Aprenda Managing Buffers Safely | Kernel Memory and Data Handling

Buffer overflows are a frequent source of bugs and vulnerabilities in kernel development. They occur when a program writes more data to a buffer than it can hold, corrupting adjacent memory and potentially leading to system crashes or security flaws. To prevent these issues, always allocate buffers with care, ensuring their size is sufficient for the intended data, and perform strict bounds checking before reading from or writing to them.

safe_buffer.c


              12345678910111213141516171819202122232425262728293031323334353637383940414243444546
            
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/slab.h>

#define BUFFER_SIZE 128

static int __init safe_buffer_init(void)
{
    char *buffer;
    size_t i;
    size_t data_len = 120; // Example data length to write

    // Safe allocation
    buffer = kmalloc(BUFFER_SIZE, GFP_KERNEL);
    if (!buffer) {
        pr_alert("Failed to allocate buffer\n");
        return -ENOMEM;
    }

    // Bounds checking before writing
    if (data_len < BUFFER_SIZE) {
        for (i = 0; i < data_len; i++) {
            buffer[i] = 'A';
        }
        buffer[data_len] = '\0';
        pr_info("Buffer safely written: %s\n", buffer);
    } else {
        pr_alert("Data length exceeds buffer size!\n");
    }

    kfree(buffer);
    return 0;
}

static void __exit safe_buffer_exit(void)
{
    pr_info("Safe buffer module exit\n");
}

module_init(safe_buffer_init);
module_exit(safe_buffer_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Kernel Course");
MODULE_DESCRIPTION("Safe buffer allocation and bounds checking example");

Circular buffers are a common structure used in device drivers for efficiently handling streams of data. They allow data to be written and read in a continuous loop, avoiding the need for shifting data as elements are removed. When implementing a circular buffer, apply the same safe allocation and bounds checking principles shown earlier. This ensures you never overwrite unread data or read beyond the valid range, keeping your buffer management robust and error-free.

circular_buffer_example.c


              123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657
            
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/slab.h>

#define CIRCULAR_BUF_SIZE 64

struct circ_buffer {
    char *buf;
    size_t head;
    size_t tail;
};

static struct circ_buffer circ;

static int __init circbuf_init(void)
{
    circ.buf = kmalloc(CIRCULAR_BUF_SIZE, GFP_KERNEL);
    if (!circ.buf) {
        pr_alert("Failed to allocate circular buffer\n");
        return -ENOMEM;
    }
    circ.head = circ.tail = 0;

    // Write data safely
    if ((circ.head + 1) % CIRCULAR_BUF_SIZE != circ.tail) {
        circ.buf[circ.head] = 'X';
        circ.head = (circ.head + 1) % CIRCULAR_BUF_SIZE;
        pr_info("Wrote 'X' to circular buffer\n");
    } else {
        pr_alert("Circular buffer is full\n");
    }

    // Read data safely
    if (circ.head != circ.tail) {
        char val = circ.buf[circ.tail];
        circ.tail = (circ.tail + 1) % CIRCULAR_BUF_SIZE;
        pr_info("Read '%c' from circular buffer\n", val);
    } else {
        pr_alert("Circular buffer is empty\n");
    }

    kfree(circ.buf);
    return 0;
}

static void __exit circbuf_exit(void)
{
    pr_info("Circular buffer module exit\n");
}

module_init(circbuf_init);
module_exit(circbuf_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Kernel Course");
MODULE_DESCRIPTION("Simple circular buffer implementation");

Tudo estava claro?

Obrigado pelo seu feedback!

Seção 3. Capítulo 3

Pergunte à IA

Pergunte o que quiser ou experimente uma das perguntas sugeridas para iniciar nosso bate-papo

Deslize para mostrar o menu

safe_buffer.c


              12345678910111213141516171819202122232425262728293031323334353637383940414243444546
            
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/slab.h>

#define BUFFER_SIZE 128

static int __init safe_buffer_init(void)
{
    char *buffer;
    size_t i;
    size_t data_len = 120; // Example data length to write

    // Safe allocation
    buffer = kmalloc(BUFFER_SIZE, GFP_KERNEL);
    if (!buffer) {
        pr_alert("Failed to allocate buffer\n");
        return -ENOMEM;
    }

    // Bounds checking before writing
    if (data_len < BUFFER_SIZE) {
        for (i = 0; i < data_len; i++) {
            buffer[i] = 'A';
        }
        buffer[data_len] = '\0';
        pr_info("Buffer safely written: %s\n", buffer);
    } else {
        pr_alert("Data length exceeds buffer size!\n");
    }

    kfree(buffer);
    return 0;
}

static void __exit safe_buffer_exit(void)
{
    pr_info("Safe buffer module exit\n");
}

module_init(safe_buffer_init);
module_exit(safe_buffer_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Kernel Course");
MODULE_DESCRIPTION("Safe buffer allocation and bounds checking example");

circular_buffer_example.c


              123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657
            
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/slab.h>

#define CIRCULAR_BUF_SIZE 64

struct circ_buffer {
    char *buf;
    size_t head;
    size_t tail;
};

static struct circ_buffer circ;

static int __init circbuf_init(void)
{
    circ.buf = kmalloc(CIRCULAR_BUF_SIZE, GFP_KERNEL);
    if (!circ.buf) {
        pr_alert("Failed to allocate circular buffer\n");
        return -ENOMEM;
    }
    circ.head = circ.tail = 0;

    // Write data safely
    if ((circ.head + 1) % CIRCULAR_BUF_SIZE != circ.tail) {
        circ.buf[circ.head] = 'X';
        circ.head = (circ.head + 1) % CIRCULAR_BUF_SIZE;
        pr_info("Wrote 'X' to circular buffer\n");
    } else {
        pr_alert("Circular buffer is full\n");
    }

    // Read data safely
    if (circ.head != circ.tail) {
        char val = circ.buf[circ.tail];
        circ.tail = (circ.tail + 1) % CIRCULAR_BUF_SIZE;
        pr_info("Read '%c' from circular buffer\n", val);
    } else {
        pr_alert("Circular buffer is empty\n");
    }

    kfree(circ.buf);
    return 0;
}

static void __exit circbuf_exit(void)
{
    pr_info("Circular buffer module exit\n");
}

module_init(circbuf_init);
module_exit(circbuf_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Kernel Course");
MODULE_DESCRIPTION("Simple circular buffer implementation");

Tudo estava claro?

Obrigado pelo seu feedback!

Seção 3. Capítulo 3