[关闭]
@H4l0 2019-06-16T02:59:59.000000Z 字数 12753 阅读 1672

glibc 代码阅读

源代码分析

前言

分析一下 free 函数过程的代码，在分析时如果遇到 pwn 中可以利用的点会概括一下利用思路。

free

与 free 函数相关的代码

  1. free -> __libc_free -> _int_free

__libc_free 函数

整体代码：

  1. void
  2. __libc_free (void *mem)
  3. {
  4.   mstate ar_ptr;
  5.   mchunkptr p;                          /* chunk corresponding to mem */
  6.   void (*hook) (void *, const void *)
  7.     = atomic_forced_read (__free_hook);
  8.   if (__builtin_expect (hook != NULL, 0))
  9.     {
  10.       (*hook)(mem, RETURN_ADDRESS (0));
  11.       return;
  12.     }
  13.   if (mem == 0)                              /* free(0) has no effect */
  14.     return;
  15.   p = mem2chunk (mem);
  16.   if (chunk_is_mmapped (p))                       /* release mmapped memory. */
  17.     {
  18.       /* See if the dynamic brk/mmap threshold needs adjusting.
  19.          Dumped fake mmapped chunks do not affect the threshold.  */
  20.       if (!mp_.no_dyn_threshold
  21.           && chunksize_nomask (p) > mp_.mmap_threshold
  22.           && chunksize_nomask (p) <= DEFAULT_MMAP_THRESHOLD_MAX
  23.           && !DUMPED_MAIN_ARENA_CHUNK (p))
  24.         {
  25.           mp_.mmap_threshold = chunksize (p);
  26.           mp_.trim_threshold = 2 * mp_.mmap_threshold;
  27.           LIBC_PROBE (memory_mallopt_free_dyn_thresholds, 2,
  28.                       mp_.mmap_threshold, mp_.trim_threshold);
  29.         }
  30.       munmap_chunk (p);
  31.       return;
  32.     }
  33.   MAYBE_INIT_TCACHE ();
  34.   ar_ptr = arena_for_chunk (p);
  35.   _int_free (ar_ptr, p, 0);
  36. }

传入的参数

  1. void *mem    // 通用类型的指针，指向 memory 区域

函数处理步骤

  1. 定义的两个变量：
  1.   mstate ar_ptr;        // 指向 malloc_state 结构体的指针
  2.   mchunkptr p;          //

malloc_state 的定义：

  1. typedef struct malloc_state *mstate;
  3. struct malloc_state
  4. {
  5.   /* Serialize access.  */
  6.   __libc_lock_define (, mutex);
  7.   /* Flags (formerly in max_fast).  */
  8.   int flags;
  9.   /* Set if the fastbin chunks contain recently inserted free blocks.  */
  10.   /* Note this is a bool but not all targets support atomics on booleans.  */
  11.   int have_fastchunks;
  12.   /* Fastbins */
  13.   mfastbinptr fastbinsY[NFASTBINS];
  14.   /* Base of the topmost chunk -- not otherwise kept in a bin */
  15.   mchunkptr top;
  16.   /* The remainder from the most recent split of a small request */
  17.   mchunkptr last_remainder;
  18.   /* Normal bins packed as described above */
  19.   mchunkptr bins[NBINS * 2 - 2];
  20.   /* Bitmap of bins */
  21.   unsigned int binmap[BINMAPSIZE];
  22.   /* Linked list */
  23.   struct malloc_state *next;
  24.   /* Linked list for free arenas.  Access to this field is serialized
  25.      by free_list_lock in arena.c.  */
  26.   struct malloc_state *next_free;
  27.   /* Number of threads attached to this arena.  0 if the arena is on
  28.      the free list.  Access to this field is serialized by
  29.      free_list_lock in arena.c.  */
  30.   INTERNAL_SIZE_T attached_threads;
  31.   /* Memory allocated from the system in this arena.  */
  32.   INTERNAL_SIZE_T system_mem;
  33.   INTERNAL_SIZE_T max_system_mem;
  34. };

mchunkptr 为指向 malloc_chunk 结构体的指针

  1. typedef struct malloc_chunk* mchunkptr;
  3. struct malloc_chunk {
  4.   INTERNAL_SIZE_T      mchunk_prev_size;  /* Size of previous chunk (if free).  */
  5.   INTERNAL_SIZE_T      mchunk_size;       /* Size in bytes, including overhead. */
  6.   struct malloc_chunk* fd;         /* double links -- used only if free. */
  7.   struct malloc_chunk* bk;
  8.   /* Only used for large blocks: pointer to next larger size.  */
  9.   struct malloc_chunk* fd_nextsize; /* double links -- used only if free. */
  10.   struct malloc_chunk* bk_nextsize;
  11. };

2 . 定义一个 hook 的函数指针，将 __free_hook 函数指针赋值给他。

  1.   void (*hook) (void *, const void *)
  2.     = atomic_forced_read (__free_hook);
  3.   if (__builtin_expect (hook != NULL, 0))
  4.     {
  5.       (*hook)(mem, RETURN_ADDRESS (0));
  6.       return;
  7.     }

如果 (*hook) 的值不为空就执行函数，参数为 mem 指针，和一个返回地址的定义。

  1. #define RETURN_ADDRESS(nr) \
  2.   __builtin_extract_return_addr (__builtin_return_address (nr))

__free_hook 默认是一个空指针。同样是定义在 malloc.c 中

  1. void weak_variable (*__free_hook) (void *__ptr,const void *) = NULL;

3 . 判断 mem 是不是一个指针，如果指向 0 继续 free 的话是无影响的。

同时通过 mem2chunk 函数取得传入的 mem 对应的 chunk 的指针给变量 p。

  1. if (mem == 0)                              /* free(0) has no effect */
  2.     return;
  3.   p = mem2chunk (mem);

mem2chunk 函数的定义：

  1. #define mem2chunk(mem) ((mchunkptr)((char*)(mem) - 2*SIZE_SZ))

这里定义的比较清楚了，拿到 mem 的指针（void *）转换为 char 类型的指针（1 字节），减去 prev_size 和 size 的大小，就得到了指向当前 chunk 的指针。

也就是和下面表示的从 mem 指针到 chunk 指针的过程一样。

  1.     chunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  2.             |             Size of previous chunk, if unallocated (P clear)  |
  3.             +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  4.             |             Size of chunk, in bytes                     |A|M|P|
  5.       mem-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

4 . 检查 p 是否为 mmap 映射过来的内存区域

  1.   if (chunk_is_mmapped (p))                       /* release mmapped memory. */
  2.     {
  3.       /* See if the dynamic brk/mmap threshold needs adjusting.
  4.          Dumped fake mmapped chunks do not affect the threshold.  */
  5.       if (!mp_.no_dyn_threshold
  6.           && chunksize_nomask (p) > mp_.mmap_threshold
  7.           && chunksize_nomask (p) <= DEFAULT_MMAP_THRESHOLD_MAX
  8.           && !DUMPED_MAIN_ARENA_CHUNK (p))
  9.         {
  10.           mp_.mmap_threshold = chunksize (p);
  11.           mp_.trim_threshold = 2 * mp_.mmap_threshold;
  12.           LIBC_PROBE (memory_mallopt_free_dyn_thresholds, 2,
  13.                       mp_.mmap_threshold, mp_.trim_threshold);
  14.         }
  15.       munmap_chunk (p);

如果根据 size 区域的 M 指示确实是 mmap 的内存的话，经过一系列的判断就调用 munmap_chunk 函数来 free 掉这块内存。

  1. #define IS_MMAPPED 0x2 /* check for mmap()'ed chunk */
  2. #define chunk_is_mmapped(p) ((p)->mchunk_size & IS_MMAPPED)

通过 p 结构体指针拿到他的 size 的值，与 0x2 直接异或，如果不为 0 就说明是 M 标志是 1，也就是通过 mmap 分配过来的内存。

判断的条件涉及到的东西太多就暂时不看了。

跟进 munmap_chunk 函数

直接看 munmap_chunk 函数的定义：

  1. munmap_chunk (mchunkptr p)
  2. {
  3.   size_t pagesize = GLRO (dl_pagesize);
  4.   INTERNAL_SIZE_T size = chunksize (p);
  5.   assert (chunk_is_mmapped (p));
  6.   /* Do nothing if the chunk is a faked mmapped chunk in the dumped
  7.      main arena.  We never free this memory.  */
  8.   if (DUMPED_MAIN_ARENA_CHUNK (p))
  9.     return;
  10.   uintptr_t mem = (uintptr_t) chunk2mem (p);
  11.   uintptr_t block = (uintptr_t) p - prev_size (p);
  12.   size_t total_size = prev_size (p) + size;
  13.   /* Unfortunately we have to do the compilers job by hand here.  Normally
  14.      we would test BLOCK and TOTAL-SIZE separately for compliance with the
  15.      page size.  But gcc does not recognize the optimization possibility
  16.      (in the moment at least) so we combine the two values into one before
  17.      the bit test.  */
  18.   if (__glibc_unlikely ((block | total_size) & (pagesize - 1)) != 0
  19.       || __glibc_unlikely (!powerof2 (mem & (pagesize - 1))))
  20.     malloc_printerr ("munmap_chunk(): invalid pointer");
  21.   atomic_decrement (&mp_.n_mmaps);
  22.   atomic_add (&mp_.mmapped_mem, -total_size);
  23.   /* If munmap failed the process virtual memory address space is in a
  24.      bad shape.  Just leave the block hanging around, the process will
  25.      terminate shortly anyway since not much can be done.  */
  26.   __munmap ((char *) block, total_size);
  27. }

前面也是两个定义：

获取 pagesize 和 chunk 的 size 的大小。

  1.   size_t pagesize = GLRO (dl_pagesize);
  2.   INTERNAL_SIZE_T size = chunksize (p);

获取 chunk 的 mem 指针，并获取上一个 chunk 的地址和这两个 chunk 总的大小（total_size），看样子要进行合并操作。

  1.   uintptr_t mem = (uintptr_t) chunk2mem (p);
  2.   uintptr_t block = (uintptr_t) p - prev_size (p);
  3.   size_t total_size = prev_size (p) + size;
  5.   typedef unsigned long int        uintptr_t;

合法性判断：

  1.   if (__glibc_unlikely ((block | total_size) & (pagesize - 1)) != 0
  2.       || __glibc_unlikely (!powerof2 (mem & (pagesize - 1))))
  3.     malloc_printerr ("munmap_chunk(): invalid pointer");
  5. # define __glibc_unlikely(cond)        __builtin_expect ((cond), 0)

具体的步骤太复杂了，大概意思就是减少 mmap 的内存大小，从函数名字也可以看得出来。

  1.   atomic_decrement (&mp_.n_mmaps);
  2.   atomic_add (&mp_.mmapped_mem, -total_size);

错误判断。

  1. __munmap ((char *) block, total_size);
  3. int
  4. __munmap (void *addr, size_t len)
  5. {
  6.   __set_errno (ENOSYS);
  7.   return -1;
  8. }

所以这里主要对 mmap 进行操作就是 atomic_decrement、atomic_add 这两个函数。

5 . 回到 __libc_free 函数中继续往下

这里涉及到 tcache 机制的就暂时先不看了。

  1. MAYBE_INIT_TCACHE ();       // 判断是否使用 tcache ，存在的话就调用 tcache_init() 进行初始化

检查这个块是不是位于主分配区，如果是的话就拿到 main_arena 的地址。

  1. ar_ptr = arena_for_chunk (p);
  3. #define arena_for_chunk(ptr) \
  4.   (chunk_main_arena (ptr) ? &main_arena : heap_for_ptr (ptr)->ar_ptr)

将 ar_ptr，p 传入 _int_free 中，交给 _int_free 处理。

  1. _int_free (ar_ptr, p, 0);

小总结

至此，__libc_free 函数的代码就大概分析完了，总结一下他做了什么事。
1. 判断 __free_hook 是否存在（pwn 中经常通过写 one_gadget 到这里触发）
2. 判读是不是 mmap 过来的区域，是的话直接就交给 munmap_chunk 处理了。
3. 各种检查性判断。

_int_free 函数

整体代码：

  1. static void
  2. _int_free (mstate av, mchunkptr p, int have_lock)
  3. {
  4.   INTERNAL_SIZE_T size;        /* its size */
  5.   mfastbinptr *fb;             /* associated fastbin */
  6.   mchunkptr nextchunk;         /* next contiguous chunk */
  7.   INTERNAL_SIZE_T nextsize;    /* its size */
  8.   int nextinuse;               /* true if nextchunk is used */
  9.   INTERNAL_SIZE_T prevsize;    /* size of previous contiguous chunk */
  10.   mchunkptr bck;               /* misc temp for linking */
  11.   mchunkptr fwd;               /* misc temp for linking */
  12.   size = chunksize (p);
  13.   /* Little security check which won't hurt performance: the
  14.      allocator never wrapps around at the end of the address space.
  15.      Therefore we can exclude some size values which might appear
  16.      here by accident or by "design" from some intruder.  */
  17.   if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)
  18.       || __builtin_expect (misaligned_chunk (p), 0))
  19.     malloc_printerr ("free(): invalid pointer");
  20.   /* We know that each chunk is at least MINSIZE bytes in size or a
  21.      multiple of MALLOC_ALIGNMENT.  */
  22.   if (__glibc_unlikely (size < MINSIZE || !aligned_OK (size)))
  23.     malloc_printerr ("free(): invalid size");
  24.   check_inuse_chunk(av, p);
  28. ......
  31.   /*
  32.     If eligible, place chunk on a fastbin so it can be found
  33.     and used quickly in malloc.
  34.   */
  35.   if ((unsigned long)(size) <= (unsigned long)(get_max_fast ())
  36. #if TRIM_FASTBINS
  37.       /*
  38.         If TRIM_FASTBINS set, don't place chunks
  39.         bordering top into fastbins
  40.       */
  41.       && (chunk_at_offset(p, size) != av->top)
  42. #endif
  43.       ) {
  44.     if (__builtin_expect (chunksize_nomask (chunk_at_offset (p, size))
  45.                           <= 2 * SIZE_SZ, 0)
  46.         || __builtin_expect (chunksize (chunk_at_offset (p, size))
  47.                              >= av->system_mem, 0))
  48.       {
  49.         bool fail = true;
  50.         /* We might not have a lock at this point and concurrent modifications
  51.            of system_mem might result in a false positive.  Redo the test after
  52.            getting the lock.  */
  53.         if (!have_lock)
  54.           {
  55.             __libc_lock_lock (av->mutex);
  56.             fail = (chunksize_nomask (chunk_at_offset (p, size)) <= 2 * SIZE_SZ
  57.                     || chunksize (chunk_at_offset (p, size)) >= av->system_mem);
  58.             __libc_lock_unlock (av->mutex);
  59.           }
  60.         if (fail)
  61.           malloc_printerr ("free(): invalid next size (fast)");
  62.       }
  63.     free_perturb (chunk2mem(p), size - 2 * SIZE_SZ);
  64.     atomic_store_relaxed (&av->have_fastchunks, true);
  65.     unsigned int idx = fastbin_index(size);
  66.     fb = &fastbin (av, idx);
  67.     /* Atomically link P to its fastbin: P->FD = *FB; *FB = P;  */
  68.     mchunkptr old = *fb, old2;
  69.     if (SINGLE_THREAD_P)
  70.       {
  71.         /* Check that the top of the bin is not the record we are going to
  72.            add (i.e., double free).  */
  73.         if (__builtin_expect (old == p, 0))
  74.           malloc_printerr ("double free or corruption (fasttop)");
  75.         p->fd = old;
  76.         *fb = p;
  77.       }
  78.     else
  79.       do
  80.         {
  81.           /* Check that the top of the bin is not the record we are going to
  82.              add (i.e., double free).  */
  83.           if (__builtin_expect (old == p, 0))
  84.             malloc_printerr ("double free or corruption (fasttop)");
  85.           p->fd = old2 = old;
  86.         }
  87.       while ((old = catomic_compare_and_exchange_val_rel (fb, p, old2))
  88.              != old2);
  89.     /* Check that size of fastbin chunk at the top is the same as
  90.        size of the chunk that we are adding.  We can dereference OLD
  91.        only if we have the lock, otherwise it might have already been
  92.        allocated again.  */
  93.     if (have_lock && old != NULL
  94.         && __builtin_expect (fastbin_index (chunksize (old)) != idx, 0))
  95.       malloc_printerr ("invalid fastbin entry (free)");
  96.   }
  97.   /*
  98.     Consolidate other non-mmapped chunks as they arrive.
  99.   */
  100.   else if (!chunk_is_mmapped(p)) {
  101.     /* If we're single-threaded, don't lock the arena.  */
  102.     if (SINGLE_THREAD_P)
  103.       have_lock = true;
  104.     if (!have_lock)
  105.       __libc_lock_lock (av->mutex);
  106.     nextchunk = chunk_at_offset(p, size);
  107.     /* Lightweight tests: check whether the block is already the
  108.        top block.  */
  109.     if (__glibc_unlikely (p == av->top))
  110.       malloc_printerr ("double free or corruption (top)");
  111.     /* Or whether the next chunk is beyond the boundaries of the arena.  */
  112.     if (__builtin_expect (contiguous (av)
  113.                           && (char *) nextchunk
  114.                           >= ((char *) av->top + chunksize(av->top)), 0))
  115.         malloc_printerr ("double free or corruption (out)");
  116.     /* Or whether the block is actually not marked used.  */
  117.     if (__glibc_unlikely (!prev_inuse(nextchunk)))
  118.       malloc_printerr ("double free or corruption (!prev)");
  119.     nextsize = chunksize(nextchunk);
  120.     if (__builtin_expect (chunksize_nomask (nextchunk) <= 2 * SIZE_SZ, 0)
  121.         || __builtin_expect (nextsize >= av->system_mem, 0))
  122.       malloc_printerr ("free(): invalid next size (normal)");
  123.     free_perturb (chunk2mem(p), size - 2 * SIZE_SZ);
  124.     /* consolidate backward */
  125.     if (!prev_inuse(p)) {
  126.       prevsize = prev_size (p);
  127.       size += prevsize;
  128.       p = chunk_at_offset(p, -((long) prevsize));
  129.       if (__glibc_unlikely (chunksize(p) != prevsize))
  130.         malloc_printerr ("corrupted size vs. prev_size while consolidating");
  131.       unlink_chunk (av, p);
  132.     }
  133.     if (nextchunk != av->top) {
  134.       /* get and clear inuse bit */
  135.       nextinuse = inuse_bit_at_offset(nextchunk, nextsize);
  136.       /* consolidate forward */
  137.       if (!nextinuse) {
  138.         unlink_chunk (av, nextchunk);
  139.         size += nextsize;
  140.       } else
  141.         clear_inuse_bit_at_offset(nextchunk, 0);
  142.       /*
  143.         Place the chunk in unsorted chunk list. Chunks are
  144.         not placed into regular bins until after they have
  145.         been given one chance to be used in malloc.
  146.       */
  147.       bck = unsorted_chunks(av);
  148.       fwd = bck->fd;
  149.       if (__glibc_unlikely (fwd->bk != bck))
  150.         malloc_printerr ("free(): corrupted unsorted chunks");
  151.       p->fd = fwd;
  152.       p->bk = bck;
  153.       if (!in_smallbin_range(size))
  154.         {
  155.           p->fd_nextsize = NULL;
  156.           p->bk_nextsize = NULL;
  157.         }
  158.       bck->fd = p;
  159.       fwd->bk = p;
  160.       set_head(p, size | PREV_INUSE);
  161.       set_foot(p, size);
  162.       check_free_chunk(av, p);
  163.     }
  164.     /*
  165.       If the chunk borders the current high end of memory,
  166.       consolidate into top
  167.     */
  168.     else {
  169.       size += nextsize;
  170.       set_head(p, size | PREV_INUSE);
  171.       av->top = p;
  172.       check_chunk(av, p);
  173.     }
  174.     /*
  175.       If freeing a large space, consolidate possibly-surrounding
  176.       chunks. Then, if the total unused topmost memory exceeds trim
  177.       threshold, ask malloc_trim to reduce top.
  178.       Unless max_fast is 0, we don't know if there are fastbins
  179.       bordering top, so we cannot tell for sure whether threshold
  180.       has been reached unless fastbins are consolidated.  But we
  181.       don't want to consolidate on each free.  As a compromise,
  182.       consolidation is performed if FASTBIN_CONSOLIDATION_THRESHOLD
  183.       is reached.
  184.     */
  185.     if ((unsigned long)(size) >= FASTBIN_CONSOLIDATION_THRESHOLD) {
  186.       if (atomic_load_relaxed (&av->have_fastchunks))
  187.         malloc_consolidate(av);
  188.       if (av == &main_arena) {
  189. #ifndef MORECORE_CANNOT_TRIM
  190.         if ((unsigned long)(chunksize(av->top)) >=
  191.             (unsigned long)(mp_.trim_threshold))
  192.           systrim(mp_.top_pad, av);
  193. #endif
  194.       } else {
  195.         /* Always try heap_trim(), even if the top chunk is not
  196.            large, because the corresponding heap might go away.  */
  197.         heap_info *heap = heap_for_ptr(top(av));
  198.         assert(heap->ar_ptr == av);
  199.         heap_trim(heap, mp_.top_pad);
  200.       }
  201.     }
  202.     if (!have_lock)
  203.       __libc_lock_unlock (av->mutex);
  204.   }
  205.   /*
  206.     If the chunk was allocated via mmap, release via munmap().
  207.   */
  208.   else {
  209.     munmap_chunk (p);
  210.   }
  211. }

代码有些长，其中把 use_tcache 的判断都去掉了。还是一步步来看。

传入的参数

定义的变量如下，获取堆块的基本信息。

  1. INTERNAL_SIZE_T size;        /* sizeof(unsigned long int) */
  2. mfastbinptr *fb;             /* 指向 chunk 结构体的指针*/
  3.         typedef struct malloc_chunk *mfastbinptr;
  5. mchunkptr nextchunk;         /* 指向 chunk 结构体的指针 */
  6.         typedef struct malloc_chunk* mchunkptr;
  8. INTERNAL_SIZE_T nextsize;    /* sizeof(unsigned long int) */
  9. int nextinuse;               /* 指示下一个 chunk 是否是已经使用的 */
  10. INTERNAL_SIZE_T prevsize;    /* prevsize */
  11. mchunkptr bck;               /* 指向 chunk 结构体的指针，bk 指针 */
  12. mchunkptr fwd;               /* m指向 chunk 结构体的指针，fd 指针 */

函数操作步骤

  1. 获取传入的 chunk 的 size

获取除去标志位的真实 chunk 的 size 的大小。

  1. size = chunksize (p);
  2. =>
  3. #define SIZE_BITS (PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
  4. #define chunksize(p) (chunksize_nomask (p) & ~(SIZE_BITS))
  5. =>
  6. #define chunksize_nomask(p)         ((p)->mchunk_size)
添加新批注
在作者公开此批注前，只有你和作者可见。
回复批注