首页 > 代码库 > Linux内核情景分析之异常访问,用户堆栈的扩展

Linux内核情景分析之异常访问,用户堆栈的扩展

2024-08-17 22:45:29   223人阅读

情景假设：

在堆内存中申请了一块内存，然后释放掉该内存，然后再去访问这块内存。也就是所说的野指针访问。

当cpu产生页面错误时,会把失败的线性地址放在cr2寄存器.线性地址缺页异常的4种情况
1.如果cpu访问的行现地址在内核态,那么很可能访问的是非连续区,需要vmalloc_fault处理.
2.缺页异常发生在中断或者内核线程时,直接失败,因为不可修改页表
3.地址在一个区间内,那就可能是已经物理地址映射了但权限问题(错误处理)或者其物理地址没有分配(分配物理内存)
4.如果找到一个在线性地址其后面的vma(线性地址在空洞).那么可能是空洞上面的区间是
堆栈区,他表示动态分配而没有分配出去的空间,有一种特殊情况,可以缺页异常使得获取物理页框
5.如果找到一个线性地址气候的vma(线性地址在空洞),那么可能是空洞上面的区间不是堆栈区,说明
这个空洞是由于一个映射区被撤销而留下的,那样直接错误处理
技术分享
 
  1. ==================== arch/i386/mm/fault.c 106 152 ====================
  2. 106  asmlinkage void do_page_fault(struct pt_regs *regs, unsigned long error_code)
  3. 107  {
  4. 108 struct task_struct *tsk;
  5. 109 struct mm_struct *mm;
  6. 110 struct vm_area_struct * vma;
  7. 111 unsigned long address;
  8. 112 unsigned long page;
  9. 113 unsigned long fixup;
  10. 114 int write;
  11. 115 siginfo_t info;
  12. 116
  13. 117 /* get the address */
  14. 118 __asm__("movl %%cr2,%0":"=r" (address));//得到失败的线性地址
  15. 119
  16. 120 tsk = current;//获取当前描述符
  17. 121
  18. 122 /*
  19. 123  * We fault-in kernel-space virtual memory on-demand. The
  20. 124  * ‘reference‘ page table is init_mm.pgd.
  21. 125  *
  22. 126  * NOTE! We MUST NOT take any locks for this case. We may
  23. 127  * be in an interrupt or a critical region, and should
  24. 128  * only copy the information from the master page table,
  25. 129  * nothing more.
  26. 130  */
  27.  //如果大于3G,表示缺页异常时,访问的是内核空间,很有可能是访问了非连续的内核空间,转到vmalloc_fault处理
  28. 131 if (address >= TASK_SIZE)
  29. 132 goto vmalloc_fault;
  30. 133
  31. 134 mm = tsk->mm;
  32. 135 info.si_code = SEGV_MAPERR;
  33. 136
  34. 137 /*
  35. 138  缺页异常发生在中断时,是错误不可以的,表示是内核线程,不可以对其页表进行修改
  36. 140  */
  37. 141 if (in_interrupt() || !mm)
  38. 142 goto no_context;
  39. 143
  40. 144 down(&mm->mmap_sem);
  41. 145
  42. 146 vma = find_vma(mm, address);//查到end大于address的地址
  43. 147 if (!vma)//是否在行现地址内,不在转为错误处理
  44. 148 goto bad_area;
  45. //在线性区内，跳到正常处理部分,可能是由于权限问题,也有可能是对应的物理地址没有分配2种情况
  46. 149 if (vma->vm_start <= address)
  47. 150 goto good_area;
  48. 151 if (!(vma->vm_flags & VM_GROWSDOWN))//如果发生在一空洞上方的区间不是堆栈区,那么此地址是由于撤销映射留下的,进行错误处理
  49. 152 goto bad_area;

  1. 220  /*
  2. 221   * Something tried to access memory that isn‘t in our memory map..
  3. 222   * Fix it, but check if it‘s kernel or user first..
  4. 223   */
  5. 224  bad_area:
  6. 225 up(&mm->mmap_sem);
  7. 226 //用户态的错误处理
  8. 227  bad_area_nosemaphore:
  9. 228 /* User mode accesses just cause a SIGSEGV */
  10. 229 if (error_code & 4) {//判断错误发生在用户态
  11. 230 tsk->thread.cr2 = address;
  12. 231 tsk->thread.error_code = error_code;
  13. 232 tsk->thread.trap_no = 14;
  14. 233 info.si_signo = SIGSEGV;//强制发送SIGEGV信号
技术分享技术分享技术分享技术分享
 
