Stack buffer size issue

Stack buffer size issue

[evilsocket]

Hello to all, i'm trying to develop a kernel module that accepts an 
ioctl with this structure :

typedef struct{
    /* [INPUT]  */
    long   process;
    unsigned long address;
   
    /* [OUTPUT] */   
    long mm_size;
}
mg_query_t;

where :

process : is the pid of a process .
address : is the address of a buffer on the stack of that process .

mm_size : *should* be the return value of the ioctl, indicating the size 
of that buffer, as an example (userspace test application):

char * abuffer[123];
mg_query_t query;
   
query.process = getpid();
query.address = abuffer;
   
if( ioctl( fd, IOCTL_MTABLE_BY_PID, &query ) < 0 ){
    close(fd);
    perror( "IOCTL_MTABLE_BY_PID" );
    return -1;
}

printf( "SIZE : %d\n", query.mm_size );



This *should* give the output :

SIZE : 123

I'm using the struct task_struct in the kernel module, looping the mmap 
to find the vm area the address resides in and then to set

mm_size = vm_end - vm_start

But doing so i obtaing only the size of the vm page the buffer resides .

Any hints ?

Thanks in advantage .

Re: Stack buffer size issue

[Valdis.Kletnieks]

[-- Attachment #1: Type: text/plain, Size: 1229 bytes --]

On Thu, 18 Sep 2008 14:30:12 +0200, evilsocket said:

> char * abuffer[123];

Note that this '123' isn't anything that's known to the kernel, or passed to
it.

> This *should* give the output :
> 
> SIZE : 123

Why "should' it do so?  The kernel doesn't know or care much about what your
stack layout is, except if you overflow the provided space.

Minor nit:  'char *abuffer[123];' allocates an array of 123 pointers-to-ints,
which means it's actually 123*4 or 123*8 bytes in size, depending on the size
of a pointer (different for 32 and 64 bit programs).  So if you got 123 as
an answer, that would *still* be wrong...

> I'm using the struct task_struct in the kernel module, looping the mmap 
> to find the vm area the address resides in and then to set
> 
> mm_size = vm_end - vm_start

Right.  That's the size of the mm you're looking at. There isn't one mm
for each variable in your program.

> But doing so i obtaing only the size of the vm page the buffer resides .

That's probably because the struct mm that covers your program stack is only
one page in size.

Do a 'cat /proc/self/maps', which will show the maps in use for the /bin/cat
process, and ponder why there's a lot fewer lines than /bin/cat has variables.

[-- Attachment #2: Type: application/pgp-signature, Size: 226 bytes --]