| | 2824 | |
| | 2825 | === use pointer of DATA === |
| | 2826 | * s0711489@ubuntu-lucid64:~$ sudo insmod stackmod.ko entry=4 |
| | 2827 | * s0711489@ubuntu-lucid64:~$ sudo mknod /dev/stack c 251 0 |
| | 2828 | * s0711489@ubuntu-lucid64:~$ sudo chmod 666 /dev/stack |
| | 2829 | |
| | 2830 | * s0711489@ubuntu-lucid64:~$ cat /sys/module/stackmod/sections/.text |
| | 2831 | {{{ |
| | 2832 | 0xffffffffa0056000 |
| | 2833 | }}} |
| | 2834 | * s0711489@ubuntu-lucid64:~$ cat /sys/module/stackmod/sections/.data |
| | 2835 | {{{ |
| | 2836 | 0xffffffffa0056718 |
| | 2837 | }}} |
| | 2838 | * s0711489@ubuntu-lucid64:~$ cat /sys/module/stackmod/sections/.bss |
| | 2839 | {{{ |
| | 2840 | 0xffffffffa0056950 |
| | 2841 | }}} |
| | 2842 | |
| | 2843 | * gdb |
| | 2844 | {{{ |
| | 2845 | (gdb) file vmlinux |
| | 2846 | Reading symbols from /home/ugrad/07/s0711489/coursework/KernelHack/linux-2.6.35.14/x86_64/vmlinux...(no debugging symbols found)...done. |
| | 2847 | (gdb) add-symbol-file ../../04/stackmod/stackmod.o 0xffffffffa0056000 -s .data 0xffffffffa0056718 -s .bss 0xffffffffa0056950 |
| | 2848 | add symbol table from file "../../04/stackmod/stackmod.o" at |
| | 2849 | .text_addr = 0xffffffffa0056000 |
| | 2850 | .data_addr = 0xffffffffa0056718 |
| | 2851 | .bss_addr = 0xffffffffa0056950 |
| | 2852 | (y or n) y |
| | 2853 | Reading symbols from /home/ugrad/07/s0711489/coursework/KernelHack/04/stackmod/stackmod.o...done. |
| | 2854 | (gdb) target remote localhost:8864 |
| | 2855 | Remote debugging using localhost:8864 |
| | 2856 | 0xffffffff810097a9 in native_safe_halt () |
| | 2857 | at /home/ugrad/07/s0711489/coursework/KernelHack/linux-2.6.35.14/x86_64/arch/x86/include/asm/irqflags.h:49 |
| | 2858 | 49 asm volatile("sti; hlt": : :"memory"); |
| | 2859 | (gdb) b stackmod_read |
| | 2860 | Breakpoint 1 at 0xffffffffa00560b4: file /home/ugrad/07/s0711489/coursework/KernelHack/04/stackmod/stackmod.c, line 62. |
| | 2861 | (gdb) b stackmod_write |
| | 2862 | Breakpoint 2 at 0xffffffffa0056207: file /home/ugrad/07/s0711489/coursework/KernelHack/04/stackmod/stackmod.c, line 105. |
| | 2863 | (gdb) b stackmod_proc_read |
| | 2864 | Breakpoint 3 at 0xffffffffa00561ca: file /home/ugrad/07/s0711489/coursework/KernelHack/04/stackmod/stackmod.c, line 153. |
| | 2865 | (gdb) c |
| | 2866 | Continuing. |
| | 2867 | }}} |
| | 2868 | |
| | 2869 | * s0711489@ubuntu-lucid64:~$ cat /proc/stackmod |
| | 2870 | {{{ |
| | 2871 | stack: 0 |
| | 2872 | }}} |
| | 2873 | {{{ |
| | 2874 | Breakpoint 3, stackmod_proc_read (page=0xffff880019958000 "`\204\225\031", |
| | 2875 | start=0xffff88001ac77e90, off=0, count=3072, eof=0xffff88001ac77e9c, |
| | 2876 | data=0x0) |
| | 2877 | at /home/ugrad/07/s0711489/coursework/KernelHack/04/stackmod/stackmod.c:153 |
