Skip to content
This repository was archived by the owner on Oct 30, 2025. It is now read-only.

Commit fa44f7e

Browse files
committed
kernel: ksud: dont create structs just to deconstruct them for a string
__ksu_handle_execve_ksud was building a fake struct filename just to pass it to ksu_handle_execveat_ksud, which immediately does... filename->name. ?? All we ever needed was filename->name, but we kept doing this meme where we manually built a struct filename, passed it around, then immediately ripped out the string again. ?? refactor this so that __ksu_handle_execveat_ksud, takes plain char *. The old ksu_handle_execveat_ksud is now a shim that unpacks the struct and hands off the string like we should’ve been doing from the start. Also mark ksu_handle_execveat_ksud as maybe unused as this will actually be unused on syscall-only builds. This also makes integration easier on kernels that don’t have struct filename. Rejected: tiann#2595 Signed-off-by: backslashxx <[email protected]>
1 parent 7db69cb commit fa44f7e

File tree

1 file changed

+26
-22
lines changed

1 file changed

+26
-22
lines changed

kernel/ksud.c

Lines changed: 26 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -155,16 +155,10 @@ static int __maybe_unused count(struct user_arg_ptr argv, int max)
155155
}
156156

157157
// IMPORTANT NOTE: the call from execve_handler_pre WON'T provided correct value for envp and flags in GKI version
158-
int ksu_handle_execveat_ksud(int *fd, struct filename **filename_ptr,
158+
static int __ksu_handle_execveat_ksud(int *fd, char *filename,
159159
struct user_arg_ptr *argv,
160160
struct user_arg_ptr *envp, int *flags)
161161
{
162-
if (!ksu_execveat_hook) {
163-
return 0;
164-
}
165-
166-
struct filename *filename;
167-
168162
static const char app_process[] = "/system/bin/app_process";
169163
static bool first_app_process = true;
170164

@@ -174,15 +168,10 @@ int ksu_handle_execveat_ksud(int *fd, struct filename **filename_ptr,
174168
static const char old_system_init[] = "/init";
175169
static bool init_second_stage_executed = false;
176170

177-
if (!filename_ptr)
171+
if (!filename)
178172
return 0;
179173

180-
filename = *filename_ptr;
181-
if (IS_ERR(filename)) {
182-
return 0;
183-
}
184-
185-
if (unlikely(!memcmp(filename->name, system_bin_init,
174+
if (unlikely(!memcmp(filename, system_bin_init,
186175
sizeof(system_bin_init) - 1) &&
187176
argv)) {
188177
// /system/bin/init executed
@@ -206,7 +195,7 @@ int ksu_handle_execveat_ksud(int *fd, struct filename **filename_ptr,
206195
pr_err("/system/bin/init parse args err!\n");
207196
}
208197
}
209-
} else if (unlikely(!memcmp(filename->name, old_system_init,
198+
} else if (unlikely(!memcmp(filename, old_system_init,
210199
sizeof(old_system_init) - 1) &&
211200
argv)) {
212201
// /init executed
@@ -269,7 +258,7 @@ int ksu_handle_execveat_ksud(int *fd, struct filename **filename_ptr,
269258
}
270259
}
271260

272-
if (unlikely(first_app_process && !memcmp(filename->name, app_process,
261+
if (unlikely(first_app_process && !memcmp(filename, app_process,
273262
sizeof(app_process) - 1))) {
274263
first_app_process = false;
275264
pr_info("exec app_process, /data prepared, second_stage: %d\n",
@@ -281,6 +270,26 @@ int ksu_handle_execveat_ksud(int *fd, struct filename **filename_ptr,
281270
return 0;
282271
}
283272

273+
// keep this for manually hooked builds
274+
__maybe_unused int ksu_handle_execveat_ksud(int *fd, struct filename **filename_ptr,
275+
struct user_arg_ptr *argv, struct user_arg_ptr *envp,
276+
int *flags)
277+
{
278+
// return early when disabled
279+
if (!ksu_execveat_hook) {
280+
return 0;
281+
}
282+
283+
if (!filename_ptr)
284+
return 0;
285+
286+
struct filename *filename = *filename_ptr;
287+
if (IS_ERR(filename))
288+
return 0;
289+
290+
return __ksu_handle_execveat_ksud(fd, (char *)filename->name, argv, envp, flags);
291+
}
292+
284293
static ssize_t (*orig_read)(struct file *, char __user *, size_t, loff_t *);
285294
static ssize_t (*orig_read_iter)(struct kiocb *, struct iov_iter *);
286295
static struct file_operations fops_proxy;
@@ -476,7 +485,6 @@ bool ksu_is_safe_mode()
476485
__maybe_unused static int __ksu_handle_execve_ksud(const char __user *filename_user,
477486
struct user_arg_ptr *argv)
478487
{
479-
struct filename filename_in, *filename_p;
480488
char path[32];
481489

482490
// return early if disabled.
@@ -490,11 +498,7 @@ __maybe_unused static int __ksu_handle_execve_ksud(const char __user *filename_u
490498
memset(path, 0, sizeof(path));
491499
ksu_strncpy_from_user_nofault(path, filename_user, 32);
492500

493-
// this is because ksu_handle_execveat_ksud calls it filename->name
494-
filename_in.name = path;
495-
filename_p = &filename_in;
496-
497-
return ksu_handle_execveat_ksud(AT_FDCWD, &filename_p, argv, NULL, NULL);
501+
return __ksu_handle_execveat_ksud(AT_FDCWD, path, argv, NULL, NULL);
498502
}
499503

500504
// I don't think this is doable with a single entry point

0 commit comments

Comments
 (0)