zoukankan      html  css  js  c++  java

  • Linux内核情景分析之异常访问,用户堆栈的扩展

    情景假设：

    在堆内存中申请了一块内存，然后释放掉该内存，然后再去访问这块内存。也就是所说的野指针访问。

    当cpu产生页面错误时,会把失败的线性地址放在cr2寄存器.线性地址缺页异常的4种情况
    1.如果cpu访问的行现地址在内核态,那么很可能访问的是非连续区,需要vmalloc_fault处理.
    2.缺页异常发生在中断或者内核线程时,直接失败,因为不可修改页表
    3.地址在一个区间内,那就可能是已经物理地址映射了但权限问题(错误处理)或者其物理地址没有分配(分配物理内存)
    4.如果找到一个在线性地址其后面的vma(线性地址在空洞).那么可能是空洞上面的区间是
    堆栈区,他表示动态分配而没有分配出去的空间,有一种特殊情况,可以缺页异常使得获取物理页框
    5.如果找到一个线性地址气候的vma(线性地址在空洞),那么可能是空洞上面的区间不是堆栈区,说明
    这个空洞是由于一个映射区被撤销而留下的,那样直接错误处理
     
    1. ==================== arch/i386/mm/fault.c 106 152 ====================
    2. 106  asmlinkage void do_page_fault(struct pt_regs *regs, unsigned long error_code)
    3. 107  {
    4. 108 struct task_struct *tsk;
    5. 109 struct mm_struct *mm;
    6. 110 struct vm_area_struct * vma;
    7. 111 unsigned long address;
    8. 112 unsigned long page;
    9. 113 unsigned long fixup;
    10. 114 int write;
    11. 115 siginfo_t info;
    12. 116
    13. 117 /* get the address */
    14. 118 __asm__("movl %%cr2,%0":"=r" (address));//得到失败的线性地址
    15. 119
    16. 120 tsk = current;//获取当前描述符
    17. 121
    18. 122 /*
    19. 123  * We fault-in kernel-space virtual memory on-demand. The
    20. 124  * 'reference' page table is init_mm.pgd.
    21. 125  *
    22. 126  * NOTE! We MUST NOT take any locks for this case. We may
    23. 127  * be in an interrupt or a critical region, and should
    24. 128  * only copy the information from the master page table,
    25. 129  * nothing more.
    26. 130  */
    27.  //如果大于3G,表示缺页异常时,访问的是内核空间,很有可能是访问了非连续的内核空间,转到vmalloc_fault处理
    28. 131 if (address >= TASK_SIZE)
    29. 132 goto vmalloc_fault;
    30. 133
    31. 134 mm = tsk->mm;
    32. 135 info.si_code = SEGV_MAPERR;
    33. 136
    34. 137 /*
    35. 138  缺页异常发生在中断时,是错误不可以的,表示是内核线程,不可以对其页表进行修改
    36. 140  */
    37. 141 if (in_interrupt() || !mm)
    38. 142 goto no_context;
    39. 143
    40. 144 down(&mm->mmap_sem);
    41. 145
    42. 146 vma = find_vma(mm, address);//查到end大于address的地址
    43. 147 if (!vma)//是否在行现地址内,不在转为错误处理
    44. 148 goto bad_area;
    45. //在线性区内，跳到正常处理部分,可能是由于权限问题,也有可能是对应的物理地址没有分配2种情况
    46. 149 if (vma->vm_start <= address)
    47. 150 goto good_area;
    48. 151 if (!(vma->vm_flags & VM_GROWSDOWN))//如果发生在一空洞上方的区间不是堆栈区,那么此地址是由于撤销映射留下的,进行错误处理
    49. 152 goto bad_area;

    1. 220  /*
    2. 221   * Something tried to access memory that isn't in our memory map..
    3. 222   * Fix it, but check if it's kernel or user first..
    4. 223   */
    5. 224  bad_area:
    6. 225 up(&mm->mmap_sem);
    7. 226 //用户态的错误处理
    8. 227  bad_area_nosemaphore:
    9. 228 /* User mode accesses just cause a SIGSEGV */
    10. 229 if (error_code & 4) {//判断错误发生在用户态
    11. 230 tsk->thread.cr2 = address;
    12. 231 tsk->thread.error_code = error_code;
    13. 232 tsk->thread.trap_no = 14;
    14. 233 info.si_signo = SIGSEGV;//强制发送SIGEGV信号