| | 2878 | 153 ) { |
| | 2879 | (gdb) p stack |
| | 2880 | $1 = {data = 0xffff88001aca6d40, depth = 0, errno = 0} |
| | 2881 | (gdb) p stack p |
| | 2882 | A syntax error in expression, near `p'. |
| | 2883 | (gdb) p p |
| | 2884 | No symbol "p" in current context. |
| | 2885 | (gdb) p stack.data |
| | 2886 | $2 = (DATA *) 0xffff88001aca6d40 |
| | 2887 | (gdb) p stack.data[0] |
| | 2888 | $3 = {length = 449474496, content = 0xffff88001aca6c88 "\210l\312\032"} |
| | 2889 | (gdb) p stack.data[1] |
| | 2890 | $4 = {length = 0, content = 0x0} |
| | 2891 | (gdb) p stack.data[2] |
| | 2892 | $5 = {length = 0, |
| | 2893 | content = 0x2e2e02020010e071 <Address 0x2e2e02020010e071 out of bounds>} |
| | 2894 | (gdb) p stack.data[3] |
| | 2895 | $6 = {length = 0, content = 0x0} |
| | 2896 | (gdb) p stack.data[4] |
| | 2897 | $7 = {length = 0, content = 0xffff88001dfc94b0 "h\n\235\037"} |
| | 2898 | (gdb) c |
| | 2899 | Continuing. |
| | 2900 | |
| | 2901 | Breakpoint 3, stackmod_proc_read (page=0xffff880019958000 "stack: 0\n", |
| | 2902 | start=0xffff88001ac77e90, off=9, count=3072, eof=0xffff88001ac77e9c, |
| | 2903 | data=0x0) |
| | 2904 | at /home/ugrad/07/s0711489/coursework/KernelHack/04/stackmod/stackmod.c:153 |
| | 2905 | 153 ) { |
| | 2906 | (gdb) p eof |
| | 2907 | $8 = (int *) 0xffff88001ac77e9c |
| | 2908 | (gdb) p *eof |
| | 2909 | $9 = 0 |
| | 2910 | (gdb) c |
| | 2911 | Continuing. |
| | 2912 | }}} |
| | 2913 | |
| | 2914 | * s0711489@ubuntu-lucid64:~$ echo depth0 > /dev/stack |
| | 2915 | {{{ |
| | 2916 | Breakpoint 2, stackmod_write (filep=0xffff88001b793900, |
| | 2917 | buf_user=0x2262c08 "depth0\ne -o filenames -F _insmod insmod\nalternatives\n\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337", <incomplete sequence \337>..., size=7, |
| | 2918 | offset=0xffff88001ac19f48) |
| | 2919 | at /home/ugrad/07/s0711489/coursework/KernelHack/04/stackmod/stackmod.c:105 |
| | 2920 | 105 ) { |
| | 2921 | (gdb) p p |
| | 2922 | $10 = <value optimized out> |
| | 2923 | (gdb) n |
| | 2924 | 108 printk(KERN_DEBUG MODNAME " is written\n"); |
| | 2925 | (gdb) |
| | 2926 | 105 ) { |
| | 2927 | (gdb) |
| | 2928 | 108 printk(KERN_DEBUG MODNAME " is written\n"); |
| | 2929 | (gdb) |
| | 2930 | 110 if (size == 0) { |
| | 2931 | (gdb) |
| | 2932 | 113 if (stack.depth >= entry) { |
| | 2933 | (gdb) |
| | 2934 | 117 if (buf_user == NULL) { |
| | 2935 | (gdb) |
| | 2936 | 121 p = stack.data + stack.depth; |
| | 2937 | (gdb) p stack |
| | 2938 | $11 = {data = 0xffff88001aca6d40, depth = 0, errno = 0} |
| | 2939 | (gdb) p stack.data |
| | 2940 | $12 = (DATA *) 0xffff88001aca6d40 |
| | 2941 | (gdb) p stack.data[0] |
