控制内核中的函数指针

Question

If I have controlled a function pointer in the kernel pointing to somewhere I want, let's make it point to my own designed function evil in the user land.

err = writepage(page) //->writepage is a kernel function pointer pointing to a evil in the userland

There is only a printf in evil , will there be kernel panic if the kernel dereferences that function pointer? Since evil runs in the kernel mode (correct me if I'm wrong), but kernel does not what printf is.

int evil() {
   printf("I don't think printf will be executed because evil is executed is kernel mode")
}

Answer 1

The kernel never sees " printf "; it sees a call to a different address, just like the program doesn't call that function by its name, but sets up registers containing parameters accordingly and calls that function.

That won't work, because the address that the printf call points to is relative to the userland process' memory, and doesn't exist in kernel memory.

You have to realize that processes run in a virtual memory of their own -- none of the addresses used in a program need to make sense for a different process.

So you can't even just call a function in a userland process; you'd first have to find out where that is in memory as the kernel sees it, and then call it. Of course, it'd then run in kernel mode, but that's not surprising -- no sane OS would allow a userland process to bend internal function calls in that manner.