     
    上面提到的第4种情况,因为越界访问而照成堆栈区间扩展的情况
    比如一进城要调用某个子程序,cpu需要把返回地址压栈,然而返回地址写入的是空洞地址,会引发一次页面异常错误
    VM_GROWDOWN表示为1表示上面是堆栈区
    1. if (!(vma->vm_flags & VM_GROWSDOWN))
    2. 152 goto bad_area;
    3. 153 if (error_code & 4) {
    4. 154 /*
    5. 155  * 还要检查异常地址是否紧挨着esp指针,如果远超过32,那就是非法越界,错误处理
    6. 32是因为pusha(一次把32个字节压入栈中)
    7. 159  */
    8. 160 if (address + 32 < regs->esp)
    9. 161 goto bad_area;
    10. 162 }
    11. //扩展堆栈
    12. 163 if (expand_stack(vma, address))
    13. 164 goto bad_area;
    有下面注释可知,expand_stack只是更改了堆栈区的vm_area_struct结构,没有建立物理内存映射
    1. static inline int expand_stack(struct vm_area_struct * vma, unsigned long address)
    2. 490  {
    3. 491 unsigned long grow;
    4. 492
    5. 493 address &= PAGE_MASK;//边界对齐
    6. 494 grow = (vma->vm_start - address) >> PAGE_SHIFT;//增长几个页框
    7. //判断是否超过了用户堆栈空间大小限制
    8. 495 if (vma->vm_end - address > current->rlim[RLIMIT_STACK].rlim_cur ||
    9. 496     ((vma->vm_mm->total_vm + grow) << PAGE_SHIFT) > current->rlim[RLIMIT_AS].rlim_cur)
    10. 497 return -ENOMEM;
    11. 498 vma->vm_start = address;//重新设置虚拟地址
    12. 499 vma->vm_pgoff -= grow;//偏移减去grow
    13. 500 vma->vm_mm->total_vm += grow;//地址空间大小
    14. 501 if (vma->vm_flags & VM_LOCKED)
    15. 502 vma->vm_mm->locked_vm += grow;
    16. 503 return 0;
    17. 504  }

     
    1. [do_page_fault()]
    2. 165  /*
    3. 166   * Ok, we have a good vm_area for this memory access, so
    4. 167   * we can handle it..
    5. 168   */
    6. 169  good_area:
    7. 170 info.si_code = SEGV_ACCERR;
    8. 171 write = 0;
    9. 172 switch (error_code & 3) {
    10. 173 default:  /* 3: write, present */
    11. 174  #ifdef TEST_VERIFY_AREA
    12. 175 if (regs->cs == KERNEL_CS)
    13. 176 printk("WP fault at %08lx
", regs->eip);
    14. 177  #endif
    15. 178 /* fall through */
    16. 179 case 2: /* write, not present */
    17. 180 if (!(vma->vm_flags & VM_WRITE))//堆栈段可读可写,调到196行
    18. 181 goto bad_area;
    19. 182 write++;
    20. 183 break;
    21. 184 case 1: /* read, present */

    23. 185 goto bad_area;
    24. 186 case 0: /* read, not present */
    25. 187 if (!(vma->vm_flags & (VM_READ | VM_EXEC)))
    26. 188 goto bad_area;
    27. 189 }
    28. 190
    29. 191 /*
    30. 192  * If for any reason at all we couldn't handle the fault,
    31. 193  * make sure we exit gracefully rather than endlessly redo
    32. 194  * the fault.
    33. 195  */
    34. 196 switch (handle_mm_fault(mm, vma, address, write)) {
    35. 197 case 1:
    36. 198 tsk->min_flt++;
    37. 199 break;
    38. 200 case 2:
    39. 201 tsk->maj_flt++;
    40. 202 break;
    41. 203 case 0:
    42. 204 goto do_sigbus;
    43. 205 default:
    44. 206 goto out_of_memory;
    45. 207 }