| | 2942 | $13 = {length = 449474496, content = 0xffff88001aca6c88 "\210l\312\032"} |
| | 2943 | (gdb) p stack.data[1] |
| | 2944 | $14 = {length = 0, content = 0x0} |
| | 2945 | (gdb) n |
| | 2946 | 122 p->content = (char *) kmalloc(size * sizeof(char), GFP_KERNEL); |
| | 2947 | (gdb) |
| | 2948 | 121 p = stack.data + stack.depth; |
| | 2949 | (gdb) |
| | 2950 | 122 p->content = (char *) kmalloc(size * sizeof(char), GFP_KERNEL); |
| | 2951 | (gdb) p p |
| | 2952 | $15 = (DATA *) 0xffff88001aca6d40 |
| | 2953 | (gdb) ptype p |
| | 2954 | type = struct kernel_module_stack_data { |
| | 2955 | int length; |
| | 2956 | char *content; |
| | 2957 | } * |
| | 2958 | (gdb) p *p |
| | 2959 | $16 = {length = 449474496, content = 0xffff88001aca6c88 "\210l\312\032"} |
| | 2960 | (gdb) n |
| | 2961 | 123 if (p->content == NULL) { |
| | 2962 | (gdb) n |
| | 2963 | 122 p->content = (char *) kmalloc(size * sizeof(char), GFP_KERNEL); |
| | 2964 | (gdb) p *p |
| | 2965 | $17 = {length = 449474496, content = 0xffff88001aca6c88 "\210l\312\032"} |
| | 2966 | (gdb) n |
| | 2967 | 123 if (p->content == NULL) { |
| | 2968 | (gdb) |
| | 2969 | 127 p->length = size; |
| | 2970 | (gdb) p *p |
| | 2971 | $18 = {length = 449474496, content = 0xffff88001dfc94c8 "\030\225\374\035"} |
| | 2972 | (gdb) p size |
| | 2973 | $19 = 7 |
| | 2974 | (gdb) n |
| | 2975 | 129 if (copy_from_user(p->content, buf_user, size) != 0) { |
| | 2976 | (gdb) p *p |
| | 2977 | $20 = {length = 7, content = 0xffff88001dfc94c8 "\030\225\374\035"} |
| | 2978 | (gdb) n |
| | 2979 | 136 stack.depth++; |
| | 2980 | (gdb) p *p |
| | 2981 | $21 = {length = 7, content = 0xffff88001dfc94c8 "depth0\n\377holders"} |
| | 2982 | (gdb) p stack |
| | 2983 | $22 = {data = 0xffff88001aca6d40, depth = 0, errno = 0} |
| | 2984 | (gdb) n |
| | 2985 | 140 return size; |
| | 2986 | (gdb) p size |
| | 2987 | $23 = 0 |
| | 2988 | (gdb) n |
| | 2989 | 138 *offset += size; |
| | 2990 | (gdb) |
| | 2991 | 141 } |
| | 2992 | (gdb) p size |
| | 2993 | $24 = <value optimized out> |
| | 2994 | (gdb) n |
| | 2995 | vfs_write (file=0xffff88001b793900, |
| | 2996 | buf=0x2262c08 "depth0\ne -o filenames -F _insmod insmod\nalternatives\n\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337", <incomplete sequence \337>..., |
| | 2997 | count=<value optimized out>, pos=0xffff88001ac19f48) at fs/read_write.c:369 |
| | 2998 | 369 if (ret > 0) { |
| | 2999 | (gdb) finish |
| | 3000 | Run till exit from #0 vfs_write (file=0xffff88001b793900, |
| | 3001 | buf=0x2262c08 "depth0\ne -o filenames -F _insmod insmod\nalternatives\n\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337", <incomplete sequence \337>..., |
| | 3002 | count=<value optimized out>, pos=0xffff88001ac19f48) at fs/read_write.c:369 |
