SlabDbg
GDB plug-in that makes it easier to develop Linux kernel exploits targeting the SLUB allocator. It displays the content of slab caches and allows to set breakpoints on allocation/free operations.
Installation
No installation, simply typing source slabdbg.py should be enough to get you started.
Usage
Usage:
slab list - Display simple information about all slab caches
slab info <name> - Display extended information about a slab cache
slab trace <name> - Start/stop tracing allocations for a slab cache
slab break <name> - Start/stop breaking on allocation for a slab cache
slab watch <name> - Start/stop watching full-slabs for a slab cache
slab print <slab> - Print the objects contained in a slab
Examples
List all slab caches
(gdb) slab list
name objs inuse slabs size obj_size objs_per_slab pages_per_slab
ext4_groupinfo_4k 28 28 1 144 144 28 1
ip6_dst_cache 10 1 1 384 384 10 1
UDPLITEv6 0 0 0 1088 1072 -1 -1
UDPv6 15 0 1 1088 1072 15 4
tw_sock_TCPv6 0 0 0 272 264 -1 -1
request_sock_TCPv6 0 0 0 328 320 -1 -1
TCPv6 0 0 0 2048 2032 -1 -1
nf_conntrack_1 0 0 0 320 312 -1 -1
ashmem_area_cache 13 3 1 312 312 13 1
---Type <return> to continue, or q <return> to quit---q
Print info about a slab cache
(gdb) slab info kmalloc-8192
Slab Cache @ 0xffffffc03a801800:
Name: kmalloc-8192
Flags: (none)
Offset: 0
Size: 8192
Object Size: 8192
Per-CPU Data @ 0xffffffc03ffe0020:
Freelist: 0xffffffc01b12a000
Page: Slab @ 0xffffffbdc06c4a00:
Objects: 4
In-Use: 4
Frozen: 1
Freelist: 0x0
Page @ 0xffffffc01b128000:
- Object (inuse) @ 0xffffffc01b128000
- Object (free) @ 0xffffffc01b12a000
- Object (inuse) @ 0xffffffc01b12c000
- Object (inuse) @ 0xffffffc01b12e000
Partial List:
- Slab @ 0xffffffbdc0e18800:
Objects: 4
In-Use: 0
Frozen: 1
Freelist: 0xffffffc038622000
Page @ 0xffffffc038620000:
- Object (inuse) @ 0xffffffc038620000
- Object (inuse) @ 0xffffffc038622000
- Object (inuse) @ 0xffffffc038624000
- Object (inuse) @ 0xffffffc038626000
- Slab @ 0xffffffbdc0e3a800:
Objects: 4
In-Use: 2
Frozen: 1
Freelist: 0xffffffc038ea2000
Page @ 0xffffffc038ea0000:
- Object (inuse) @ 0xffffffc038ea0000
- Object (inuse) @ 0xffffffc038ea2000
- Object (inuse) @ 0xffffffc038ea4000
- Object (inuse) @ 0xffffffc038ea6000
- Slab @ 0xffffffbdc0e3ca00:
Objects: 4
In-Use: 2
Frozen: 1
Freelist: 0xffffffc038f2e000
Page @ 0xffffffc038f28000:
- Object (inuse) @ 0xffffffc038f28000
- Object (inuse) @ 0xffffffc038f2a000
- Object (inuse) @ 0xffffffc038f2c000
- Object (inuse) @ 0xffffffc038f2e000
Per-Node Data @ 0xffffffc03a800c80:
Partial List: (none)
Full List: (none)
Trace alloc/free for a slab cache
(gdb) slab trace kmalloc-128
Started tracing slab cache
(gdb) c
Continuing.
Object 0xffffffc038503c00 allocated in kmalloc-128
Object 0xffffffc01d5c7d00 allocated in kmalloc-128
Object 0xffffffc01d5c7280 allocated in kmalloc-128
Object 0xffffffc038fee780 freed in kmalloc-128
Object 0xffffffc038fee700 freed in kmalloc-128
Object 0xffffffc038fee000 freed in kmalloc-128
Object 0xffffffc03853f000 allocated in kmalloc-128
Object 0xffffffc01d5c7c80 allocated in kmalloc-128
Object 0xffffffc038117200 allocated in kmalloc-128
Break on alloc/free for a slab cache
(gdb) slab break kmalloc-128
Started breaking on slab cache
(gdb) c
Continuing.
Breakpoint -2, kmem_cache_free (s=0xffffffc03a801e00, x=0xffffffc038503c00) at mm/slub.c:2877
2877 {
Print the content of a slab
(gdb) slab print 0xffffffbdc0e3ca00
Slab @ 0xffffffbdc0e3ca00:
Objects: 4
In-Use: 2
Frozen: 1
Freelist: 0xffffffc038f2e000
Page @ 0xffffffc038f28000:
- Object (inuse) @ 0xffffffc038f28000
- Object (inuse) @ 0xffffffc038f2a000
- Object (free) @ 0xffffffc038f2c000
- Object (free) @ 0xffffffc038f2e000
Watch the full slabs of a slab cache
(gdb) slab watch kmalloc-8192
Started watching slab cache 'kmalloc-8192'
(gdb) c
Continuing.
(gdb) slab info kmalloc-8192
Slab Cache @ 0xffffffc03a801800:
Name: kmalloc-8192
Flags: (none)
Offset: 0
Size: 8192
Object Size: 8192
Per-CPU Data @ 0xffffffc03ffe0020:
Freelist: 0xffffffc038d0a000
Page: Slab @ 0xffffffbdc0e34200:
Objects: 4
In-Use: 4
Frozen: 1
Freelist: 0x0
Page @ 0xffffffc038d08000:
- Object (inuse) @ 0xffffffc038d08000
- Object (free) @ 0xffffffc038d0a000
- Object (free) @ 0xffffffc038d0c000
- Object (free) @ 0xffffffc038d0e000
Partial List: (none)
Per-Node Data @ 0xffffffc03a800c80:
Partial List: (none)
Full List:
- Slab @ 0xffffffbdc0e6d000:
Objects: 4
In-Use: 4
Frozen: 0
Freelist: 0x0
Page @ 0xffffffc039b40000:
- Object (inuse) @ 0xffffffc039b40000
- Object (inuse) @ 0xffffffc039b42000
- Object (inuse) @ 0xffffffc039b44000
- Object (inuse) @ 0xffffffc039b46000
---Type <return> to continue, or q <return> to quit---q
Disclaimer
I have only tested it on the official Android emulator running an arm64 system image and a manually compiled kernel.