Linux内核情景分析之异常访问,用户堆栈的扩展

情景假设：

在堆内存中申请了一块内存，然后释放掉该内存，然后再去访问这块内存。也就是所说的野指针访问。

当cpu产生页面错误时,会把失败的线性地址放在cr2寄存器.线性地址缺页异常的4种情况

1.如果cpu访问的行现地址在内核态,那么很可能访问的是非连续区,需要vmalloc_fault处理.

2.缺页异常发生在中断或者内核线程时,直接失败,因为不可修改页表

3.地址在一个区间内,那就可能是已经物理地址映射了但权限问题(错误处理)或者其物理地址没有分配(分配物理内存)

4.如果找到一个在线性地址其后面的vma(线性地址在空洞).那么可能是空洞上面的区间是

堆栈区,他表示动态分配而没有分配出去的空间,有一种特殊情况,可以缺页异常使得获取物理页框

5.如果找到一个线性地址气候的vma(线性地址在空洞),那么可能是空洞上面的区间不是堆栈区,说明

这个空洞是由于一个映射区被撤销而留下的,那样直接错误处理

1. ==================== arch/i386/mm/fault.c 106 152 ====================
2. 106 asmlinkage void do_page_fault(struct pt_regs *regs, unsigned long error_code)
3. 107 {
4. 108 struct task_struct *tsk;
5. 109 struct mm_struct *mm;
6. 110 struct vm_area_struct * vma;
7. 111 unsigned long address;
8. 112 unsigned long page;
9. 113 unsigned long fixup;
10. 114 int write;
11. 115 siginfo_t info;
12. 116
13. 117 /* get the address */
14. 118 __asm__("movl %%cr2,%0":"=r" (address));//得到失败的线性地址
15. 119
16. 120 tsk = current;//获取当前描述符
17. 121
18. 122 /*
19. 123 * We fault-in kernel-space virtual memory on-demand. The
20. 124 * 'reference' page table is init_mm.pgd.
21. 125 *
22. 126 * NOTE! We MUST NOT take any locks for this case. We may
23. 127 * be in an interrupt or a critical region, and should
24. 128 * only copy the information from the master page table,
25. 129 * nothing more.
26. 130 */
27. //如果大于3G,表示缺页异常时,访问的是内核空间,很有可能是访问了非连续的内核空间,转到vmalloc_fault处理

28. 131 if (address >= TASK_SIZE)
29. 132 goto vmalloc_fault;
30. 133
31. 134 mm = tsk->mm;
32. 135 info.si_code = SEGV_MAPERR;
33. 136
34. 137 /*
35. 138 缺页异常发生在中断时,是错误不可以的,表示是内核线程,不可以对其页表进行修改
36. 140 */
37. 141 if (in_interrupt() || !mm)
38. 142 goto no_context;
39. 143
40. 144 down(&mm->mmap_sem);
41. 145
42. 146 vma = find_vma(mm, address);//查到end大于address的地址
43. 147 if (!vma)//是否在行现地址内,不在转为错误处理
44. 148 goto bad_area;
45. //在线性区内，跳到正常处理部分,可能是由于权限问题,也有可能是对应的物理地址没有分配2种情况
46. 149 if (vma->vm_start <= address)
47. 150 goto good_area;
48. 151 if (!(vma->vm_flags & VM_GROWSDOWN))//如果发生在一空洞上方的区间不是堆栈区,那么此地址是由于撤销映射留下的,进行错误处理
49. 152 goto bad_area;

1. 220 /*
2. 221 * Something tried to access memory that isn't in our memory map..
3. 222 * Fix it, but check if it's kernel or user first..
4. 223 */
5. 224 bad_area:
6. 225 up(&mm->mmap_sem);
7. 226 //用户态的错误处理
8. 227 bad_area_nosemaphore:
9. 228 /* User mode accesses just cause a SIGSEGV */
10. 229 if (error_code & 4) {//判断错误发生在用户态
11. 230 tsk->thread.cr2 = address;
12. 231 tsk->thread.error_code = error_code;
13. 232 tsk->thread.trap_no = 14;
14. 233 info.si_signo = SIGSEGV;//强制发送SIGEGV信号