| | 3003 | 0xffffffff810df6b7 in sys_write (fd=<value optimized out>, |
| | 3004 | buf=0x2262c08 "depth0\ne -o filenames -F _insmod insmod\nalternatives\n\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337", <incomplete sequence \337>..., count=7) |
| | 3005 | at fs/read_write.c:418 |
| | 3006 | 418 ret = vfs_write(file, buf, count, &pos); |
| | 3007 | Could not fetch register "orig_rax"; remote failure reply 'E00' |
| | 3008 | (gdb) c |
| | 3009 | Continuing. |
| | 3010 | }}} |
| | 3011 | |
| | 3012 | * s0711489@ubuntu-lucid64:~$ echo depth1 > /dev/stack |
| | 3013 | {{{ |
| | 3014 | Breakpoint 2, stackmod_write (filep=0xffff88001b906480, |
| | 3015 | buf_user=0x2262c08 "depth1\ne -o filenames -F _insmod insmod\nalternatives\n\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337", <incomplete sequence \337>..., size=7, |
| | 3016 | offset=0xffff88001ac19f48) |
| | 3017 | at /home/ugrad/07/s0711489/coursework/KernelHack/04/stackmod/stackmod.c:105 |
| | 3018 | 105 ) { |
| | 3019 | (gdb) n |
| | 3020 | 108 printk(KERN_DEBUG MODNAME " is written\n"); |
| | 3021 | (gdb) |
| | 3022 | 105 ) { |
| | 3023 | (gdb) |
| | 3024 | 108 printk(KERN_DEBUG MODNAME " is written\n"); |
| | 3025 | (gdb) |
| | 3026 | 110 if (size == 0) { |
| | 3027 | (gdb) |
| | 3028 | 113 if (stack.depth >= entry) { |
| | 3029 | (gdb) |
| | 3030 | 117 if (buf_user == NULL) { |
| | 3031 | (gdb) |
| | 3032 | 121 p = stack.data + stack.depth; |
| | 3033 | (gdb) |
| | 3034 | 122 p->content = (char *) kmalloc(size * sizeof(char), GFP_KERNEL); |
| | 3035 | (gdb) |
| | 3036 | 121 p = stack.data + stack.depth; |
| | 3037 | (gdb) |
| | 3038 | 122 p->content = (char *) kmalloc(size * sizeof(char), GFP_KERNEL); |
| | 3039 | (gdb) |
| | 3040 | 123 if (p->content == NULL) { |
| | 3041 | (gdb) |
| | 3042 | 122 p->content = (char *) kmalloc(size * sizeof(char), GFP_KERNEL); |
| | 3043 | (gdb) |
| | 3044 | 123 if (p->content == NULL) { |
| | 3045 | (gdb) |
| | 3046 | 127 p->length = size; |
| | 3047 | (gdb) |
| | 3048 | 129 if (copy_from_user(p->content, buf_user, size) != 0) { |
| | 3049 | (gdb) p size |
| | 3050 | $25 = 7 |
| | 3051 | (gdb) p p |
| | 3052 | $26 = (DATA *) 0xffff88001aca6d50 |
| | 3053 | (gdb) p *p |
| | 3054 | $27 = {length = 7, content = 0xffff88001dfc9518 " \225\374\035"} |
| | 3055 | (gdb) p stack |
| | 3056 | $28 = {data = 0xffff88001aca6d40, depth = 1, errno = 0} |
| | 3057 | (gdb) s |
| | 3058 | copy_from_user (filep=<value optimized out>, |
| | 3059 | buf_user=0x2262c08 "depth1\ne -o filenames -F _insmod insmod\nalternatives\n\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337", <incomplete sequence \337>..., size=7, |
| | 3060 | offset=0xffff88001ac19f48) |
