwritten() which is called by lkdtm_WRITE_KERN().

    Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
    ---
    drivers/misc/lkdtm/perms.c | 8 +++++---
    1 file changed, 5 insertions(+), 3 deletions(-)

    diff --git a/drivers/misc/lkdtm/perms.c b/drivers/misc/lkdtm/perms.c
    index 60b3b2fe929d..442d60ed25ef 100644
    --- a/drivers/misc/lkdtm/perms.c
    +++ b/drivers/misc/lkdtm/perms.c
    @@ -5,6 +5,7 @@
    * even non-readable regions.
    */
    #include "lkdtm.h"
    +#include <linux/kallsyms.h>
    #include <linux/slab.h>
    #include <linux/vmalloc.h>
    #include <linux/mman.h>
    @@ -37,7 +38,7 @@ static noinline void do_nothing(void)
    }

    /* Must immediately follow do_nothing for size calculuations to work out. */
    -static void do_overwritten(void)
    +static noinline void do_overwritten(void)
    {
    pr_info("do_overwritten wasn't overwritten!\n");
    return;
    @@ -113,8 +114,9 @@ void lkdtm_WRITE_KERN(void)
    size_t size;
    volatile unsigned char *ptr;

    - size = (unsigned long)do_overwritten - (unsigned long)do_nothing;
    - ptr = (unsigned char *)do_overwritten;
    + size = (unsigned long)dereference_symbol_descriptor(do_overwritten) -
    + (unsigned long)dereference_symbol_descriptor(do_nothing);
    + ptr = dereference_symbol_descriptor(do_overwritten);

    pr_info("attempting bad %zu byte write at %px\n", size, ptr);
    memcpy((void *)ptr, (unsigned char *)do_nothing, size);
    --
    2.31.1
    \
     
     \ /
      Last update: 2021-10-11 17:28    [W:4.449 / U:0.428 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site