1

I am trying to set the instruction point (regs->ip) to a return address of a function in a loadable kernel module (for Linux 3.13). However, it throws stack smashing detection. My question is how to get around it.

More specifically, before setting instruction point in the kernel module, the stack of user land process looks like the following:

+--------+
|  foo   |
+--------+
|  bar   |
+--------+
| bottom |
+--------+

the kernel module sets ip (instruction point) to the return address of bar, which apparrently is stack overflow...

So I am thinking if I can simulate the return of foo in the kernel module, and thus setting ip would not cause smashing detected error.

First, is this speculation correct? that is, by simulating return of foo in kernel space allows me to return to bar without smashing detected?

Second, if it is correct, how to implement it in kernel space?

Updates: An interesting (or undefined) behavior to mention: the bar function looks like:

foo(){
    call_into_kernel_module();
    printf("end of foo()");
}

bar(){
    ...
    char a[4];
    ...
    foo();
    printf("end of bar()");
}

a is never filled with any data, or referenced afterwards. If I remove the declaration, smashing will be gone. Otherwise, it stays. (Btw, I can see end of bar() in the printout ).

Richard
  • 14,642
  • 18
  • 56
  • 77
  • It is unclear why stack overflow and stack smashing are occured? How you invoke your kernel code, where you change the ip? How stack overflow is related to stack smashing? Stack smashing could be caused by stack canary corrupting, while stack overflow caused by a lack of the space for the uspace stack. Give the full picture, please. – Alex Hoppus Jun 06 '15 at 20:55
  • what is difference between stack overflow and stack smashing...? to me, they are the same thing. – Richard Jun 07 '15 at 16:36
  • 1
    How are you detecting what needs to be done to unwind the stack? There's more to it than just changing the return address. There are frame pointers, saved registers, etc. All that needs to be properly coordinated. – Gil Hamilton Jun 08 '15 at 10:45

0 Answers0