make memdup_user_nul() similar to memdup_user()

Call trace:
dump_backtrace+0x0/0x560 arch/arm64/kernel/stacktrace.c:130
show_stack+0x34/0x44 arch/arm64/kernel/stacktrace.c:267
__dump_stack lib/dump_stack.c:82 [inline]
dump_stack+0x1f8/0x274 lib/dump_stack.c:123
panic+0x694/0xb60 kernel/panic.c:452
check_panic_on_warn+0x108/0x12c kernel/panic.c:287
__warn+0x2a0/0x2ec kernel/panic.c:905
report_bug+0x1a8/0x2cc lib/bug.c:199
bug_handler+0x58/0xd0 arch/arm64/kernel/traps.c:1169
call_break_hook+0x160/0x1d4 arch/arm64/kernel/debug-monitors.c:322
brk_handler+0x30/0xc0 arch/arm64/kernel/debug-monitors.c:329
do_debug_exception+0x178/0x31c arch/arm64/mm/fault.c:1225
el1_dbg+0x3c/0x60 arch/arm64/kernel/entry-common.c:206
el1_sync_handler+0x164/0x1a4 arch/arm64/kernel/entry-common.c:251
el1_sync+0x74/0x100 arch/arm64/kernel/entry.S:950
__alloc_pages+0x1764/0x21a0 mm/page_alloc.c:5740
alloc_pages+0x168/0x280 mm/mempolicy.c:2336
kmalloc_order+0x44/0x1b0 mm/slab_common.c:866
kmalloc_order_trace+0x34/0x100 mm/slab_common.c:882
kmalloc_large include/linux/slab.h:541 [inline]
__kmalloc_track_caller+0x40c/0x670 mm/slub.c:4567
memdup_user_nul+0x44/0x270 mm/util.c:273
bitmap_parselist_user+0x34/0xb0 lib/bitmap.c:688
cpumask_parselist_user include/linux/cpumask.h:735 [inline]
preferred_cpuset_write+0xe4/0x2b4 fs/proc/base.c:3405 // 这里没有对入参count做检查，如果传入一个很大值，会超出可分配页的范围，导致WARNING
vfs_write+0x210/0x840 fs/read_write.c:599
ksys_write+0x128/0x264 fs/read_write.c:659
__do_sys_write fs/read_write.c:671 [inline]
__se_sys_write fs/read_write.c:668 [inline]
__arm64_sys_write+0x78/0xac fs/read_write.c:668
__invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
el0_svc_common.constprop.0+0x15c/0x5e4 arch/arm64/kernel/syscall.c:155
do_el0_svc+0x64/0x160 arch/arm64/kernel/syscall.c:217
el0_svc+0x24/0x34 arch/arm64/kernel/entry-common.c:385
el0_sync_handler+0xec/0x1ec arch/arm64/kernel/entry-common.c:417
el0_sync+0x160/0x180 arch/arm64/kernel/entry.S:1192

int main(void)
{
syscall(__NR_mmap, /addr=/0x1ffff000ul, /len=/0x1000ul, /prot=/0ul, /flags=/0x32ul, /fd=/-1, /offset=/0ul);
syscall(__NR_mmap, /addr=/0x20000000ul, /len=/0x1000000ul, /prot=/7ul, /flags=/0x32ul, /fd=/-1, /offset=/0ul);
syscall(__NR_mmap, /addr=/0x21000000ul, /len=/0x1000ul, /prot=/0ul, /flags=/0x32ul, /fd=/-1, /offset=/0ul);
intptr_t res = 0;
memcpy((void*)0x20000080, "/proc/348/task/348/preferred_cpuset", 35);
res = syscall(__NR_openat, /fd=/0xffffffffffffff9cul, /file=/0x20000080ul, /flags=/1ul, /mode=/0ul);
if (res != -1)
r[0] = res;
(uint32_t)0x20002100 = 0x10;
(uint32_t)0x20002104 = 0;
(uint64_t)0x20002108 = 0;
syscall(__NR_write, /fd=/r[0], /arg=/0x20002100ul, /len=/0xfffffdfeul); // 这里传入长度为 0xfffffdfe，写的文件是 /proc/348/task/348/preferred_cpuset
return 0;
}

preferred_cpuset_write 是通过 CONFIG_QOS_SCHED_DYNAMIC_AFFINITY 控制

src-openEuler/kernel

内容风险标识

评论 (1)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识