上面提到的第4种情况,因为越界访问而照成堆栈区间扩展的情况

比如一进城要调用某个子程序,cpu需要把返回地址压栈,然而返回地址写入的是空洞地址,会引发一次页面异常错误

VM_GROWDOWN表示为1表示上面是堆栈区

1. if (!(vma->vm_flags & VM_GROWSDOWN))
2. 152 goto bad_area;
3. 153 if (error_code & 4) {
4. 154 /*
5. 155 * 还要检查异常地址是否紧挨着esp指针,如果远超过32,那就是非法越界,错误处理
6. 32是因为pusha(一次把32个字节压入栈中)
7. 159 */
8. 160 if (address + 32 < regs->esp)
9. 161 goto bad_area;
10. 162 }
11. //扩展堆栈
12. 163 if (expand_stack(vma, address))
13. 164 goto bad_area;

有下面注释可知,expand_stack只是更改了堆栈区的vm_area_struct结构,没有建立物理内存映射

1. static inline int expand_stack(struct vm_area_struct * vma, unsigned long address)
2. 490 {
3. 491 unsigned long grow;
4. 492
5. 493 address &= PAGE_MASK;//边界对齐
6. 494 grow = (vma->vm_start - address) >> PAGE_SHIFT;//增长几个页框
7. //判断是否超过了用户堆栈空间大小限制
8. 495 if (vma->vm_end - address > current->rlim[RLIMIT_STACK].rlim_cur ||
9. 496 ((vma->vm_mm->total_vm + grow) << PAGE_SHIFT) > current->rlim[RLIMIT_AS].rlim_cur)
10. 497 return -ENOMEM;
11. 498 vma->vm_start = address;//重新设置虚拟地址
12. 499 vma->vm_pgoff -= grow;//偏移减去grow
13. 500 vma->vm_mm->total_vm += grow;//地址空间大小
14. 501 if (vma->vm_flags & VM_LOCKED)
15. 502 vma->vm_mm->locked_vm += grow;
16. 503 return 0;
17. 504 }

1. [do_page_fault()]
2. 165 /*
3. 166 * Ok, we have a good vm_area for this memory access, so
4. 167 * we can handle it..
5. 168 */
6. 169 good_area:
7. 170 info.si_code = SEGV_ACCERR;
8. 171 write = 0;
9. 172 switch (error_code & 3) {
10. 173 default: /* 3: write, present */
11. 174 #ifdef TEST_VERIFY_AREA
12. 175 if (regs->cs == KERNEL_CS)
13. 176 printk("WP fault at %08lx\n", regs->eip);
14. 177 #endif
15. 178 /* fall through */
16. 179 case 2: /* write, not present */
17. 180 if (!(vma->vm_flags & VM_WRITE))//堆栈段可读可写,调到196行
18. 181 goto bad_area;
19. 182 write++;
20. 183 break;
21. 184 case 1: /* read, present */
22. 

23. 185 goto bad_area;
24. 186 case 0: /* read, not present */
25. 187 if (!(vma->vm_flags & (VM_READ | VM_EXEC)))
26. 188 goto bad_area;
27. 189 }
28. 190
29. 191 /*
30. 192 * If for any reason at all we couldn't handle the fault,
31. 193 * make sure we exit gracefully rather than endlessly redo
32. 194 * the fault.
33. 195 */
34. 196 switch (handle_mm_fault(mm, vma, address, write)) {
35. 197 case 1:
36. 198 tsk->min_flt++;
37. 199 break;
38. 200 case 2:
39. 201 tsk->maj_flt++;
40. 202 break;
41. 203 case 0:
42. 204 goto do_sigbus;
43. 205 default:
44. 206 goto out_of_memory;
45. 207 }

