Skip to content

Commit cd2af74

Browse files
committed
Improve pointers address verification and return message chain
1 parent 997abed commit cd2af74

File tree

1 file changed

+14
-11
lines changed

1 file changed

+14
-11
lines changed

volatility3/framework/symbols/linux/__init__.py

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -217,29 +217,32 @@ def _get_new_sock_pipe_path(cls, context, task, filp) -> str:
217217
ns_common_type = kernel_module.get_type("ns_common")
218218
stashed_template = ns_common_type.child_template("stashed")
219219
stashed_type_full_name = stashed_template.vol.type_name
220-
stashed_type_name = stashed_type_full_name.split(constants.BANG)[-1]
220+
stashed_type_name = stashed_type_full_name.split(constants.BANG)[1]
221221
if stashed_type_name == "atomic64_t":
222222
# 3.19 <= Kernels < 6.9
223-
ns_ops = dentry.d_fsdata.dereference().cast(
224-
"proc_ns_operations"
225-
)
223+
fsdata_ptr = dentry.d_fsdata
224+
if not (fsdata_ptr and fsdata_ptr.is_readable()):
225+
raise IndexError
226+
227+
ns_ops = fsdata_ptr.dereference().cast("proc_ns_operations")
226228
else:
227229
# Kernels >= 6.9
228-
ns_common = inode.i_private.dereference().cast("ns_common")
230+
private_ptr = inode.i_private
231+
if not (private_ptr and private_ptr.is_readable()):
232+
raise IndexError
233+
234+
ns_common = private_ptr.dereference().cast("ns_common")
229235
ns_ops = ns_common.ops
230236

231237
pre_name = utility.pointer_to_string(ns_ops.name, 255)
232238
except IndexError:
233-
ret = "<unsupported ns_common type>"
239+
pre_name = "<unsupported ns_dname implementation>"
234240
else:
235241
pre_name = f"<unsupported d_op symbol> {sym}"
236-
237-
ret = f"{pre_name}:[{inode.i_ino:d}]"
238-
239242
else:
240-
ret = f"<unknown d_dname pointer> {sym_addr:x}"
243+
pre_name = f"<unknown d_dname pointer> {sym_addr:x}"
241244

242-
return ret
245+
return f"{pre_name}:[{inode.i_ino:d}]"
243246

244247
@classmethod
245248
def path_for_file(cls, context, task, filp) -> str:

0 commit comments

Comments
 (0)