kernel: Allocate fake struct on heap (#3081)

aviraxp · web-flow · commit 3d73f892e126 · 2025-12-20T19:28:58.000+08:00
task_struct is typically 4000+ bytes long.
diff --git a/kernel/app_profile.c b/kernel/app_profile.c
@@ -3,6 +3,7 @@
 #include <linux/sched.h>
 #include <linux/sched/signal.h>
 #include <linux/seccomp.h>
+#include <linux/slab.h>
 #include <linux/thread_info.h>
 #include <linux/uidgid.h>
 #include <linux/version.h>
@@ -63,7 +64,14 @@ void seccomp_filter_release(struct task_struct *tsk);
 
 static void disable_seccomp(void)
 {
-    struct task_struct fake;
+    struct task_struct *fake;
+
+    fake = kmalloc(sizeof(*fake), GFP_ATOMIC);
+    if (!fake) {
+        pr_warn("failed to alloc fake task_struct\n");
+        return;
+    }
+
     // Refer to kernel/seccomp.c: seccomp_set_mode_strict
     // When disabling Seccomp, ensure that current->sighand->siglock is held during the operation.
     spin_lock_irq(&current->sighand->siglock);
@@ -75,21 +83,23 @@ static void disable_seccomp(void)
     clear_thread_flag(TIF_SECCOMP);
 #endif
 
-    memcpy(&fake, current, sizeof(fake));
+    memcpy(fake, current, sizeof(*fake));
+
     current->seccomp.mode = 0;
     current->seccomp.filter = NULL;
     atomic_set(&current->seccomp.filter_count, 0);
     spin_unlock_irq(&current->sighand->siglock);
 
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 11, 0)
     // https://github.com/torvalds/linux/commit/bfafe5efa9754ebc991750da0bcca2a6694f3ed3#diff-45eb79a57536d8eccfc1436932f093eb5c0b60d9361c39edb46581ad313e8987R576-R577
-    fake.flags |= PF_EXITING;
+    fake->flags |= PF_EXITING;
 #elif LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
     // https://github.com/torvalds/linux/commit/0d8315dddd2899f519fe1ca3d4d5cdaf44ea421e#diff-45eb79a57536d8eccfc1436932f093eb5c0b60d9361c39edb46581ad313e8987R556-R558
-    fake.sighand = NULL;
+    fake->sighand = NULL;
 #endif
 
-    seccomp_filter_release(&fake);
+    seccomp_filter_release(fake);
+    kfree(fake);
 }
 
 void escape_with_root_profile(void)
