Commit b6491339 authored by Christophe Leroy's avatar Christophe Leroy Committed by Michael Ellerman
Browse files

lkdtm: Really write into kernel text in WRITE_KERN 



WRITE_KERN is supposed to overwrite some kernel text, namely
do_overwritten() function.

But at the time being it overwrites do_overwritten() function
descriptor, not function text.

Fix it by dereferencing the function descriptor to obtain
function text pointer. Export dereference_function_descriptor()
for when LKDTM is built as a module.

And make do_overwritten() noinline so that it is really
do_overwritten() which is called by lkdtm_WRITE_KERN().

Signed-off-by: default avatarChristophe Leroy <christophe.leroy@csgroup.eu>
Acked-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/31e58eaffb5bc51c07d8d4891d1982100ade8cfc.1644928018.git.christophe.leroy@csgroup.eu
parent 69b420ed

drivers/misc/lkdtm/perms.c

+5 −3
Original line number Diff line number Diff line
@@ -10,6 +10,7 @@ 
#include <linux/mman.h>

#include <linux/uaccess.h>

#include <asm/cacheflush.h>

#include <asm/sections.h>



/* Whether or not to fill the target memory area with do_nothing(). */

#define CODE_WRITE	true
@@ -37,7 +38,7 @@ static noinline void do_nothing(void) 
}



/* Must immediately follow do_nothing for size calculuations to work out. */

static void do_overwritten(void)

static noinline void do_overwritten(void)

{

	pr_info("do_overwritten wasn't overwritten!\n");

	return;
@@ -113,8 +114,9 @@ void lkdtm_WRITE_KERN(void) 
	size_t size;

	volatile unsigned char *ptr;



	size = (unsigned long)do_overwritten - (unsigned long)do_nothing;

	ptr = (unsigned char *)do_overwritten;

	size = (unsigned long)dereference_function_descriptor(do_overwritten) -

	       (unsigned long)dereference_function_descriptor(do_nothing);

	ptr = dereference_function_descriptor(do_overwritten);



	pr_info("attempting bad %zu byte write at %px\n", size, ptr);

	memcpy((void *)ptr, (unsigned char *)do_nothing, size);

kernel/extable.c

+1 −0
Original line number Diff line number Diff line
@@ -149,6 +149,7 @@ void *dereference_function_descriptor(void *ptr) 
		ptr = p;

	return ptr;

}

EXPORT_SYMBOL_GPL(dereference_function_descriptor);



void *dereference_kernel_function_descriptor(void *ptr)

{