Search code examples
clinuxpointersmodulekernel

Pointer Dereferencing causes Permission Violation in Kernel Module


i am trying to allocate memory for a pointer in another function in Linux Kernel module file, and it causes error_code(0x0001) - permissions violation .

Here is a simpler reproduction of what i am trying to do.

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/slab.h>

int another(char **name){
    *name = kmalloc(16, GFP_KERNEL);
    return 0;
}

static int __init test_init(void){
    char *name;
    another(&name);
    printk(KERN_INFO "Hello!");
    return 0;
}

static void __exit test_exit(void){
    printk(KERN_INFO "Goodbye!");
}

MODULE_LICENSE("GPL");

module_init(test_init);
module_exit(test_exit);

I did this a lot in userspace and it works just fine, but here it crashes every time. Here is dmesg message.

[  313.588325] BUG: unable to handle page fault for address: 00007fa96fb6c768
[  313.588328] #PF: supervisor read access in kernel mode
[  313.588329] #PF: error_code(0x0001) - permissions violation
[  313.588330] PGD 80000001ed9ab067 P4D 80000001ed9ab067 PUD 1e7961067 PMD 172bfb067 PTE 8000000203cad867
[  313.588334] Oops: 0001 [#1] PREEMPT SMP PTI
[  313.588337] CPU: 0 PID: 3225 Comm: insmod Tainted: P           OE     5.19.9-arch1-1 #1 3da5a84b9442a05cd5bc412feaf8d6ab31862ed4
[  313.588339] Hardware name: System manufacturer System Product Name/PRIME H270-PRO, BIOS 0808 07/10/2017
[  313.588340] RIP: 0010:test_init+0xc/0x1000 [ldlox]
[  313.588346] Code: Unable to access opcode bytes at RIP 0xffffffffc36e0fe2.
[  313.588347] RSP: 0018:ffffa61e830d3d28 EFLAGS: 00010286
[  313.588349] RAX: 0000000000000000 RBX: ffffffffc36e1000 RCX: 0000000000000000
[  313.588350] RDX: 0000000000000000 RSI: ffffffffc36e1000 RDI: ffffa61e830d3d28
[  313.588351] RBP: ffffa61e830d3d38 R08: 0000000000000010 R09: ffff96b66407b210
[  313.588353] R10: ffff96b664da2790 R11: 0000000000000100 R12: 0000000000000000
[  313.588354] R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000
[  313.588355] FS:  00007fa96fb6c740(0000) GS:ffff96b77ec00000(0000) knlGS:0000000000000000
[  313.588357] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  313.588358] CR2: ffffffffc36e0fe2 CR3: 0000000205752005 CR4: 00000000003706f0
[  313.588360] Call Trace:
[  313.588361]  <TASK>
[  313.588363]  ? 0xffffffffc36e1000
[  313.588365]  do_one_initcall+0x5d/0x220
[  313.588370]  do_init_module+0x4a/0x1e0
[  313.588373]  __do_sys_finit_module+0xac/0x120
[  313.588376]  do_syscall_64+0x5f/0x90
[  313.588380]  ? syscall_exit_to_user_mode+0x1b/0x40
[  313.588383]  ? do_syscall_64+0x6b/0x90
[  313.588385]  ? exc_page_fault+0x74/0x170
[  313.588387]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[  313.588390] RIP: 0033:0x7fa96f71959d
[  313.588392] Code: 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d bb 77 0d 00 f7 d8 64 89 01 48
[  313.588394] RSP: 002b:00007ffdbca6d348 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[  313.588396] RAX: ffffffffffffffda RBX: 0000559aa257f7b0 RCX: 00007fa96f71959d
[  313.588397] RDX: 0000000000000000 RSI: 0000559aa0cb0cb2 RDI: 0000000000000003
[  313.588398] RBP: 0000559aa0cb0cb2 R08: 0000000000000000 R09: 0000559aa2581cf0
[  313.588399] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000
[  313.588400] R13: 0000559aa257f760 R14: 00007ffdbca6d588 R15: 0000559aa257f8c0
[  313.588402]  </TASK>
[  313.588403] Modules linked in: ldlox(OE+) snd_seq_dummy snd_hrtimer snd_seq snd_seq_device xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp nft_compat nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables libcrc32c nfnetlink bridge intel_rapl_msr intel_rapl_common intel_tcc_cooling cfg80211 x86_pkg_temp_thermal intel_powerclamp coretemp 8021q garp kvm_intel mrp stp snd_hda_codec_realtek llc kvm irqbypass snd_hda_codec_generic crct10dif_pclmul ledtrig_audio crc32_pclmul nvidia_drm(POE) ghash_clmulni_intel nvidia_uvm(POE) nvidia_modeset(POE) aesni_intel eeepc_wmi crypto_simd iTCO_wdt asus_wmi intel_pmc_bxt mei_pxp mei_hdcp snd_hda_codec_hdmi cryptd ee1004 sparse_keymap iTCO_vendor_support rapl platform_profile snd_hda_intel intel_cstate vfat snd_intel_dspcfg wmi_bmof rfkill mxm_wmi fat snd_intel_sdw_acpi intel_uncore nvidia(POE) i915 mousedev snd_hda_codec snd_hda_core drm_buddy snd_hwdep ttm snd_pcm drm_display_helper snd_timer video mei_me
[  313.588439]  cec e1000e snd intel_gtt soundcore i2c_i801 mei mac_hid i2c_smbus wmi acpi_pad pcspkr dm_multipath dm_mod sg crypto_user fuse bpf_preload ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 usbhid crc32c_intel xhci_pci xhci_pci_renesas
[  313.588452] Unloaded tainted modules: acpi_cpufreq():1 acpi_cpufreq():1 acpi_cpufreq():1 acpi_cpufreq():1 fjes():1 fjes():1 pcc_cpufreq():1 fjes():1 pcc_cpufreq():1 acpi_cpufreq():1 acpi_cpufreq():1 pcc_cpufreq():1 fjes():1 pcc_cpufreq():1 acpi_cpufreq():1 fjes():1 fjes():1 acpi_cpufreq():1 pcc_cpufreq():1 fjes():1 pcc_cpufreq():1 acpi_cpufreq():1 pcc_cpufreq():1 acpi_cpufreq():1 fjes():1 acpi_cpufreq():1 fjes():1 pcc_cpufreq():1 acpi_cpufreq():1
[  313.588471] CR2: 00007fa96fb6c768
[  313.588472] ---[ end trace 0000000000000000 ]---
[  313.588474] RIP: 0010:test_init+0xc/0x1000 [ldlox]
[  313.588477] Code: Unable to access opcode bytes at RIP 0xffffffffc36e0fe2.
[  313.588478] RSP: 0018:ffffa61e830d3d28 EFLAGS: 00010286
[  313.588479] RAX: 0000000000000000 RBX: ffffffffc36e1000 RCX: 0000000000000000
[  313.588480] RDX: 0000000000000000 RSI: ffffffffc36e1000 RDI: ffffa61e830d3d28
[  313.588481] RBP: ffffa61e830d3d38 R08: 0000000000000010 R09: ffff96b66407b210
[  313.588482] R10: ffff96b664da2790 R11: 0000000000000100 R12: 0000000000000000
[  313.588483] R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000
[  313.588484] FS:  00007fa96fb6c740(0000) GS:ffff96b77ec00000(0000) knlGS:0000000000000000
[  313.588486] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  313.588487] CR2: ffffffffc36e0fe2 CR3: 0000000205752005 CR4: 00000000003706f0

