linux-kernel - Re: [PATCH] kprobe : fix out-of-bounds in register_kretprobe when parsing negative data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <dd740077-f7f5-7b6a-11c4-d4c952a539a0@huawei.com>
Date:   Wed, 13 Dec 2017 20:25:06 +0800
From:   "chengjian (D)" <cj.chengjian@...wei.com>
To:     <ananth@...ux.vnet.ibm.com>, <anil.s.keshavamurthy@...el.com>,
        <davem@...emloft.net>, <mhiramat@...nel.org>,
        <linux-kernel@...r.kernel.org>
CC:     <xiexiuqi@...wei.com>, <huawei.libin@...wei.com>
Subject: Re: [PATCH] kprobe : fix out-of-bounds in register_kretprobe when
 parsing negative data_size

Hi

The demo is like:

#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/kprobes.h>
#include <linux/version.h>

static int data_size=0;
module_param(data_size, int, 0644);

static struct kretprobe rp;

static int ret_handler(struct kretprobe_instance *ri, struct pt_regs *regs)
{
     printk(KERN_DEBUG "ret_handler\n");
     return 0;
}
static int entry_handler(struct kretprobe_instance *ri, struct pt_regs 
*regs)
{
     printk(KERN_DEBUG "entry_handler\n");
         return 0;
}
static int __init kretprobe_init(void)
{
     int ret;
     printk(KERN_DEBUG"size = %ld\n", sizeof(struct kretprobe_instance) 
- 1);
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,2,0)
     rp.kp.addr = (kprobe_opcode_t *)kallsyms_lookup_name("_do_fork");
#else
     rp.kp.addr = (kprobe_opcode_t *)kallsyms_lookup_name("do_fork");
#endif

     rp.handler = ret_handler;
     rp.entry_handler = entry_handler;
     rp.data_size = data_size;
     rp.maxactive = 1;

     ret = register_kretprobe(&rp);
     if (ret < 0)
     {
         printk(KERN_DEBUG "register_kretprobe failed, returned %d\n", ret);
         return -1;
     }
     printk(KERN_DEBUG "register_kretprobe pass\n");
     return 0;
}

static void __exit kretprobe_exit(void)
{
     unregister_kretprobe(&rp);
     printk(KERN_DEBUG "kretprobe  unregistered\n");
}

module_init(kretprobe_init)
module_exit(kretprobe_exit)
MODULE_LICENSE("GPL");





insmod this module

     sudo insmod testRegKretprobe.ko data_size=-1



Thanks.
CHENG Jian