CODEWITHSUNDEEP
androidsecuritylinux-kernelkernel-modulearm64
Gal Kaptsenel
Gal Kaptsenel

Reputation: 21

aarch64 allocate executable page in kernel

I am writing a krenel module that allocates some virtual executable memory. The module should write some code into the allocated page, call it, and afterwards return to my code. I am working on a Pixel 8 device(5.15.137-android14-11-gbc062a78e195-ab12057991), with aarch64 arch.

My original idea was to use vmalloc to allocate some pages, and then use set_memory_x function, in order to make few of them executable. As set_memory_x is not exported, I want to use kallsyms_lookup_name to get the address of set_memory_x. As kallsyms_lookup_name is not exported, I want to use the kprobe trick). The kprobe trick works as requied (I get the correct address, as it is exactly the same as in /proc/kallysysms), but the moment I call kallsyms_lookup_name, I get CFI failure:

According to the contents of the /sys/fs/pstore/console-ramoops-0 file:

RAMDUMP_MSG.txt: reset message: KP: CFI failure (target: kallsyms_lookup_name+0x0/0x1a4) UUID: 09360bf4-7890-8040-a5e7-638d656d4189 last kernel version: 5.15.137-android14-11-gb60f0c2a8346-ab12076200 aosp kernel version: 5.15.137-android14-11-gbc062a78e195-ab12057991 build: google/shiba/shiba:14/AP2A.240905.003/12231197:user/release-keys RST_STAT: 0x80 - SYSTEM_SWRESET_SYSTEM GSA_RESET_STATUS: 0x10 - GSA_INTERMEDIATE_RESET Reboot reason: 0xbaba - Kernel PANIC Reboot mode: 0x0 - Normal Boot

As I can see, it is related to CFI failure. So maybe there is some other way to acquire executable memory pages?

I've checked previous questions regarding allocating executable pages in kernel, but thet seem to use functions I have no access to today.

Upvotes: 1

Views: 38

Answers (0)

Related Questions