1. [do_page_fault()>handle_mm_fault()]
2. 1189 /*
3. 1190 * By the time we get here, we already hold the mm semaphore
4. 1191 */
5. 1192 int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct * vma,
6. 1193 unsigned long address, int write_access)
7. 1194 {
8. 1195 int ret = -1;
9. 1196 pgd_t *pgd;
10. 1197 pmd_t *pmd;
11. 1198
12. 1199 pgd = pgd_offset(mm, address);//获取该地址所在页面目录项的指针(页表的地址)
13. 1200 pmd = pmd_alloc(pgd, address);//分配pmd目录
14. 1201
15. 1202 if (pmd) {
16. 1203 pte_t * pte = pte_alloc(pmd, address);//分配pte表现
17. 1204 if (pte)
18. //分配物理地址
19. 1205 ret = handle_pte_fault(mm, vma, address, write_access, pte);
20. 1206 }
21. 1207 return ret;
22. 1208 }

1. [do_page_fault()>handle_mm_fault()>pte_alloc()]
2. 120 extern inline pte_t * pte_alloc(pmd_t * pmd, unsigned long address)
3. 121 {
4. 122 address = (address >> PAGE_SHIFT) & (PTRS_PER_PTE - 1);//给定地址转换为页表的下标,用于定位页表项
5. 124 if (pmd_none(*pmd))//如果pmd所指向的页表为空,那就转到getnew分配
6. 125 goto getnew;
7. 126 if (pmd_bad(*pmd))
8. 127 goto fix;
9. 128 return (pte_t *)pmd_page(*pmd) + address;
10. 129 getnew:
11. 130 {
12. 131 unsigned long page = (unsigned long) get_pte_fast();//从缓冲池获取(释放页表,并非一定会释放物理地址)
13. 132
14. 133 if (!page)
15. 134 return get_pte_slow(pmd, address);
16. 135 set_pmd(pmd, __pmd(_PAGE_TABLE + __pa(page)));//写入中间pmd
17. 136 return (pte_t *)page + address;
18. 137 }
19. 138 fix:
20. 139 __handle_bad_pmd(pmd);
21. 140 return NULL;
22. 141 }

1. [do_page_fault()>handle_mm_fault()>handle_pte_fault()]
2. 1135 /*
3. 1136 * These routines also need to handle stuff like marking pages dirty
4. 1137 * and/or accessed for architectures that don't do it in hardware (most
5. 1138 * RISC architectures). The early dirtying is also good on the i386.
6. 1139 *
7. 1140 * There is also a hook called "update_mmu_cache()" that architectures
8. 1141 * with external mmu caches can use to update those (ie the Sparc or
9. 1142 * PowerPC hashed page tables that act as extended TLBs).
10. 1143 *
11. 1144 * Note the "page_table_lock". It is to protect against kswapd removing
12. 1147 * we can drop the lock early.
13. 1148 *
14. 1149 * The adding of pages is protected by the MM semaphore (which we hold),
15. 1150 * so we don't need to worry about a page being suddenly been added into
16. 1151 * our VM.
17. 1152 */
18. 1153 static inline int handle_pte_fault(struct mm_struct *mm,
19. 1154 struct vm_area_struct * vma, unsigned long address,
20. 1155 int write_access, pte_t * pte)
21. 1156 {
22. 1157 pte_t entry;
23. 1158
24. 1159 /*
25. 1160 * We need the page table lock to synchronize with kswapd
26. 1161 * and the SMP-safe atomic PTE updates.
27. 1162 */
28. 1163 spin_lock(&mm->page_table_lock);
29. 1164 entry = *pte;//pte对应的物理地址当然没有,所以为null
30. 1165 if (!pte_present(entry)) {//检查其对应的物理地址否为空
31. 1166 /*
32. 1167 * If it truly wasn't present, we know that kswapd
33. 1168 * and the PTE updates will not touch it later. So
34. 1169 * drop the lock.
35. 1170 */
36. 1171 spin_unlock(&mm->page_table_lock);
37. 1172 if (pte_none(entry))//页表项内容为0，表明进程未访问过该页 
38. 1173 return do_no_page(mm, vma, address, write_access, pte);//调用do_no_page分配
39. //否则换出
40. 1174 return do_swap_page(mm, vma, address, pte, pte_to_swp_entry(entry), write_access);
41. 1175 }
42. 1176
43. 1177 if (write_access) {
44. 1178 if (!pte_write(entry))
45. 1179 return do_wp_page(mm, vma, address, pte, entry);
46. 1180
47. 1181 entry = pte_mkdirty(entry);
48. 1182 }
49. 1183 entry = pte_mkyoung(entry);
50. 1184 establish_pte(vma, address, pte, entry);
51. 1185 spin_unlock(&mm->page_table_lock);
52. 1186 return 1;
53. 1187 }
54. 1145 * pages from under us. Note that kswapd only ever _removes_ pages, never
55. 1146 * adds them. As such, once we have noticed that the page is not present

