红联Linux门户
Linux帮助

求助:redhat9内核模块替换sys_execve导致系统内存耗尽问题

发布时间:2007-06-14 19:37:39来源:红联作者:dingyan_ding
在redhat9上编写了一个内核模块,替换了sys_execve调用,加载后开四个终端循环运行system(/usr/bin/who)命令,约7小时左右导致系统内存耗尽,最终会报"out ofmemory : killed httpd"消息。
下面是我的代码,感觉已经很精简了,为什么会导致这样的结果呢?
#define __KERNEL__
#define MODULE
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
//#include
//#include
#include
#include
#include
#include

void **sys_calls_table;
#ifndef HIDDEN_SCT
extern void *sys_call_table[];
#endif
#if defined(HIDDEN_SCT)
#ifdef NO_SYS_CLOSE
unsigned long sys_close_ = SYS_CLOSE_ADDR;
#else
unsigned int sys_close_ = (unsigned long )sys_close;
#endif
void ** get_sys_call_table_addr(void)
{
unsigned long ptr;
extern int loops_per_jiffy;
unsigned long *p;
for (ptr=(unsigned long)&loops_per_jiffy ; ptr<(unsigned long)&boot_cpu_data ; ptr+=sizeof(void *))
{
p = (unsigned long *)ptr;
if (p[6] == sys_close_)
{
return (void **)p;
}
}
return NULL;
}
#endif
static asmlinkage int (*old_sys_execve)(struct pt_regs regs);

asmlinkage int new_sys_execve(struct pt_regs regs)
{
int error;
char * filename;
filename = getname((char *) regs.ebx);
error = PTR_ERR(filename);
if (IS_ERR(filename))
goto out;
error = do_execve(filename, (char **) regs.ecx, (char **) regs.edx, ®s);
if (error == 0)
current->ptrace &= ~PT_DTRACE;
putname(filename);
out:
return error;

}

int Monitor_intercept_calls (void)
{
/* execve() */
old_sys_execve = sys_calls_table[__NR_execve];
sys_calls_table[__NR_execve] = new_sys_execve;

printk("old_exec = %lu, new_exec = %lu\n", (unsigned long)old_sys_execve, (unsigned long)new_sys_execve);
return 0;
}

int Monitor_restore_calls (void)
{
/* Restore open() call */
if ( sys_calls_table[__NR_execve] != new_sys_execve)
return 1;
sys_calls_table[__NR_execve] = old_sys_execve;


return 0;
}
int init_module()
{
lock_kernel();
#ifdef HIDDEN_SCT
sys_calls_table = get_sys_call_table_addr();
#else
sys_calls_table = sys_call_table;
#endif
unlock_kernel();

if (!sys_calls_table) {
printk("System calls table can't be found\n");
return -EPERM;
}
printk("Load CMD_EXEC_CONTROLOR MODULE\n");

Monitor_intercept_calls();

return 0;
}

int cleanup_module()
{
Monitor_restore_calls();
return 0;
}
MODULE_LICENSE("GPL");

红帽系统是在vmare中安装的。运行7小时后,top结果如图所示:


请教各位高人,不胜感激!!!
文章评论

共有 0 条评论