Skip to content

Commit 2a005e0

Browse files
committed
kernel: core_hook: screw path_umount backport, call sys_umount directly
I am repasting here what I posted on the source code originally: /* * turns out path_umount backport is completely unneeded * we copy the trick used on strncpy_from_unsafe_user / strncpy_from_user_nofault * https://elixir.bootlin.com/linux/v4.4.302/source/mm/maccess.c#L184 * basically * * mm_segment_t old_fs = get_fs(); // remember original fs segment * set_fs(USER_DS); // or KERNEL_DS * * do_whatever_in_userspace(); * set_fs(old_fs); // restore fs segment * * * kernel -> user, KERNEL_DS, user -> kernel, USER_DS * * so yes, we can try to straight up call a syscall from kernel space * * NOTE: on newer kernels you can use force_uaccess_begin + force_uaccess_end * ref: https://elixir.bootlin.com/linux/v5.10.237/source/mm/maccess.c#L250 * */ path_umount backport now optional — neat trick, werks, what can I say. Backports? Nah, we’re good. Signed-off-by: backslashxx <[email protected]>
1 parent f0221bc commit 2a005e0

File tree

1 file changed

+20
-0
lines changed

1 file changed

+20
-0
lines changed

kernel/core_hook.c

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@
1616
#include <linux/mount.h>
1717
#include <linux/fs.h>
1818
#include <linux/namei.h>
19+
#ifndef KSU_HAS_PATH_UMOUNT
20+
#include <linux/syscalls.h> // sys_umount
21+
#endif
1922

2023
#include "allowlist.h"
2124
#include "core_hook.h"
@@ -506,13 +509,26 @@ static bool should_umount(struct path *path)
506509
return false;
507510
}
508511

512+
#ifdef KSU_HAS_PATH_UMOUNT
509513
static void ksu_umount_mnt(struct path *path, int flags)
510514
{
511515
int err = path_umount(path, flags);
512516
if (err) {
513517
pr_info("umount %s failed: %d\n", path->dentry->d_iname, err);
514518
}
515519
}
520+
#else
521+
static void ksu_sys_umount(const char *mnt, int flags)
522+
{
523+
char __user *usermnt = (char __user *)mnt;
524+
525+
mm_segment_t old_fs = get_fs();
526+
set_fs(KERNEL_DS);
527+
long ret = sys_umount(usermnt, flags); // cuz asmlinkage long sys##name
528+
set_fs(old_fs);
529+
pr_info("%s: path: %s code: %d \n", __func__, mnt, ret);
530+
}
531+
#endif // KSU_HAS_PATH_UMOUNT
516532

517533
static void try_umount(const char *mnt, bool check_mnt, int flags)
518534
{
@@ -532,7 +548,11 @@ static void try_umount(const char *mnt, bool check_mnt, int flags)
532548
return;
533549
}
534550

551+
#ifdef KSU_HAS_PATH_UMOUNT
535552
ksu_umount_mnt(&path, flags);
553+
#else
554+
ksu_sys_umount(mnt, flags);
555+
#endif
536556
}
537557

538558
int ksu_handle_setuid(struct cred *new, const struct cred *old)

0 commit comments

Comments
 (0)