| | 3061 | at /home/ugrad/07/s0711489/coursework/KernelHack/linux-2.6.35.14/x86_64/arch/x86/include/asm/uaccess_64.h:53 |
| | 3062 | 53 might_fault(); |
| | 3063 | (gdb) finish |
| | 3064 | Run till exit from #0 copy_from_user (filep=<value optimized out>, |
| | 3065 | buf_user=0x2262c08 "depth1\ne -o filenames -F _insmod insmod\nalternatives\n\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337", <incomplete sequence \337>..., size=7, |
| | 3066 | offset=0xffff88001ac19f48) |
| | 3067 | at /home/ugrad/07/s0711489/coursework/KernelHack/linux-2.6.35.14/x86_64/arch/x86/include/asm/uaccess_64.h:53 |
| | 3068 | 129 if (copy_from_user(p->content, buf_user, size) != 0) { |
| | 3069 | (gdb) p size |
| | 3070 | $29 = 7 |
| | 3071 | (gdb) n |
| | 3072 | 136 stack.depth++; |
| | 3073 | (gdb) |
| | 3074 | 140 return size; |
| | 3075 | (gdb) p size |
| | 3076 | $30 = 0 |
| | 3077 | (gdb) n |
| | 3078 | 138 *offset += size; |
| | 3079 | (gdb) p *offset |
| | 3080 | $31 = 0 |
| | 3081 | (gdb) n |
| | 3082 | 141 } |
| | 3083 | (gdb) p *offset |
| | 3084 | $32 = 7 |
| | 3085 | (gdb) p size |
| | 3086 | $33 = <value optimized out> |
| | 3087 | (gdb) finish |
| | 3088 | Run till exit from #0 stackmod_write (filep=<value optimized out>, |
| | 3089 | buf_user=0x2262c08 "depth1\ne -o filenames -F _insmod insmod\nalternatives\n\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337", <incomplete sequence \337>..., |
| | 3090 | size=<value optimized out>, offset=0xffff88001ac19f48) |
| | 3091 | at /home/ugrad/07/s0711489/coursework/KernelHack/04/stackmod/stackmod.c:141 |
| | 3092 | 0xffffffff810df5a3 in vfs_write (file=0xffff88001b906480, |
| | 3093 | buf=0x2262c08 "depth1\ne -o filenames -F _insmod insmod\nalternatives\n\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337\337", <incomplete sequence \337>..., |
| | 3094 | count=<value optimized out>, pos=0xffff88001ac19f48) at fs/read_write.c:366 |
| | 3095 | 366 ret = file->f_op->write(file, buf, count, pos); |
| | 3096 | Could not fetch register "orig_rax"; remote failure reply 'E00' |
| | 3097 | (gdb) c |
| | 3098 | Continuing. |
| | 3099 | }}} |
| | 3100 | |
| | 3101 | * s0711489@ubuntu-lucid64:~$ cat /proc/stackmod |
| | 3102 | {{{ |
| | 3103 | stack: 2 |
| | 3104 | }}} |
| | 3105 | {{{ |
| | 3106 | Breakpoint 3, stackmod_proc_read (page=0xffff880019958000 "stack: 0\n", |
| | 3107 | start=0xffff88001b885e90, off=0, count=3072, eof=0xffff88001b885e9c, |
| | 3108 | data=0x0) |
| | 3109 | at /home/ugrad/07/s0711489/coursework/KernelHack/04/stackmod/stackmod.c:153 |
| | 3110 | 153 ) { |
| | 3111 | (gdb) p stack |
| | 3112 | $34 = {data = 0xffff88001aca6d40, depth = 2, errno = 0} |
| | 3113 | (gdb) p stack.data |
| | 3114 | $35 = (DATA *) 0xffff88001aca6d40 |