Also i am getting these messages while compiling.

/home/sam/projects/test.o: warning: objtool: another+0x40: 'naked' return found in RETHUNK build
/home/sam/projects/test.o: warning: objtool: test_init+0x55: 'naked' return found in RETHUNK build
/home/sam/projects/test.o: warning: objtool: test_exit+0x1e: 'naked' return found in RETHUNK build
/home/sam/projects/test.o: warning: objtool: folio_flags+0x29: missing int3 after ret
/home/sam/projects/test.o: warning: objtool: another+0x40: missing int3 after ret
/home/sam/projects/test.o: warning: objtool: test_init+0x55: missing int3 after ret
/home/sam/projects/test.o: warning: objtool: test_exit+0x1e: missing int3 after ret

This is my Makefile:

KBUILD_CFLAGS   :=  -g -Wall
EXTRA_CFLAGS    +=  -I$(PWD)/

obj-m   += ldlox.o
ldlox-y += rbl_serdes.o

all:
    make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules

clean:
    make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean

And my linux/linux-headers versions:

linux-headers 5.19.10.arch1-1
5.19.10-arch1-1

Solution

  • The issue is caused by the following line in Makefile

    KBUILD_CFLAGS   :=  -g -Wall
    

    which needs to be replaced by

    KBUILD_CFLAGS   +=  -g -Wall
    

    As stated here.