From b644c124e33115aa1233715b5af1ed4bca967523 Mon Sep 17 00:00:00 2001 From: weishu Date: Thu, 22 Jun 2023 15:29:53 +0800 Subject: [PATCH] kernel: copy filename ourself instead of getname --- kernel/sucompat.c | 30 ++++++++++++++---------------- 1 file changed, 14 insertions(+), 16 deletions(-) diff --git a/kernel/sucompat.c b/kernel/sucompat.c index 09e5f501..f09a0af6 100644 --- a/kernel/sucompat.c +++ b/kernel/sucompat.c @@ -20,6 +20,12 @@ #define SU_PATH "/system/bin/su" #define SH_PATH "/system/bin/sh" +#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0) +#define ksu_strncpy_from_user_nofault strncpy_from_user_nofault +#else +#define ksu_strncpy_from_user_nofault strncpy_from_unsafe_user +#endif + extern void escape_to_root(); static void __user *userspace_stack_buffer(const void *d, size_t len) @@ -41,32 +47,27 @@ static char __user *sh_user_path(void) int ksu_handle_faccessat(int *dfd, const char __user **filename_user, int *mode, int *flags) { - struct filename *filename; const char su[] = SU_PATH; if (!ksu_is_allow_uid(current_uid().val)) { return 0; } - filename = getname(*filename_user); + char path[sizeof(su)]; + memset(path, 0, sizeof(path)); + ksu_strncpy_from_user_nofault(path, *filename_user, sizeof(path)); - if (IS_ERR(filename)) { - return 0; - } - if (unlikely(!memcmp(filename->name, su, sizeof(su)))) { + if (unlikely(!memcmp(path, su, sizeof(su)))) { pr_info("faccessat su->sh!\n"); *filename_user = sh_user_path(); } - putname(filename); - return 0; } int ksu_handle_stat(int *dfd, const char __user **filename_user, int *flags) { // const char sh[] = SH_PATH; - struct filename *filename; const char su[] = SU_PATH; if (!ksu_is_allow_uid(current_uid().val)) { @@ -77,18 +78,15 @@ int ksu_handle_stat(int *dfd, const char __user **filename_user, int *flags) return 0; } - filename = getname(*filename_user); + char path[sizeof(su)]; + memset(path, 0, sizeof(path)); + ksu_strncpy_from_user_nofault(path, *filename_user, sizeof(path)); - if (IS_ERR(filename)) { - return 0; - } - if (unlikely(!memcmp(filename->name, su, sizeof(su)))) { + if (unlikely(!memcmp(path, su, sizeof(su)))) { pr_info("newfstatat su->sh!\n"); *filename_user = sh_user_path(); } - putname(filename); - return 0; }