carloslack / KoviD

Linux kernel rootkit
Other
283 stars 54 forks source link

Linux 6.1.x kernel mm_struct changes, no struct vm_area_struct *mmap causes compilation failure #83

Closed fordskyle888 closed 7 months ago

fordskyle888 commented 11 months ago

Test on VERSION "22.04.2 LTS (Jammy Jellyfish)" kernel info : 6.2.0-1017-aws #17~22.04.1-Ubuntu SMP Fri Nov 17 21:07:13 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

make fail messages is:

  The kernel was built by: x86_64-linux-gnu-gcc-11 (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0
  You are using:           gcc-11 (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0
  CC [M]  /root/.acme.sh/KoviD/src/vm.o
In file included from /root/.acme.sh/KoviD/src/vm.c:4:
/root/.acme.sh/KoviD/src/lkm.h:12:9: note: ‘#pragma message: !!! Be careful: Build kovid in DEBUG mode !!!’
   12 | #pragma message "!!! Be careful: Build kovid in DEBUG mode !!!"
      |         ^~~~~~~
/root/.acme.sh/KoviD/src/vm.c: In function ‘kv_get_elf_vm_start’:
/root/.acme.sh/KoviD/src/vm.c:34:18: error: ‘struct mm_struct’ has no member named ‘mmap’
   34 |     vma = tsk->mm->mmap;
      |                  ^~
make[2]: *** [scripts/Makefile.build:260: /root/.acme.sh/KoviD/src/vm.o] Error 1
make[1]: *** [Makefile:2026: /root/.acme.sh/KoviD] Error 2
make[1]: Leaving directory '/usr/src/linux-headers-6.2.0-1017-aws'
make: *** [Makefile:30: all] Error 2
carloslack commented 11 months ago

Hi @fordskyle888 , firstly, thanks for reporting that.

Kernel 6+ is not currently supported in kv, I would be surprised if it did work without some work. Said that, mmap struct member was replaced, from kernel 6.1 by maple tree, so it is not directly accessed via mm_struct as it was before that.

Changes started in the kernel 6.1 form commit hash d4af56c5c7c6781ca6ca8075e2cf5bc119ed33d1, with the addition of the maple_tree to mm_struct -> mm_mt

When I start porting to 6+ I will keep that in mind, hence I will keep this issue open as a reminder. Thanks again (btw if you fancy to port it yourself please create a PR for kv, would be much appreciated)

carloslack commented 7 months ago

closing this for now, when I start porting to 6.x I will hit this issue anyway.