| | 3115 | (gdb) p stack.data[0] |
| | 3116 | $36 = {length = 7, content = 0xffff88001dfc94c8 "depth0\n\377holders"} |
| | 3117 | (gdb) p stack.data[1] |
| | 3118 | $37 = {length = 7, content = 0xffff88001dfc9518 "depth1\n\377(\225\374\035"} |
| | 3119 | (gdb) p stack.data[2] |
| | 3120 | $38 = {length = 0, |
| | 3121 | content = 0x2e2e02020010e071 <Address 0x2e2e02020010e071 out of bounds>} |
| | 3122 | (gdb) p stack.data[3] |
| | 3123 | $39 = {length = 0, content = 0x0} |
| | 3124 | (gdb) p stack.data[4] |
| | 3125 | $40 = {length = 0, content = 0xffff88001dfc94b0 "h\n\235\037"} |
| | 3126 | (gdb) p stack.data[5] |
| | 3127 | $41 = {length = 1, content = 0x0} |
| | 3128 | (gdb) n |
| | 3129 | 156 outlen = sprintf(page, "stack: %d\n", stack.depth); |
| | 3130 | (gdb) |
| | 3131 | 153 ) { |
| | 3132 | (gdb) |
| | 3133 | 156 outlen = sprintf(page, "stack: %d\n", stack.depth); |
| | 3134 | (gdb) p outlen |
| | 3135 | $42 = <value optimized out> |
| | 3136 | (gdb) n |
| | 3137 | 157 *eof = 1; |
| | 3138 | (gdb) p outlen |
| | 3139 | $43 = <value optimized out> |
| | 3140 | (gdb) n |
| | 3141 | 156 outlen = sprintf(page, "stack: %d\n", stack.depth); |
| | 3142 | (gdb) |
| | 3143 | 159 printk(KERN_DEBUG "/proc/" PROCNAME " is read\n"); |
| | 3144 | (gdb) p outlen |
| | 3145 | $44 = <value optimized out> |
| | 3146 | (gdb) n |
| | 3147 | 162 } |
| | 3148 | (gdb) p outlen |
| | 3149 | $45 = <value optimized out> |
| | 3150 | (gdb) finish |
| | 3151 | Run till exit from #0 stackmod_proc_read (page=<value optimized out>, |
| | 3152 | start=<value optimized out>, off=<value optimized out>, |
| | 3153 | count=<value optimized out>, eof=0xffff88001b885e9c, |
| | 3154 | data=<value optimized out>) |
| | 3155 | at /home/ugrad/07/s0711489/coursework/KernelHack/04/stackmod/stackmod.c:162 |
| | 3156 | __proc_file_read (file=<value optimized out>, |
| | 3157 | buf=0xfb6000 <Address 0xfb6000 out of bounds>, nbytes=32768, |
| | 3158 | ppos=0xffff88001b885f48) at fs/proc/generic.c:125 |
| | 3159 | 125 if (n == 0) /* end of file */ |
| | 3160 | Could not fetch register "orig_rax"; remote failure reply 'E00' |
| | 3161 | (gdb) c |
| | 3162 | Continuing. |
| | 3163 | |
| | 3164 | Breakpoint 3, stackmod_proc_read (page=0xffff880019958000 "stack: 2\n", |
| | 3165 | start=0xffff88001b885e90, off=9, count=3072, eof=0xffff88001b885e9c, |
| | 3166 | data=0x0) |
| | 3167 | at /home/ugrad/07/s0711489/coursework/KernelHack/04/stackmod/stackmod.c:153 |
| | 3168 | 153 ) { |
| | 3169 | (gdb) c |
| | 3170 | Continuing. |
| | 3171 | }}} |
| | 3172 | |
| | 3173 | |
| | 3174 | * s0711489@ubuntu-lucid64:~$ cat /dev/stack |
| | 3175 | {{{ |
| | 3176 | depth1 |
| | 3177 | depth0 |
| | 3178 | }}} |
| | 3179 | {{{ |