上面提到的第4种情况,因为越界访问而照成堆栈区间扩展的情况
技术分享
比如一进城要调用某个子程序,cpu需要把返回地址压栈,然而返回地址写入的是空洞地址,会引发一次页面异常错误
VM_GROWDOWN表示为1表示上面是堆栈区
  1. if (!(vma->vm_flags & VM_GROWSDOWN))
  2. 152 goto bad_area;
  3. 153 if (error_code & 4) {
  4. 154 /*
  5. 155  * 还要检查异常地址是否紧挨着esp指针,如果远超过32,那就是非法越界,错误处理
  6. 32是因为pusha(一次把32个字节压入栈中)
  7. 159  */
  8. 160 if (address + 32 < regs->esp)
  9. 161 goto bad_area;
  10. 162 }
  11. //扩展堆栈
  12. 163 if (expand_stack(vma, address))
  13. 164 goto bad_area;
有下面注释可知,expand_stack只是更改了堆栈区的vm_area_struct结构,没有建立物理内存映射
  1. static inline int expand_stack(struct vm_area_struct * vma, unsigned long address)
  2. 490  {
  3. 491 unsigned long grow;
  4. 492
  5. 493 address &= PAGE_MASK;//边界对齐
  6. 494 grow = (vma->vm_start - address) >> PAGE_SHIFT;//增长几个页框
  7. //判断是否超过了用户堆栈空间大小限制
  8. 495 if (vma->vm_end - address > current->rlim[RLIMIT_STACK].rlim_cur ||
  9. 496     ((vma->vm_mm->total_vm + grow) << PAGE_SHIFT) > current->rlim[RLIMIT_AS].rlim_cur)
  10. 497 return -ENOMEM;
  11. 498 vma->vm_start = address;//重新设置虚拟地址
  12. 499 vma->vm_pgoff -= grow;//偏移减去grow
  13. 500 vma->vm_mm->total_vm += grow;//地址空间大小
  14. 501 if (vma->vm_flags & VM_LOCKED)
  15. 502 vma->vm_mm->locked_vm += grow;
  16. 503 return 0;
  17. 504  }

 
  1. [do_page_fault()]
  2. 165  /*
  3. 166   * Ok, we have a good vm_area for this memory access, so
  4. 167   * we can handle it..
  5. 168   */
  6. 169  good_area:
  7. 170 info.si_code = SEGV_ACCERR;
  8. 171 write = 0;
  9. 172 switch (error_code & 3) {
  10. 173 default:  /* 3: write, present */
  11. 174  #ifdef TEST_VERIFY_AREA
  12. 175 if (regs->cs == KERNEL_CS)
  13. 176 printk("WP fault at %08lx\n", regs->eip);
  14. 177  #endif
  15. 178 /* fall through */
  16. 179 case 2: /* write, not present */
  17. 180 if (!(vma->vm_flags & VM_WRITE))//堆栈段可读可写,调到196行
  18. 181 goto bad_area;
  19. 182 write++;
  20. 183 break;
  21. 184 case 1: /* read, present */

  23. 185 goto bad_area;
  24. 186 case 0: /* read, not present */
  25. 187 if (!(vma->vm_flags & (VM_READ | VM_EXEC)))
  26. 188 goto bad_area;
  27. 189 }
  28. 190
  29. 191 /*
  30. 192  * If for any reason at all we couldn‘t handle the fault,
  31. 193  * make sure we exit gracefully rather than endlessly redo
  32. 194  * the fault.
  33. 195  */
  34. 196 switch (handle_mm_fault(mm, vma, address, write)) {
  35. 197 case 1:
  36. 198 tsk->min_flt++;
  37. 199 break;
  38. 200 case 2:
  39. 201 tsk->maj_flt++;
  40. 202 break;
  41. 203 case 0:
  42. 204 goto do_sigbus;
  43. 205 default:
  44. 206 goto out_of_memory;
  45. 207 }