1. [do_page_fault()>handle_mm_fault()>handle_pte_fault()>do_no_page()]
2. 1080 /*
3. 1081 * do_no_page() tries to create a new page mapping. It aggressively
4. 1082 * tries to share with existing pages, but makes a separate copy if
5. 1083 * the "write_access" parameter is true in order to avoid the next
6. 1084 * page fault.
7. 1085 *
8. 1086 * As this is called only for pages that do not currently exist, we
9. 1087 * do not need to flush old virtual caches or the TLB.
10. 1088 *
11. 1089 * This is called with the MM semaphore held.
12. 1090 */
13. 1091 static int do_no_page(struct mm_struct * mm, struct vm_area_struct * vma,
14. 1092 unsigned long address, int write_access, pte_t *page_table)
15. 1093 {
16. 1094 struct page * new_page;
17. 1095 pte_t entry;
18. 1096
19. 1097 if (!vma->vm_ops || !vma->vm_ops->nopage)
20. 1098 return do_anonymous_page(mm, vma, page_table, write_access, address);//只是其封装而已
21. ......
22. ==================== mm/memory.c 1133 1133 ====================
23. 1133 }

1. [do_page_fault()>handle_mm_fault()>handle_pte_fault()>do_no_page()>do_anonymous_page()]
2. 1058 /*
3. 1059 * This only needs the MM semaphore
4. 1060 */
5. 1061 static int do_anonymous_page(struct mm_struct * mm, struct vm_area_struct * vma, pte_t *page_table,
6. int write_access, unsigned long addr)
7. 1062 {
8. 1063 struct page *page = NULL;
9. //如果引起页面异常是一次读操作,那么由mk_pte构建的映射表项要通过pte_wrprotect修正,只读属性
10. //同时对于只读的页面,一律映射ZERO_PAGE同一个物理内存页面,也即是内容全部为0,只有可写才独立分配内存
11. 1064 pte_t entry = pte_wrprotect(mk_pte(ZERO_PAGE(addr), vma->vm_page_prot));
12. 1065 if (write_access) {
13. 1066 page = alloc_page(GFP_HIGHUSER);//分配独立物理页面
14. 1067 if (!page)
15. 1068 return -1;
16. 1069 clear_user_highpage(page, addr);
17. //下面相同.只可写属性
18. 1070 entry = pte_mkwrite(pte_mkdirty(mk_pte(page, vma->vm_page_prot)));
19. 1071 mm->rss++;
20. 1072 flush_page_to_ram(page);
21. 1073 }
22. //虚拟页面到物理内存页面映射建立
23. 1074 set_pte(page_table, entry);
24. 1075 /* No need to invalidate - it was non-present before */
25. 1076 update_mmu_cache(vma, addr, entry);
26. 1077 return 1; /* Minor fault */
27. 1078 }

来自为知笔记(Wiz)