search-pattern crashed when trying to read from memory mapped file /dev/dri/renderD128
#674
Closed
4 tasks done
Labels
Comments
ammarfaizi2
changed the title
/dev/dri/renderD128/dev/dri/renderD128
ammarfaizi2
added a commit
to ammarfaizi2/gef
that referenced
this issue
Jul 7, 2021
Komori Kuzuyu <[email protected]> wrote: > search-pattern command stop finding string pattern after error "Cannot > access memory at address xxxxxxxxxxxx". Checking /proc/$pid/maps the > address mentioned in error is readable but cannot be read from gdb. > > The memory is a mapped file to /dev/dri/renderD128 > Do not assume virtual memory that has read bit is always directly readable from userspace. We have a special case where /proc/$pid/maps shows virtual memory address with a read bit, but it cannot be read from the GDB. This commit adds an exception handler for read_memory on search-pattern command when such a special case occurs. Before this commit, the search-pattern command stops when it meets the above case (unhandled exception). After this commit, the search-pattern command continues the scan when read_memory fails. We still of course, show the error message indicates that the read_memory fails. The special case after this commit looks like this: gef➤ search-pattern "However" [+] Searching 'However' in memory [+] In '/usr/lib/x86_64-linux-gnu/dri/radeonsi_dri.so'(0x7fffe5576000-0x7fffe59b6000), permission=r-- 0x7fffe55f8ec6 - 0x7fffe55f8efd → "However, if the abstract value is too large, the o[...]" 0x7fffe55ff01b - 0x7fffe55ff052 → "However, if the abstract value is too large, the o[...]" [!] Cannot access memory at address 0x7fffeb00b000 [!] Cannot access memory at address 0x7fffeb0d4000 [!] Cannot access memory at address 0x7fffef49f000 [+] In '/usr/lib/x86_64-linux-gnu/libbrotlicommon.so.1.0.9'(0x7ffff72ab000-0x7ffff72ca000), permission=r-- 0x7ffff72bb287 - 0x7ffff72bb2be → "However, compositionclear:both;cooperationwithin t[...]" 0x7ffff72bd4ae - 0x7ffff72bd4e5 → "However, inprogrammersat least inapproximatealthou[...]" 0x7ffff72bd834 - 0x7ffff72bd867 → "However thelead to the\t<a href="/was grantedpeople" 0x7ffff72be10f - 0x7ffff72be146 → "However, intelligence" tabindex="float:right;Commo[...]" 0x7ffff72c1c99 - 0x7ffff72c1cd0 → "However, the An example ofcompared withquantities [...]" 0x7ffff72c1f4a - 0x7ffff72c1f81 → "However, thisDepartment ofthe remainingeffect on t[...]" 0x7ffff72c2451 - 0x7ffff72c2488 → "However, manythe presidentHowever, someis thought [...]" 0x7ffff72c246b - 0x7ffff72c24a2 → "However, someis thought tountil the endwas announc[...]" 0x7ffff72c2ff8 - 0x7ffff72c302a → "However, theand eventuallyAt the end of because of" 0x7ffff72c3c36 - 0x7ffff72c3c6d → "However, it isbecame part ofin relation topopular [...]" 0x7ffff72c66da - 0x7ffff72c670c → "However, there aresrc="http://staticsuggested that" 0x7ffff72c6c32 - 0x7ffff72c6c69 → "However, since the/div>\n</div>\n<div left; margin[...]" gef➤ Fixes: hugsy#674 Reported-by: Komori Kuzuyu <[email protected]> Signed-off-by: Ammar Faizi <[email protected]> Signed-off-by: Komori Kuzuyu <[email protected]>
5 tasks
komori-k
pushed a commit
to ammarfaizi2/gef
that referenced
this issue
Jul 7, 2021