  1. [do_page_fault()>handle_mm_fault()]
  2. 1189 /*
  3. 1190  * By the time we get here, we already hold the mm semaphore
  4. 1191  */
  5. 1192 int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct * vma,
  6. 1193 unsigned long address, int write_access)
  7. 1194 {
  8. 1195 int ret = -1;
  9. 1196 pgd_t *pgd;
  10. 1197 pmd_t *pmd;
  11. 1198
  12. 1199 pgd = pgd_offset(mm, address);//获取该地址所在页面目录项的指针(页表的地址)
  13. 1200 pmd = pmd_alloc(pgd, address);//分配pmd目录
  14. 1201
  15. 1202 if (pmd) {
  16. 1203 pte_t * pte = pte_alloc(pmd, address);//分配pte表现
  17. 1204 if (pte)
  18. //分配物理地址
  19. 1205 ret = handle_pte_fault(mm, vma, address, write_access, pte);
  20. 1206 }
  21. 1207 return ret;
  22. 1208 }

  1. [do_page_fault()>handle_mm_fault()>pte_alloc()]
  2. 120  extern inline pte_t * pte_alloc(pmd_t * pmd, unsigned long address)
  3. 121  {
  4. 122 address = (address >> PAGE_SHIFT) & (PTRS_PER_PTE - 1);//给定地址转换为页表的下标,用于定位页表项
  5. 124 if (pmd_none(*pmd))//如果pmd所指向的页表为空,那就转到getnew分配
  6. 125 goto getnew;
  7. 126 if (pmd_bad(*pmd))
  8. 127 goto fix;
  9. 128 return (pte_t *)pmd_page(*pmd) + address;
  10. 129  getnew:
  11. 130  {
  12. 131 unsigned long page = (unsigned long) get_pte_fast();//从缓冲池获取(释放页表,并非一定会释放物理地址)
  13. 132
  14. 133 if (!page)
  15. 134 return get_pte_slow(pmd, address);
  16. 135 set_pmd(pmd, __pmd(_PAGE_TABLE + __pa(page)));//写入中间pmd
  17. 136 return (pte_t *)page + address;
  18. 137  }
  19. 138  fix:
  20. 139 __handle_bad_pmd(pmd);
  21. 140 return NULL;
  22. 141  }

  1. [do_page_fault()>handle_mm_fault()>handle_pte_fault()]
  2. 1135 /*
  3. 1136  * These routines also need to handle stuff like marking pages dirty
  4. 1137  * and/or accessed for architectures that don‘t do it in hardware (most
  5. 1138  * RISC architectures).  The early dirtying is also good on the i386.
  6. 1139  *
  7. 1140  * There is also a hook called "update_mmu_cache()" that architectures
  8. 1141  * with external mmu caches can use to update those (ie the Sparc or
  9. 1142  * PowerPC hashed page tables that act as extended TLBs).
  10. 1143  *
  11. 1144  * Note the "page_table_lock". It is to protect against kswapd removing
  12. 1147  * we can drop the lock early.
  13. 1148  *
  14. 1149  * The adding of pages is protected by the MM semaphore (which we hold),
  15. 1150  * so we don‘t need to worry about a page being suddenly been added into
  16. 1151  * our VM.
  17. 1152  */
  18. 1153 static inline int handle_pte_fault(struct mm_struct *mm,
  19. 1154 struct vm_area_struct * vma, unsigned long address,
  20. 1155 int write_access, pte_t * pte)
  21. 1156 {
  22. 1157 pte_t entry;
  23. 1158
  24. 1159 /*
  25. 1160  * We need the page table lock to synchronize with kswapd
  26. 1161  * and the SMP-safe atomic PTE updates.
  27. 1162  */
  28. 1163 spin_lock(&mm->page_table_lock);
  29. 1164 entry = *pte;//pte对应的物理地址当然没有,所以为null
  30. 1165 if (!pte_present(entry)) {//检查其对应的物理地址否为空
  31. 1166 /*
  32. 1167  * If it truly wasn‘t present, we know that kswapd
  33. 1168  * and the PTE updates will not touch it later. So
  34. 1169  * drop the lock.
  35. 1170  */
  36. 1171 spin_unlock(&mm->page_table_lock);
  37. 1172 if (pte_none(entry))//页表项内容为0，表明进程未访问过该页 
  38. 1173 return do_no_page(mm, vma, address, write_access, pte);//调用do_no_page分配
  39. //否则换出
  40. 1174 return do_swap_page(mm, vma, address, pte, pte_to_swp_entry(entry), write_access);
  41. 1175 }
  42. 1176
  43. 1177 if (write_access) {
  44. 1178 if (!pte_write(entry))
  45. 1179 return do_wp_page(mm, vma, address, pte, entry);
  46. 1180
  47. 1181 entry = pte_mkdirty(entry);
  48. 1182 }
  49. 1183 entry = pte_mkyoung(entry);
  50. 1184 establish_pte(vma, address, pte, entry);
  51. 1185 spin_unlock(&mm->page_table_lock);
  52. 1186 return 1;
  53. 1187 }
  54. 1145  * pages from under us. Note that kswapd only ever _removes_ pages, never
  55. 1146  * adds them. As such, once we have noticed that the page is not present

  1. [do_page_fault()>handle_mm_fault()>handle_pte_fault()>do_no_page()]
  2. 1080 /*
  3. 1081  * do_no_page() tries to create a new page mapping. It aggressively
  4. 1082  * tries to share with existing pages, but makes a separate copy if
  5. 1083  * the "write_access" parameter is true in order to avoid the next
  6. 1084  * page fault.
  7. 1085  *
  8. 1086  * As this is called only for pages that do not currently exist, we
  9. 1087  * do not need to flush old virtual caches or the TLB.
  10. 1088  *
  11. 1089  * This is called with the MM semaphore held.
  12. 1090  */
  13. 1091 static int do_no_page(struct mm_struct * mm, struct vm_area_struct * vma,
  14. 1092 unsigned long address, int write_access, pte_t *page_table)
  15. 1093 {
  16. 1094 struct page * new_page;
  17. 1095 pte_t entry;
  18. 1096
  19. 1097 if (!vma->vm_ops || !vma->vm_ops->nopage)
  20. 1098 return do_anonymous_page(mm, vma, page_table, write_access, address);//只是其封装而已
  21.     ......
  22. ==================== mm/memory.c 1133 1133 ====================
  23. 1133 }

  1. [do_page_fault()>handle_mm_fault()>handle_pte_fault()>do_no_page()>do_anonymous_page()]
  2. 1058 /*
  3. 1059  * This only needs the MM semaphore
  4. 1060  */
  5. 1061 static int do_anonymous_page(struct mm_struct * mm, struct vm_area_struct * vma, pte_t *page_table,
  6. int write_access, unsigned long addr)
  7. 1062 {
  8. 1063 struct page *page = NULL;
  9. //如果引起页面异常是一次读操作,那么由mk_pte构建的映射表项要通过pte_wrprotect修正,只读属性
  10. //同时对于只读的页面,一律映射ZERO_PAGE同一个物理内存页面,也即是内容全部为0,只有可写才独立分配内存
  11. 1064 pte_t entry = pte_wrprotect(mk_pte(ZERO_PAGE(addr), vma->vm_page_prot));
  12. 1065 if (write_access) {
  13. 1066 page = alloc_page(GFP_HIGHUSER);//分配独立物理页面
  14. 1067 if (!page)
  15. 1068 return -1;
  16. 1069 clear_user_highpage(page, addr);
  17. //下面相同.只可写属性
  18. 1070 entry = pte_mkwrite(pte_mkdirty(mk_pte(page, vma->vm_page_prot)));
  19. 1071 mm->rss++;
  20. 1072 flush_page_to_ram(page);
  21. 1073 }
  22. //虚拟页面到物理内存页面映射建立
  23. 1074 set_pte(page_table, entry);
  24. 1075 /* No need to invalidate - it was non-present before */
  25. 1076 update_mmu_cache(vma, addr, entry);
  26. 1077 return 1; /* Minor fault */
  27. 1078 }








来自为知笔记(Wiz)


Linux内核情景分析之异常访问,用户堆栈的扩展


联系
我们