Insert systemcall hook module cause system crashed - c

Question

Environment
ubuntun 18.04
Linux ubuntu 5.4.0-122-generic #138~18.04.1-Ubuntu SMP Fri Jun 24 14:14:03 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
What I'm trying to do
I'm trying to write a kernel module that hooks sys_read, sys_write and sys_open, using ftrace.
The ftrace code is copied from some blogs, I'm sure ftrace usage is right.
But when i execute insmod my.ko, the vmware workstation shows up cpu disabled by guest operating system, I have no idea about it, the system crashed immediately so that i can't read the dmesg or do something else about debug.
Here is my code (maybe only fh_sys_read and GetPath make sense for this question):
#include <linux/module.h>
#include <linux/delay.h>
#include <asm/unistd.h>
#include <linux/fs.h>
#include <linux/sched.h>
#include <linux/version.h>
//#include<linux/err.h>
#include <linux/errno.h>
#include <linux/fcntl.h>
#include <linux/rtc.h>
#include <linux/string.h>
#include <linux/time.h>
#include <linux/timex.h>
#include <linux/unistd.h>
//#include<linux/slab.h>
#include <linux/kernel.h>
#include <linux/module.h>
//#include<linux/init.h>
#include <linux/dcache.h>
#include <linux/delay.h>
#include <linux/fdtable.h>
#include <linux/file.h>
#include <linux/fs_struct.h>
#include <linux/kallsyms.h>
#include <linux/kprobes.h>
#include <linux/limits.h> //for PATH_MAX
#include <linux/mutex.h>
#include <linux/spinlock.h>
#include <linux/workqueue.h>
#include <asm/current.h>
#include <stddef.h>
// #include <string.h>
MODULE_LICENSE("GPL");
#define F_LEN 256
static char* GetPath(int fd){
char *tmp;
char *pathname;
struct file *file;
struct path path;
struct files_struct *files = NULL;
files = current->files;
file = files->fdt->fd[fd];
if (!file) {
return NULL;
}
path = file->f_path;
path_get(&path);
tmp = (char *)__get_free_page(GFP_KERNEL);
if (!tmp) {
path_put(&path);
return NULL;
}
path_put(&path);
pathname = d_path(&path, tmp, PAGE_SIZE);
if (IS_ERR(pathname)) {
free_page((unsigned long)tmp);
return PTR_ERR(pathname);
}
printk("path:%s\n", pathname);
free_page((unsigned long)tmp);
return NULL;
}
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 17, 0)
#include <linux/ftrace.h>
#ifndef CONFIG_X86_64
#error Currently only x86_64 architecture is supported
#endif // config_x86_64
#if defined(CONFIG_X86_64) && (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 17, 0))
#define PTREGS_SYSCALL_STUBS 1
#endif // config PTREGS
#ifdef PTREGS_SYSCALL_STUBS
#define SYSCALL_NAME(name) ("__x64_" name)
#else
#define SYSCALL_NAME(name) (name)
#endif // PTREGS_SYSCALL_STUBS
struct ftrace_hook {
const char *name;
void *function;
void *original;
unsigned long address;
struct ftrace_ops ops;
};
#define HOOK(_name, _function, _original) \
{ \
.name = SYSCALL_NAME(_name), .function = (_function), \
.original = (_original), \
}
static asmlinkage long (*real_sys_read)(unsigned int fd, char *buf, size_t count);
static asmlinkage long (*real_sys_write)(unsigned int fd, const char *buf, size_t count);
static asmlinkage long (*real_sys_open)(const char *filename, int flags, umode_t mode);
static asmlinkage long fh_sys_read(unsigned int fd, char __user *buf, size_t count) {
GetPath(fd);
return (*real_sys_read)(fd, buf, count);
}
static asmlinkage long fh_sys_write(unsigned int fd, const char __user *buf,
size_t count) {
return (*real_sys_write)(fd, buf, count);
}
static asmlinkage long fh_sys_open(const char __user *filename, int flags,
umode_t mode) {
return (*real_sys_open)(filename, flags, mode);
}
#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 7, 0)
static unsigned long lookup_name(const char *name) {
struct kprobe kp = {.symbol_name = name};
unsigned long retval;
if (register_kprobe(&kp) < 0) return 0;
retval = (unsigned long)kp.addr;
unregister_kprobe(&kp);
return retval;
}
#else
static unsigned long lookup_name(const char *name) {
return kallsyms_lookup_name(name);
