【问题标题】:Why the thread_info structure in linux(x86_64) is stuffed by 0?为什么linux(x86_64)中的thread_info结构被0填充?
【发布时间】:2016-06-09 10:27:10
【问题描述】:

我在用vmware的debugstub调试linux内核进程的时候,发现了一个很奇怪的情况。 我在 sys_execve 中设置了一个断点并打开了 chrome,它确实中断了,但我发现 thread_info 结构总是被 0 填充。

Breakpoint 1, SyS_execve (filename=139842677234776, argv=139842677234848, envp=139843191453696)
at /build/linux-lts-utopic-V0z0lI/linux-lts-utopic-3.16.0/fs/exec.c:1630
1630    in /build/linux-lts-utopic-V0z0lI/linux-lts-utopic-3.16.0/fs/exec.c
(gdb) set $hehe = (struct thread_info *)(((long)$rsp & 0xffffffffffffe000))
(gdb) print *$hehe
$21 = {
  task = 0x0 <irq_stack_union>,
  exec_domain = 0x0 <irq_stack_union>,
  flags = 0,
  status = 0,
  cpu = 0,
  saved_preempt_count = 0,
  addr_limit = {
    seg = 0
  },
  restart_block = {
fn = 0x0 <irq_stack_union>,
{
  futex = {
    uaddr = 0x0 <irq_stack_union>,
    val = 0,
    flags = 0,
    bitset = 0,
    time = 0,
    uaddr2 = 0x0 <irq_stack_union>
  },
  nanosleep = {
    clockid = 0,
    rmtp = 0x0 <irq_stack_union>,
    compat_rmtp = 0x0 <irq_stack_union>,
    expires = 0
  },
  poll = {
    ufds = 0x0 <irq_stack_union>,
    nfds = 0,
    has_timeout = 0,
    tv_sec = 0,
    tv_nsec = 0
  }
}
  },
  sysenter_return = 0x0 <irq_stack_union>,
  sig_on_uaccess_error = 0,
  uaccess_err = 0
}

然后我在 32 位 ubuntu 14.04 中尝试了相同的操作,一切正常。

(gdb) set $hehe = (struct thread_info *)((long)$esp & 0xffffe000)
(gdb) print *$hehe
$1 = {task = 0xc1980a40 <init_task>, exec_domain = 0xc198ef80 <default_exec_domain>, flags = 0, status = 0, cpu = 0, saved_preempt_count = -2147483648,
  addr_limit = {seg = 4294967295}, restart_block = {fn = 0xc106d520 <do_no_restart_syscall>, {futex = {uaddr = 0x0, val = 0, flags = 0, bitset = 0, time = 0,
    uaddr2 = 0x0}, nanosleep = {clockid = 0, rmtp = 0x0, expires = 0}, poll = {ufds = 0x0, nfds = 0, has_timeout = 0, tv_sec = 0, tv_nsec = 0}}},
  sysenter_return = 0x0, sig_on_uaccess_error = 0, uaccess_err = 0}

我想知道是什么导致了这些事情发生。 默认的PAGE_SIZE不是4KB吗?或者线程堆栈不是 THREAD_SIZE (2*PAGE_SIZE) 大?

【问题讨论】:

    标签: linux process kernel


    【解决方案1】:

    现在堆栈为 16KB 已经有一段时间了。我不明白你为什么要玩猜谜游戏,也不明白你为什么要寻找 thread_info。如果您尝试获取 task_struct,您可以通过 %gs 获取它。

    【讨论】:

    • 我尝试编写一个针对内核漏洞的利用。所以我需要通过我泄露的堆栈地址找到thread_info。如果我将大小更改为 16KB 会很有用,非常感谢您完美地解决了我的问题。
    猜你喜欢
    • 1970-01-01
    • 2021-05-18
    • 2020-03-05
    • 1970-01-01
    • 2020-11-27
    • 2015-09-24
    • 1970-01-01
    • 1970-01-01
    • 2017-01-21
    相关资源
    最近更新 更多