【KPWN】一种相对新的 Kernel Elastic Object 结构体 anon_vma_name

#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/ipc.h>
#include <sys/msg.h>
#include <sys/wait.h>
#include <sys/syscall.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
#include <sys/prctl.h>
#include <string.h>

#define PAGE_SIZE (1 << 12)

#define ALLOCS 2048*4
static size_t times[ALLOCS];
static void *addresses[2*ALLOCS];

#ifndef PR_SET_VMA
#define PR_SET_VMA 0x53564d41
#define PR_SET_VMA_ANON_NAME 0
#endif
int rename_vma(unsigned long addr, unsigned long size, char *name)
{
    int res;
    res = prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, addr, size, name);
    if (res < 0)
        printf("prctl");
    return res;
}

void init_vma_name(void)
{
    pr_info("init addresses\n");
    for (int i = 0; i < 2*ALLOCS; i++) {
        addresses[i] = mmap(0, 1024, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
        if (addresses[i] == MAP_FAILED)
            printf("mmap");
    }
}

void alloc_objs(size_t size)
{
    // size from 0 to 80
    pr_info("allocate %d objs\n", ALLOCS);
    char *buffer;
    buffer = malloc(size);
    memset(buffer, 0x41, size);
    buffer[prev_size - 1] = 0;
    for (size_t i = 0; i < ALLOCS; i++) {
        char store[5];
        memset(store, 0, 5);
        snprintf(store, 5, "%04ld", i);
        memcpy(buffer, store, 4);
        printf("buffer %s len %ld\n", buffer, strlen(buffer));
        rename_vma((unsigned long) addresses[i], 1024, buffer);
    }
}

// free
// rename_vma((unsigned long) addresses[i], 1024, NULL);

// read
// cat /proc/self/maps

SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
    unsigned long, arg4, unsigned long, arg5)

  case PR_SET_VMA:
    error = prctl_set_vma(arg2, arg3, arg4, arg5);
    break;

int prctl(PR_SET_VMA, unsigned long opt, unsigned long addr, unsigned long size, const char* name)

#ifdef CONFIG_ANON_VMA_NAME

#define ANON_VMA_NAME_MAX_LEN    80
#define ANON_VMA_NAME_INVALID_CHARS  "\\`$[]"

static int prctl_set_vma(unsigned long opt, unsigned long addr,
       unsigned long size, unsigned long arg)
{
  struct mm_struct *mm = current->mm;
  const char __user *uname;
  struct anon_vma_name *anon_name = NULL;
  int error;

  switch (opt) {
  // highlight-next-line
  case PR_SET_VMA_ANON_NAME:
    uname = (const char __user *)arg;
    if (uname) {
      char *name, *pch;

      // highlight-next-line
      name = strndup_user(uname, ANON_VMA_NAME_MAX_LEN);
      if (IS_ERR(name))
        return PTR_ERR(name);

      for (pch = name; *pch != '\0'; pch++) {
        if (!is_valid_name_char(*pch)) {
          kfree(name);
          return -EINVAL;
        }
      }
      /* anon_vma has its own copy */
      // highlight-next-line
      anon_name = anon_vma_name_alloc(name);
      kfree(name);
      if (!anon_name)
        return -ENOMEM;

    }

    mmap_write_lock(mm);
    error = madvise_set_anon_name(mm, addr, size, anon_name);
    mmap_write_unlock(mm);
    anon_vma_name_put(anon_name);
    break;
  default:
    error = -EINVAL;
  }

  return error;
}

struct anon_vma_name *anon_vma_name_alloc(const char *name)
{
  struct anon_vma_name *anon_name;
  size_t count;

  /* Add 1 for NUL terminator at the end of the anon_name->name */
  count = strlen(name) + 1;
  anon_name = kmalloc(struct_size(anon_name, name, count), GFP_KERNEL);
  if (anon_name) {
    kref_init(&anon_name->kref);
    memcpy(anon_name->name, name, count);
  }

  return anon_name;
}

struct anon_vma_name {
  struct kref kref;
  /* The name needs to be at the end because it is dynamically sized. */
  char name[];
};

struct kref {
  refcount_t refcount;
};

typedef struct refcount_struct {
  atomic_t refs;
} refcount_t;

typedef struct {
  int counter;
} atomic_t;

void anon_vma_name_free(struct kref *kref)
{
  struct anon_vma_name *anon_name =
      container_of(kref, struct anon_vma_name, kref);
  kfree(anon_name);
}

static void
show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
{
  struct anon_vma_name *anon_name = NULL;
  struct mm_struct *mm = vma->vm_mm;
  struct file *file = vma->vm_file;
  vm_flags_t flags = vma->vm_flags;
  unsigned long ino = 0;
  unsigned long long pgoff = 0;
  unsigned long start, end;
  dev_t dev = 0;
  const char *name = NULL;

  if (file) {
    struct inode *inode = file_inode(vma->vm_file);
    dev = inode->i_sb->s_dev;
    ino = inode->i_ino;
    pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
  }

  start = vma->vm_start;
  end = vma->vm_end;
  show_vma_header_prefix(m, start, end, flags, pgoff, dev, ino);
  if (mm)
    anon_name = anon_vma_name(vma);

  /*
   * Print the dentry name for named mappings, and a
   * special [heap] marker for the heap:
   */
  if (file) {
    seq_pad(m, ' ');
    /*
     * If user named this anon shared memory via
     * prctl(PR_SET_VMA ..., use the provided name.
     */
    if (anon_name)
      seq_printf(m, "[anon_shmem:%s]", anon_name->name);
    else
      seq_file_path(m, file, "\n");
    goto done;
  }