`set_brk` kallsym seems to have disappeared

[d1sgr4c3]

i discovered this glitch earlier:

[Crasher][DEBUG]07-03 14:29 Connecting ssh...
[Crasher][DEBUG]07-03 14:29 Bootstrap system...
[Crasher][DEBUG]07-03 14:29 Uploading exp...
Traceback (most recent call last):
  File "/RetSpill/igni/analyzer.py", line 446, in <module>
    analyzer.get_raw_info()
  File "/RetSpill/igni/analyzer.py", line 232, in get_raw_info
    self.symbols = crasher.extract_symbols()
  File "/RetSpill/igni/crasher.py", line 264, in extract_symbols
    raise ValueError(f"Fail to find '{name}' from kallsym, please provide it manually")
ValueError: Fail to find 'set_brk' from kallsym, please provide it manually

ofc i double-checked this manually, but it looks like set_brk has been removed

at least in this one: 319addc2ad901dac4d6cc931d77ef35073e0942f v6.12.7

https://lore.kernel.org/all/2025052237-condiment-professor-63ee@gregkh/

[Kyle-Kyle]

Hi. The purpose of the set_brk function is to derive the offset of "current_task". I think it can be done using other functions as well.
I'll see whether I can find another simple function to achieve the same thing in a bit.

[d1sgr4c3]

thank you, @Kyle-Kyle! will be waiting for your reply

by the way, i am ready to contribute, will be glad to do something cool together if you ok with that!

[Kyle-Kyle]

Hi @d1sgr4c3 , this project is definitely open to PRs. I'm excited to see your patches!

[d1sgr4c3]

@Kyle-Kyle, look what i have:

while trying to "disassemble" (well-understand) your analyzer.py i built some 5x kernel and saw the purpose:

 ► 0xffffffff8125ccd2 <set_brk+34>    mov    rax, qword ptr gs:[0x16d00]  

In file: xxx/linux-5.14.15/arch/x86/include/asm/current.h:15
 
   13 static __always_inline struct task_struct *get_current(void)
   14 {
 ► 15         return this_cpu_read_stable(current_task);
   16 }

however, arch/x86/include/asm/current.h is changed a bit
i used to break here a couple of times and what i saw:

──────────────[ DISASM / x86-64 / set emulate on ]───────────
 ► 0xffffffff81120394 <__rcu_read_lock+4>                          mov    rdx, qword ptr gs:[rip + 0x7ef0c464]     RDX, [0xffff88813bc2c800] => 0xffffffff82a0c940 (init_task) ◂— 0xffffffff82a0c940
   0xffffffff8112039c <__rcu_read_lock+12>                         mov    eax, dword ptr [rdx + 0x3fc]
   0xffffffff811203a2 <__rcu_read_lock+18>                         add    eax, 1
   0xffffffff811203a5 <__rcu_read_lock+21>                         mov    dword ptr [rdx + 0x3fc], eax
   0xffffffff811203ab <__rcu_read_lock+27>                         ret    
 
   0xffffffff811203ac <__rcu_read_lock+28>                         int3   
──────────────────[ SOURCE (CODE) ]───────────────────
In file: xxx/linux-stable/arch/x86/include/asm/current.h:47
   44 static __always_inline struct task_struct *get_current(void)
   45 {
   46         if (IS_ENABLED(CONFIG_USE_X86_SEG_SUPPORT))
 ► 47                 return this_cpu_read_const(const_pcpu_hot.current_task);
   48 
   49         return this_cpu_read_stable(pcpu_hot.current_task);
   50 }

the most interesting part of this instruction is "mov rdx, qword ptr gs:[rip + 0x7ef0c464]". I've checked about 50 steps. every time I click on the breakpoint, this pattern always appears "[rip +0x7ef5be03]"
of course, I tried to calculate the value several times when I clicked on this instruction, and each time I got

pwndbg> p/x $rip +0x7ef0c464
$6 = 0x2c7f8

this. _ moreover, this value is constant.__ and this seems to be what we need to find (since we know rip (just the address where this plugin is hosted + offset)

so, what do you think?

[Kyle-Kyle]

yeah. I just checked one 6.8 kernel and indeed, the constant offset is somehow represented by rip+<value>. I'm not sure which function you examined, but I found two functions you can use. One is the setpriority syscall, the other is the d_path function.

[Kyle-Kyle]

And to clearly answer your question: yes, that is the offset we want to use.