We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
1 parent b51acfd commit 55b27a6Copy full SHA for 55b27a6
volatility3/framework/symbols/linux/extensions/__init__.py
@@ -1574,7 +1574,7 @@ def _is_kernel_prior_to_struct_mount(self) -> bool:
1574
'True' if the kernel lacks the 'mount' struct, typically indicating kernel < 3.3.
1575
"""
1576
1577
- return not self._context.symbol_space.has_type("mount")
+ return (not self._context.symbol_space.has_type("mount")) and self.has_member("mnt_parent")
1578
1579
def is_equal(self, vfsmount_ptr) -> bool:
1580
"""Helper to make sure it is comparing two pointers to 'vfsmount'.
0 commit comments