Komori Kuzuyu <[email protected]> wrote: > search-pattern command stop finding string pattern after error "Cannot > access memory at address xxxxxxxxxxxx". Checking /proc/$pid/maps the > address mentioned in error is readable but cannot be read from gdb. > > The memory is a mapped file to /dev/dri/renderD128 > Do not assume virtual memory that has read bit is always directly readable from userspace. We have a special case where /proc/$pid/maps shows virtual memory address with a read bit, but it cannot be read from the GDB. This commit adds an exception handler for read_memory on search-pattern command when such a special case occurs. Before this commit, the search-pattern command stops when it meets the above case (unhandled exception). After this commit, the search-pattern command continues the scan when read_memory fails. We still of course, show the error message indicates that the read_memory fails. The special case after this commit looks like this: gef➤ search-pattern "However" [+] Searching 'However' in memory [+] In '/usr/lib/x86_64-linux-gnu/dri/radeonsi_dri.so'(0x7fffe5576000-0x7fffe59b6000), permission=r-- 0x7fffe55f8ec6 - 0x7fffe55f8efd → "However, if the abstract value is too large, the o[...]" 0x7fffe55ff01b - 0x7fffe55ff052 → "However, if the abstract value is too large, the o[...]" [!] Cannot access memory at address 0x7fffeb00b000 [!] Cannot access memory at address 0x7fffeb0d4000 [!] Cannot access memory at address 0x7fffef49f000 [+] In '/usr/lib/x86_64-linux-gnu/libbrotlicommon.so.1.0.9'(0x7ffff72ab000-0x7ffff72ca000), permission=r-- 0x7ffff72bb287 - 0x7ffff72bb2be → "However, compositionclear:both;cooperationwithin t[...]" 0x7ffff72bd4ae - 0x7ffff72bd4e5 → "However, inprogrammersat least inapproximatealthou[...]" 0x7ffff72bd834 - 0x7ffff72bd867 → "However thelead to the\t<a href="/was grantedpeople" 0x7ffff72be10f - 0x7ffff72be146 → "However, intelligence" tabindex="float:right;Commo[...]" 0x7ffff72c1c99 - 0x7ffff72c1cd0 → "However, the An example ofcompared withquantities [...]" 0x7ffff72c1f4a - 0x7ffff72c1f81 → "However, thisDepartment ofthe remainingeffect on t[...]" 0x7ffff72c2451 - 0x7ffff72c2488 → "However, manythe presidentHowever, someis thought [...]" 0x7ffff72c246b - 0x7ffff72c24a2 → "However, someis thought tountil the endwas announc[...]" 0x7ffff72c2ff8 - 0x7ffff72c302a → "However, theand eventuallyAt the end of because of" 0x7ffff72c3c36 - 0x7ffff72c3c6d → "However, it isbecame part ofin relation topopular [...]" 0x7ffff72c66da - 0x7ffff72c670c → "However, there aresrc="http://staticsuggested that" 0x7ffff72c6c32 - 0x7ffff72c6c69 → "However, since the/div>\n</div>\n<div left; margin[...]" gef➤ Fixes: hugsy#674 Reported-by: Komori Kuzuyu <[email protected]> Signed-off-by: Ammar Faizi <[email protected]> Signed-off-by: Komori Kuzuyu <[email protected]>
Grazfather
pushed a commit
that referenced
this issue
Jul 7, 2021
Komori Kuzuyu <[email protected]> wrote: > search-pattern command stop finding string pattern after error "Cannot > access memory at address xxxxxxxxxxxx". Checking /proc/$pid/maps the > address mentioned in error is readable but cannot be read from gdb. > > The memory is a mapped file to /dev/dri/renderD128 > Do not assume virtual memory that has read bit is always directly readable from userspace. We have a special case where /proc/$pid/maps shows virtual memory address with a read bit, but it cannot be read from the GDB. This commit adds an exception handler for read_memory on search-pattern command when such a special case occurs. Before this commit, the search-pattern command stops when it meets the above case (unhandled exception). After this commit, the search-pattern command continues the scan when read_memory fails. We still of course, show the error message indicates that the read_memory fails. The special case after this commit looks like this: gef➤ search-pattern "However" [+] Searching 'However' in memory [+] In '/usr/lib/x86_64-linux-gnu/dri/radeonsi_dri.so'(0x7fffe5576000-0x7fffe59b6000), permission=r-- 0x7fffe55f8ec6 - 0x7fffe55f8efd → "However, if the abstract value is too large, the o[...]" 