[PATCH v1 08/10] lkdtm: Really write into kernel text in WRITE_KERN
From: Christophe Leroy <hidden>
Date: 2021-10-11 15:27:41
Also in:
linux-arch, linuxppc-dev, lkml
Subsystem:
char and misc drivers, linux kernel dump test module (lkdtm), the rest · Maintainers:
Arnd Bergmann, Greg Kroah-Hartman, Kees Cook, Linus Torvalds
WRITE_KERN is supposed to overwrite some kernel text, namely do_overwritten() function. But at the time being it overwrites do_overwritten() function descriptor, not function text. Fix it by dereferencing the function descriptor to obtain function text pointer. And make do_overwritten() noinline so that it is really do_overwritten() which is called by lkdtm_WRITE_KERN(). Signed-off-by: Christophe Leroy <redacted> --- drivers/misc/lkdtm/perms.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/misc/lkdtm/perms.c b/drivers/misc/lkdtm/perms.c
index 60b3b2fe929d..442d60ed25ef 100644
--- a/drivers/misc/lkdtm/perms.c
+++ b/drivers/misc/lkdtm/perms.c@@ -5,6 +5,7 @@ * even non-readable regions. */ #include "lkdtm.h" +#include <linux/kallsyms.h> #include <linux/slab.h> #include <linux/vmalloc.h> #include <linux/mman.h>
@@ -37,7 +38,7 @@ static noinline void do_nothing(void) } /* Must immediately follow do_nothing for size calculuations to work out. */ -static void do_overwritten(void) +static noinline void do_overwritten(void) { pr_info("do_overwritten wasn't overwritten!\n"); return;
@@ -113,8 +114,9 @@ void lkdtm_WRITE_KERN(void) size_t size; volatile unsigned char *ptr; - size = (unsigned long)do_overwritten - (unsigned long)do_nothing; - ptr = (unsigned char *)do_overwritten; + size = (unsigned long)dereference_symbol_descriptor(do_overwritten) - + (unsigned long)dereference_symbol_descriptor(do_nothing); + ptr = dereference_symbol_descriptor(do_overwritten); pr_info("attempting bad %zu byte write at %px\n", size, ptr); memcpy((void *)ptr, (unsigned char *)do_nothing, size);
--
2.31.1