    1. [do_page_fault()>handle_mm_fault()]
    2. 1189 /*
    3. 1190  * By the time we get here, we already hold the mm semaphore
    4. 1191  */
    5. 1192 int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct * vma,
    6. 1193 unsigned long address, int write_access)
    7. 1194 {
    8. 1195 int ret = -1;
    9. 1196 pgd_t *pgd;
    10. 1197 pmd_t *pmd;
    11. 1198
    12. 1199 pgd = pgd_offset(mm, address);//获取该地址所在页面目录项的指针(页表的地址)
    13. 1200 pmd = pmd_alloc(pgd, address);//分配pmd目录
    14. 1201
    15. 1202 if (pmd) {
    16. 1203 pte_t * pte = pte_alloc(pmd, address);//分配pte表现
    17. 1204 if (pte)
    18. //分配物理地址
    19. 1205 ret = handle_pte_fault(mm, vma, address, write_access, pte);
    20. 1206 }
    21. 1207 return ret;
    22. 1208 }

    1. [do_page_fault()>handle_mm_fault()>pte_alloc()]
    2. 120  extern inline pte_t * pte_alloc(pmd_t * pmd, unsigned long address)
    3. 121  {
    4. 122 address = (address >> PAGE_SHIFT) & (PTRS_PER_PTE - 1);//给定地址转换为页表的下标,用于定位页表项
    5. 124 if (pmd_none(*pmd))//如果pmd所指向的页表为空,那就转到getnew分配
    6. 125 goto getnew;
    7. 126 if (pmd_bad(*pmd))
    8. 127 goto fix;
    9. 128 return (pte_t *)pmd_page(*pmd) + address;
    10. 129  getnew:
    11. 130  {
    12. 131 unsigned long page = (unsigned long) get_pte_fast();//从缓冲池获取(释放页表,并非一定会释放物理地址)
    13. 132
    14. 133 if (!page)
    15. 134 return get_pte_slow(pmd, address);
    16. 135 set_pmd(pmd, __pmd(_PAGE_TABLE + __pa(page)));//写入中间pmd
    17. 136 return (pte_t *)page + address;
    18. 137  }
    19. 138  fix:
    20. 139 __handle_bad_pmd(pmd);
    21. 140 return NULL;
    22. 141  }

    1. [do_page_fault()>handle_mm_fault()>handle_pte_fault()]
    2. 1135 /*
    3. 1136  * These routines also need to handle stuff like marking pages dirty
    4. 1137  * and/or accessed for architectures that don't do it in hardware (most
    5. 1138  * RISC architectures).  The early dirtying is also good on the i386.
    6. 1139  *
    7. 1140  * There is also a hook called "update_mmu_cache()" that architectures
    8. 1141  * with external mmu caches can use to update those (ie the Sparc or
    9. 1142  * PowerPC hashed page tables that act as extended TLBs).
    10. 1143  *
    11. 1144  * Note the "page_table_lock". It is to protect against kswapd removing
    12. 1147  * we can drop the lock early.
    13. 1148  *
    14. 1149  * The adding of pages is protected by the MM semaphore (which we hold),
    15. 1150  * so we don't need to worry about a page being suddenly been added into
    16. 1151  * our VM.
    17. 1152  */
    18. 1153 static inline int handle_pte_fault(struct mm_struct *mm,
    19. 1154 struct vm_area_struct * vma, unsigned long address,
    20. 1155 int write_access, pte_t * pte)
    21. 1156 {
    22. 1157 pte_t entry;
    23. 1158
    24. 1159 /*
    25. 1160  * We need the page table lock to synchronize with kswapd
    26. 1161  * and the SMP-safe atomic PTE updates.
    27. 1162  */
    28. 1163 spin_lock(&mm->page_table_lock);
    29. 1164 entry = *pte;//pte对应的物理地址当然没有,所以为null
    30. 1165 if (!pte_present(entry)) {//检查其对应的物理地址否为空
    31. 1166 /*
    32. 1167  * If it truly wasn't present, we know that kswapd
    33. 1168  * and the PTE updates will not touch it later. So
    34. 1169  * drop the lock.
    35. 1170  */
    36. 1171 spin_unlock(&mm->page_table_lock);
    37. 1172 if (pte_none(entry))//页表项内容为0，表明进程未访问过该页 
    38. 1173 return do_no_page(mm, vma, address, write_access, pte);//调用do_no_page分配
    39. //否则换出
    40. 1174 return do_swap_page(mm, vma, address, pte, pte_to_swp_entry(entry), write_access);
    41. 1175 }
    42. 1176
    43. 1177 if (write_access) {
    44. 1178 if (!pte_write(entry))
    45. 1179 return do_wp_page(mm, vma, address, pte, entry);
    46. 1180
    47. 1181 entry = pte_mkdirty(entry);
    48. 1182 }
    49. 1183 entry = pte_mkyoung(entry);
    50. 1184 establish_pte(vma, address, pte, entry);
    51. 1185 spin_unlock(&mm->page_table_lock);
    52. 1186 return 1;
    53. 1187 }
    54. 1145  * pages from under us. Note that kswapd only ever _removes_ pages, never
    55. 1146  * adds them. As such, once we have noticed that the page is not present