}
#endif // lookup_name
static int fh_resolve_address(struct ftrace_hook *hook) {
pr_debug("start lookup_name");
hook->address = lookup_name(hook->name);
if (!hook->address) {
printk(KERN_ERR "lookup_name error");
printk(KERN_ERR "unresolved symbol: %s\n", hook->name);
return -ENOENT;
}
*((unsigned long *)hook->original) = hook->address;
return 0;
}
#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 11, 0)
#define ftrace_ops_fl_recursion ftrace_ops_fl_recursion_safe
#endif
#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 11, 0)
#define ftrace_regs pt_regs
static __always_inline struct pt_regs *ftrace_get_regs(
struct ftrace_regs *fregs) {
return fregs;
}
#endif // versioncode 5.11
static void notrace fh_ftrace_thunk(unsigned long ip, unsigned long parent_ip,
struct ftrace_ops *ops,
struct ftrace_regs *regs) {
struct ftrace_hook *hook = container_of(ops, struct ftrace_hook, ops);
/* Skip the function calls from the current module. */
if (!within_module(parent_ip, THIS_MODULE))
regs->ip = (unsigned long)hook->function;
}
int fh_install_hook(struct ftrace_hook *hook) {
int err = 0;
err = fh_resolve_address(hook);
if (err) {
printk(KERN_ERR "resolve_address error");
return err;
}
hook->ops.func = fh_ftrace_thunk;
hook->ops.flags = FTRACE_OPS_FL_SAVE_REGS | FTRACE_OPS_FL_IPMODIFY;
pr_info("start set ip");
err = ftrace_set_filter_ip(&hook->ops, hook->address, 0, 0);
if (err) {
pr_debug("ftrace_set_filter_ip() failed: %d\n", err);
return err;
}
pr_debug("start register_ftrace_function");
err = register_ftrace_function(&hook->ops);
if (err) {
pr_debug("register_ftrace_function() failed: %d\n", err);
ftrace_set_filter_ip(&hook->ops, hook->address, 1, 0);
return err;
}
return 0;
}
int fh_install_hooks(struct ftrace_hook *hooks, int count) {
int i = 0;
for (i = 0; i < count; i++) {
fh_install_hook(&hooks[i]);
}
return 0;
}
int fh_remove_hook(struct ftrace_hook *hook) {
int err;
err = unregister_ftrace_function(&hook->ops);
if (err) {
pr_debug("unregister_ftrace_function() failed: %d\n", err);
}
err = ftrace_set_filter_ip(&hook->ops, hook->address, 1, 0);
if (err) {
pr_debug("ftrace_set_filter_ip() failed: %d\n", err);
}
return 0;
}
int fh_remove_hooks(struct ftrace_hook *hooks, int count) {
int i = 0;
for (i = 0; i < count; i++) {
fh_remove_hook(&hooks[i]);
}
return 0;
}
struct ftrace_hook hooks[] = {HOOK("sys_read", fh_sys_read, &real_sys_read),
HOOK("sys_open", fh_sys_open, &real_sys_open),
HOOK("sys_write", fh_sys_write, &real_sys_write)};
#endif // if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 17, 0)
static int __init kprobe_test_init(void) {
fh_install_hooks(hooks, 3);
return 0;
}
static void __exit kprobe_test_exit(void) {
fh_remove_hooks(hooks, 3);
}
module_init(kprobe_test_init);
module_exit(kprobe_test_exit);
My thoughts
I think the GetPath function caused the crash, and when I commment the line that calls GetPath, it works well, but it doesn't make sense.
I had tried to comment each line in GetPath, this GetPath wouldn't cause the crash, but it make no sense too.
static char* GetPath(int fd){
char *tmp;
char *pathname;
struct file *file;
struct path path;
struct files_struct *files = NULL;
files = current->files;
file = files->fdt->fd[fd];
if (!file) {
return NULL;
}
path = file->f_path;
// path_get(&path);
tmp = (char *)__get_free_page(GFP_KERNEL);
if (!tmp) {
path_put(&path);
return NULL;
}
return NULL;
// FIXME:
/*
path_put(&path);
pathname = d_path(&path, tmp, PAGE_SIZE);
if (IS_ERR(pathname)) {
free_page((unsigned long)tmp);
return PTR_ERR(pathname);
}
printk("path:%s\n", pathname);
free_page((unsigned long)tmp);
return NULL;
*/
}
Question
What is the problem, the GetPath function is just everal line and it looks all right.
How to debug kernel module that will cause system crashed? Like gdb, I can make some breakpoint and debug them step by step, but kernel module I don't know how.
Feel very sorry for my poor english.
Thanks for viewing.