| | 3180 | Breakpoint 1, stackmod_read (filep=0xffff88001b591180, |
| | 3181 | buf_user=0xcec000 <Address 0xcec000 out of bounds>, size=32768, |
| | 3182 | offset=0xffff88001ba91f48) |
| | 3183 | at /home/ugrad/07/s0711489/coursework/KernelHack/04/stackmod/stackmod.c:62 |
| | 3184 | 62 ) { |
| | 3185 | (gdb) p stack |
| | 3186 | $46 = {data = 0xffff88001aca6d40, depth = 2, errno = 0} |
| | 3187 | (gdb) n |
| | 3188 | 66 printk(KERN_DEBUG MODNAME " is read\n"); |
| | 3189 | (gdb) |
| | 3190 | 62 ) { |
| | 3191 | (gdb) |
| | 3192 | 66 printk(KERN_DEBUG MODNAME " is read\n"); |
| | 3193 | (gdb) |
| | 3194 | 68 if (size == 0) { |
| | 3195 | (gdb) |
| | 3196 | 71 if (stack.depth == 0) { |
| | 3197 | (gdb) |
| | 3198 | 75 if (buf_user == NULL) { |
| | 3199 | (gdb) |
| | 3200 | 78 if (! access_ok(VERIFY_WRITE, buf_user, size) ) { |
| | 3201 | (gdb) |
| | 3202 | 82 stack.depth--; |
| | 3203 | (gdb) |
| | 3204 | 83 p = stack.data + stack.depth; |
| | 3205 | (gdb) |
| | 3206 | 82 stack.depth--; |
| | 3207 | (gdb) |
| | 3208 | 83 p = stack.data + stack.depth; |
| | 3209 | (gdb) |
| | 3210 | 85 len = p->length; |
| | 3211 | (gdb) p p |
| | 3212 | $47 = (DATA *) 0xffff88001aca6d50 |
| | 3213 | (gdb) p stack.data |
| | 3214 | $48 = (DATA *) 0xffff88001aca6d40 |
| | 3215 | (gdb) p stack.data[0] |
| | 3216 | $49 = {length = 7, content = 0xffff88001dfc94c8 "depth0\n\377holders"} |
| | 3217 | (gdb) p stack.data[1] |
| | 3218 | $50 = {length = 7, content = 0xffff88001dfc9518 "depth1\n\377(\225\374\035"} |
| | 3219 | (gdb) n |
| | 3220 | 86 if (size < len) { |
| | 3221 | (gdb) p len |
| | 3222 | $51 = 7 |
| | 3223 | (gdb) n |
| | 3224 | 87 len = size; |
| | 3225 | (gdb) |
| | 3226 | 89 if (len > 0 && copy_to_user(buf_user, p->content, len) != 0) { |
| | 3227 | (gdb) p len |
| | 3228 | $52 = 7 |
| | 3229 | (gdb) n |
| | 3230 | 94 kfree(p->content); |
| | 3231 | (gdb) p p |
| | 3232 | $53 = (DATA *) 0xffff88001aca6d50 |
| | 3233 | (gdb) p *p |
| | 3234 | $54 = {length = 7, content = 0xffff88001dfc9518 "depth1\n\377(\225\374\035"} |
| | 3235 | (gdb) n |
| | 3236 | 98 *offset += len; |
| | 3237 | (gdb) p *p |
| | 3238 | $55 = {length = 7, content = 0xffff88001dfc9518 " \225\374\035"} |
| | 3239 | (gdb) n |
| | 3240 | 95 p->content = NULL; |
| | 3241 | (gdb) |
| | 3242 | 96 p->length = 0; |
| | 3243 | (gdb) |
| | 3244 | 98 *offset += len; |
| | 3245 | (gdb) p len |
| | 3246 | $56 = 7 |
| | 3247 | (gdb) p *p |
| | 3248 | $57 = {length = 0, content = 0x0} |
| | 3249 | (gdb) n |
| | 3250 | 100 return len; |
| | 3251 | (gdb) |
| | 3252 | 101 } |
| | 3253 | (gdb) c |
| | 3254 | Continuing. |
| | 3255 | |
| | 3256 | Breakpoint 1, stackmod_read (filep=0xffff88001b591180, |
| | 3257 | buf_user=0xcec000 "depth1\n", size=32768, offset=0xffff88001ba91f48) |
