diff options
| author | Andreas Kling <kling@serenityos.org> | 2020-02-22 09:56:22 +0100 |
|---|---|---|
| committer | Andreas Kling <kling@serenityos.org> | 2020-02-22 10:09:54 +0100 |
| commit | 94652fd2fbf8cc79dc8446ea38b366c0464d6d98 (patch) | |
| tree | 74a75a99b53dc30de3bbf92b55d9b0a18b6c0dab /Kernel | |
| parent | f020081a3842d05df5574fdb93de03ab895a7414 (diff) | |
| download | serenity-94652fd2fbf8cc79dc8446ea38b366c0464d6d98.zip | |
Kernel: Fully validate pointers when walking stack during profiling
It's not enough to just check that things wouldn't page fault, we also
need to verify that addresses are accessible to the profiled thread.
Diffstat (limited to 'Kernel')
| -rw-r--r-- | Kernel/Thread.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/Kernel/Thread.cpp b/Kernel/Thread.cpp index dcba4fae39..de857a0662 100644 --- a/Kernel/Thread.cpp +++ b/Kernel/Thread.cpp @@ -813,7 +813,7 @@ Vector<uintptr_t> Thread::raw_backtrace(uintptr_t ebp) const ProcessPagingScope paging_scope(process); Vector<uintptr_t, Profiling::max_stack_frame_count> backtrace; backtrace.append(ebp); - for (uintptr_t* stack_ptr = (uintptr_t*)ebp; MM.can_read_without_faulting(process, VirtualAddress(stack_ptr), sizeof(uintptr_t) * 2); stack_ptr = (uintptr_t*)*stack_ptr) { + for (uintptr_t* stack_ptr = (uintptr_t*)ebp; process.validate_read_from_kernel(VirtualAddress(stack_ptr), sizeof(uintptr_t) * 2) && MM.can_read_without_faulting(process, VirtualAddress(stack_ptr), sizeof(uintptr_t) * 2); stack_ptr = (uintptr_t*)*stack_ptr) { uintptr_t retaddr = stack_ptr[1]; backtrace.append(retaddr); if (backtrace.size() == Profiling::max_stack_frame_count) |