```struct task_struct { struct thread_info thread_info; volatile long state; /* -1 unrunnable, 0 runnable, >0 stopped: */ void *stack; /* 堆指针 */ at
以linux为例,它的task_struct在不同版本中发生了上万次变化,硬件无法知情。三个定理如果成立,就决定了必须有两个阶段,且硬件软件都参与,才能完成“保存进程A的IP寄存器”这一目的第一个阶段 看图, save regs(A) -> k-stack(A)“On the left, the hardware saves the registers of Process A into the Kern...
#ifdef CONFIG_THREAD_INFO_IN_TASK /* * For reasons of header soup (see current_thread_info()), this * must be the first element of task_struct. */ struct thread_info thread_info; #endif volatile long state;进程状态/* -1 unrunnable, 0 runnable, >0 stopped */ void *stack;进程内核...
thread_info结构体中的成员task指向线程的task_struct结构体: // file: arch/x86/include/asm/thread_info.hstructthread_info{structtask_struct*task;/* main task structure */...}; 同样,task_struct结构体中也有一个成员stack指向thread_info结构体。 // file: include/linux/sched.hstructtask_struct{....
asmlinkage __visiblevoid__initstart_kernel(void){char*command_line;char*after_dashes;set_task_stack_end_magic(&init_task);smp_setup_processor_id();debug_objects_early_init();cgroup_init_early();local_irq_disable();early_boot_irqs_disabled=true;/* * Interrupts are still disabled. Do necessa...
//宏定义了就是向上生长staticinline unsigned long*end_of_stack(struct task_struct*p){#ifdefCONFIG_STACK_GROWSUPreturn(unsigned long*)((unsigned long)task_thread_info(p)+THREAD_SIZE)-1;#elsereturn(unsigned long*)(task_thread_info(p)+1);#endif} ...
如下为task_struct结构体代码分析 struct task_struct { //进程的运行时状态 volatile long state; /* -1 unrunnable, 0 runnable, >0 stopped */ void *stack; atomic_t usage; //进程当前的状态 /* 0x00000002表示进程正在被创建; 0x00000004表示进程正准备退出; ...
struct task_struct *task; struct exec_domain *exec_domain; __u32 flags; __u32 status; __u32 cpu; int preempt_count; mm_segment_t addr_limit; struct restart_block restart_block; void __user *sysenter_return; #ifdef CONFIG_X86_32 ...
THREAD_INFO_IN_TASK是一个典型缩小攻击面特性,将原本放在栈内存上的thread_info结构体,移到task struct全局变量中,防止攻击者通过stack overflow对thread_info结构体敏感数据(addr_limit)进行篡改。 漏洞利用防御和缓解。 例如为缓解堆喷射(heap spray)攻击,堆内存free list增加随机化处理,即SLAB/SLUB free list ...
structnode{void*unknown;chardata[8];structnode*next;}; 该结构体前八个字节是从current_task的某个特殊偏移取的值,经尝试可知为线程组 id,我们来看其分配过程,使用了kmem_cache_alloc(kmalloc_caches[5], 0x60000C0),第二个参数是 flag ,为常规的GFP_KERNEL,这里可以暂且忽略 ...