| | 3258 | at /home/ugrad/07/s0711489/coursework/KernelHack/04/stackmod/stackmod.c:62 |
| | 3259 | 62 ) { |
| | 3260 | (gdb) n |
| | 3261 | 66 printk(KERN_DEBUG MODNAME " is read\n"); |
| | 3262 | (gdb) |
| | 3263 | 62 ) { |
| | 3264 | (gdb) |
| | 3265 | 66 printk(KERN_DEBUG MODNAME " is read\n"); |
| | 3266 | (gdb) |
| | 3267 | 68 if (size == 0) { |
| | 3268 | (gdb) |
| | 3269 | 71 if (stack.depth == 0) { |
| | 3270 | (gdb) p stack |
| | 3271 | $58 = {data = 0xffff88001aca6d40, depth = 1, errno = 0} |
| | 3272 | (gdb) n |
| | 3273 | 75 if (buf_user == NULL) { |
| | 3274 | (gdb) |
| | 3275 | 78 if (! access_ok(VERIFY_WRITE, buf_user, size) ) { |
| | 3276 | (gdb) |
| | 3277 | 82 stack.depth--; |
| | 3278 | (gdb) |
| | 3279 | 83 p = stack.data + stack.depth; |
| | 3280 | (gdb) |
| | 3281 | 82 stack.depth--; |
| | 3282 | (gdb) |
| | 3283 | 83 p = stack.data + stack.depth; |
| | 3284 | (gdb) |
| | 3285 | 85 len = p->length; |
| | 3286 | (gdb) p *p |
| | 3287 | $59 = {length = 7, content = 0xffff88001dfc94c8 "depth0\n\377holders"} |
| | 3288 | (gdb) n |
| | 3289 | 86 if (size < len) { |
| | 3290 | (gdb) |
| | 3291 | 87 len = size; |
| | 3292 | (gdb) |
| | 3293 | 89 if (len > 0 && copy_to_user(buf_user, p->content, len) != 0) { |
| | 3294 | (gdb) p len |
| | 3295 | $60 = 7 |
| | 3296 | (gdb) n |
| | 3297 | 94 kfree(p->content); |
| | 3298 | (gdb) n |
| | 3299 | 98 *offset += len; |
| | 3300 | (gdb) |
| | 3301 | 95 p->content = NULL; |
| | 3302 | (gdb) |
| | 3303 | 96 p->length = 0; |
| | 3304 | (gdb) |
| | 3305 | 98 *offset += len; |
| | 3306 | (gdb) p *p |
| | 3307 | $61 = {length = 0, content = 0x0} |
| | 3308 | (gdb) n |
| | 3309 | 100 return len; |
| | 3310 | (gdb) p buf_user |
| | 3311 | $62 = 0xcec000 "depth0\n" |
| | 3312 | (gdb) n |
| | 3313 | 101 } |
| | 3314 | (gdb) c |
| | 3315 | Continuing. |
| | 3316 | |
| | 3317 | Breakpoint 1, stackmod_read (filep=0xffff88001b591180, |
| | 3318 | buf_user=0xcec000 "depth0\n", size=32768, offset=0xffff88001ba91f48) |
| | 3319 | at /home/ugrad/07/s0711489/coursework/KernelHack/04/stackmod/stackmod.c:62 |
| | 3320 | 62 ) { |
| | 3321 | (gdb) n |
| | 3322 | 66 printk(KERN_DEBUG MODNAME " is read\n"); |
| | 3323 | (gdb) |
| | 3324 | 62 ) { |
| | 3325 | (gdb) |
| | 3326 | 66 printk(KERN_DEBUG MODNAME " is read\n"); |
| | 3327 | (gdb) |
| | 3328 | 68 if (size == 0) { |
| | 3329 | (gdb) p stack |
| | 3330 | $63 = {data = 0xffff88001aca6d40, depth = 0, errno = 0} |
| | 3331 | (gdb) p stack.data[0] |
| | 3332 | $64 = {length = 0, content = 0x0} |
| | 3333 | (gdb) n |
| | 3334 | 71 if (stack.depth == 0) { |
| | 3335 | (gdb) |
| | 3336 | 101 } |
| | 3337 | (gdb) c |
| | 3338 | Continuing. |
| | 3339 | }}} |