0x7fffe55ff01b - 0x7fffe55ff052 → "However, if the abstract value is too large, the o[...]" [!] Cannot access memory at address 0x7fffeb00b000 [!] Cannot access memory at address 0x7fffeb0d4000 [!] Cannot access memory at address 0x7fffef49f000 [+] In '/usr/lib/x86_64-linux-gnu/libbrotlicommon.so.1.0.9'(0x7ffff72ab000-0x7ffff72ca000), permission=r-- 0x7ffff72bb287 - 0x7ffff72bb2be → "However, compositionclear:both;cooperationwithin t[...]" 0x7ffff72bd4ae - 0x7ffff72bd4e5 → "However, inprogrammersat least inapproximatealthou[...]" 0x7ffff72bd834 - 0x7ffff72bd867 → "However thelead to the\t<a href="/was grantedpeople" 0x7ffff72be10f - 0x7ffff72be146 → "However, intelligence" tabindex="float:right;Commo[...]" 0x7ffff72c1c99 - 0x7ffff72c1cd0 → "However, the An example ofcompared withquantities [...]" 0x7ffff72c1f4a - 0x7ffff72c1f81 → "However, thisDepartment ofthe remainingeffect on t[...]" 0x7ffff72c2451 - 0x7ffff72c2488 → "However, manythe presidentHowever, someis thought [...]" 0x7ffff72c246b - 0x7ffff72c24a2 → "However, someis thought tountil the endwas announc[...]" 0x7ffff72c2ff8 - 0x7ffff72c302a → "However, theand eventuallyAt the end of because of" 0x7ffff72c3c36 - 0x7ffff72c3c6d → "However, it isbecame part ofin relation topopular [...]" 0x7ffff72c66da - 0x7ffff72c670c → "However, there aresrc="http://staticsuggested that" 0x7ffff72c6c32 - 0x7ffff72c6c69 → "However, since the/div>\n</div>\n<div left; margin[...]" gef➤ Fixes: #674 Reported-by: Komori Kuzuyu <[email protected]> Signed-off-by: Ammar Faizi <[email protected]> Signed-off-by: Komori Kuzuyu <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
search-pattern crashed when trying to read from memory mapped file
/dev/dri/renderD128devbranch?gdb -nxthe closed ones) - and the PR?
Step 1: Describe your environment
Step 2: Describe your problem
Steps to reproduce
search-pattern "anything".Minimalist test case
We do not have the minimalist test case because we don't yet know the simplest way to open memory map to
/dev/dri/renderD128correctly.Observed Results
After I got the report from Komori, I was able to reproduce it myself on my machine.
We can see that GDB fails to read memory at address 0x7f637ed29000. However, after I checked the
vmmap, that address is actually readable. It has read and write bits.Lookie here:
I tried to debug Telegram desktop under strace, and I found that it performs
ioctl()+mmap()to file descriptor 35, where 35 is opened file/dev/dri/renderD128. I was not able to see exactly what objects are passed as pointers to these syscalls. I think it is something about display driver. I debugged with strace in hope I can create a simple reproduction test by seeing the syscalls used to map that file, but I couldn't, it is not that simple.Expected Result
Do not assume virtual memory that has read bit is always directly readable. We need to handle this error and show a message that the address cannot be read. Then continue the searching. Don't stop due to this exception.
Conclusion
There is a special case where readable virtual memory is not directly readable from userspace. This display driver device is the example of it.
Full Traces
Cc: @komori-k
The text was updated successfully, but these errors were encountered: