fstat（）在预加载的mmap（）系统调用中无法按预期工作

Question

I am trying to get the device minor and major numbers from fstat() . The call to fstat() is done inside a preloaded mmap() system call:

// preload.so
// compile with:
// gcc  -ldl -Wall -shared -fPIC -o preload.so -D_GNU_SOURCE preload.c
#include <stdlib.h>
#include <stdarg.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <dlfcn.h>
#include <unistd.h>
#include <stdio.h>
#include <sys/stat.h>

#if __GNUC__ >= 4
#define PUBLIC __attribute__ ((visibility("default")))
#else
#define PUBLIC
#endif

PUBLIC void *mmap(void *start, size_t length, int prot, int flags, int fd, off_t offset) {
    printf("preload\n");

    struct stat sb;
    if (fstat(fd, &sb) == -1)
        printf("fstat() failed\n");
    else 
        printf("%u %u\n", major(sb.st_rdev), minor(sb.st_rdev));

    typedef void*(*mmap_t)(void *, size_t, int, int, int, off_t);
    mmap_t o_mmap = dlsym(RTLD_NEXT, "mmap");
    return (*o_mmap)(start, length, prot, flags, fd, offset);
}

The above library can then intercept any mmap() system call from any given program:

$ LD_PRELOAD=./preload.so ./my_prog

Why do I keep obtaining 0 and 0 as major and minor number, although my_prog attempts to mmap() a device after opening a real device node?

Is there any way to obtain the major and minor numbers from within the preloaded mmap() system call without any other informations except the arguments passed to the function itself?

Answer 1

mmap() will be called by a lot of other code as well, eg

• To load/map shared libraries.
• To obtain anonymous memory (eg malloc() might call mmap to obtain more memory)

In the first case, the mmap()'ed file is just a regular file, and will have have a minor/major of 0. In the second case, the fd passed in is not a valid fd - the app should pass -1 as the fd, but it might not..

You're likely seeing these mmap() calls from the runtime and indirectly from other library calls your application does, not just the mmap() call of a device that your app does.

On eg Linux/glibc, and possibly other systems as well, I'd presume an mmap() call could be compiled to call mmap64() instead, depending on compiler flags that's used to enable large file support. You might need to intercept mmap64() as well as mmap()

It's unclear what you're really trying to do, but you could

• check that fd is not -1
• check that the flags does not contain MAP_ANONYMOUS
• then perform fstat.
• check the struct stat .st_mode for S_ISCHR() or S_ISBLK() (see the stat man page) to know if mmap() was for a device file
• if the sb.st_rdev is for the major/minor number your interested in, take action.