    1. [do_page_fault()>handle_mm_fault()>handle_pte_fault()>do_no_page()]
    2. 1080 /*
    3. 1081  * do_no_page() tries to create a new page mapping. It aggressively
    4. 1082  * tries to share with existing pages, but makes a separate copy if
    5. 1083  * the "write_access" parameter is true in order to avoid the next
    6. 1084  * page fault.
    7. 1085  *
    8. 1086  * As this is called only for pages that do not currently exist, we
    9. 1087  * do not need to flush old virtual caches or the TLB.
    10. 1088  *
    11. 1089  * This is called with the MM semaphore held.
    12. 1090  */
    13. 1091 static int do_no_page(struct mm_struct * mm, struct vm_area_struct * vma,
    14. 1092 unsigned long address, int write_access, pte_t *page_table)
    15. 1093 {
    16. 1094 struct page * new_page;
    17. 1095 pte_t entry;
    18. 1096
    19. 1097 if (!vma->vm_ops || !vma->vm_ops->nopage)
    20. 1098 return do_anonymous_page(mm, vma, page_table, write_access, address);//只是其封装而已
    21.     ......
    22. ==================== mm/memory.c 1133 1133 ====================
    23. 1133 }

    1. [do_page_fault()>handle_mm_fault()>handle_pte_fault()>do_no_page()>do_anonymous_page()]
    2. 1058 /*
    3. 1059  * This only needs the MM semaphore
    4. 1060  */
    5. 1061 static int do_anonymous_page(struct mm_struct * mm, struct vm_area_struct * vma, pte_t *page_table,
    6. int write_access, unsigned long addr)
    7. 1062 {
    8. 1063 struct page *page = NULL;
    9. //如果引起页面异常是一次读操作,那么由mk_pte构建的映射表项要通过pte_wrprotect修正,只读属性
    10. //同时对于只读的页面,一律映射ZERO_PAGE同一个物理内存页面,也即是内容全部为0,只有可写才独立分配内存
    11. 1064 pte_t entry = pte_wrprotect(mk_pte(ZERO_PAGE(addr), vma->vm_page_prot));
    12. 1065 if (write_access) {
    13. 1066 page = alloc_page(GFP_HIGHUSER);//分配独立物理页面
    14. 1067 if (!page)
    15. 1068 return -1;
    16. 1069 clear_user_highpage(page, addr);
    17. //下面相同.只可写属性
    18. 1070 entry = pte_mkwrite(pte_mkdirty(mk_pte(page, vma->vm_page_prot)));
    19. 1071 mm->rss++;
    20. 1072 flush_page_to_ram(page);
    21. 1073 }
    22. //虚拟页面到物理内存页面映射建立
    23. 1074 set_pte(page_table, entry);
    24. 1075 /* No need to invalidate - it was non-present before */
    25. 1076 update_mmu_cache(vma, addr, entry);
    26. 1077 return 1; /* Minor fault */
    27. 1078 }
  • 相关阅读:
    LInux-crontab
    Linux权限－chmod1
    Tool_BurpSuite安装和简单使用
    python与redis交互（四）
    Flask_环境部署（十六）
    Nginx_配置文件nginx.conf配置详解
    Tool_linux环境安装python3和pip
    Nginx_全局命令设置
    Linux_无法解析域名
    VMware_克隆机器后主机Ping不同虚拟机，虚拟机能Ping通主机
  • 原文地址：https://www.cnblogs.com/zengyiwen/p/a36f15f18826cb4ef269a23e561b6c16.html
Copyright © 2011-2022 走看看