Browse Source

Kernel: Fully validate pointers when walking stack during profiling

It's not enough to just check that things wouldn't page fault, we also
need to verify that addresses are accessible to the profiled thread.
Andreas Kling 5 years ago
parent
commit
94652fd2fb
1 changed files with 1 additions and 1 deletions
  1. 1 1
      Kernel/Thread.cpp

+ 1 - 1
Kernel/Thread.cpp

@@ -813,7 +813,7 @@ Vector<uintptr_t> Thread::raw_backtrace(uintptr_t ebp) const
     ProcessPagingScope paging_scope(process);
     ProcessPagingScope paging_scope(process);
     Vector<uintptr_t, Profiling::max_stack_frame_count> backtrace;
     Vector<uintptr_t, Profiling::max_stack_frame_count> backtrace;
     backtrace.append(ebp);
     backtrace.append(ebp);
-    for (uintptr_t* stack_ptr = (uintptr_t*)ebp; MM.can_read_without_faulting(process, VirtualAddress(stack_ptr), sizeof(uintptr_t) * 2); stack_ptr = (uintptr_t*)*stack_ptr) {
+    for (uintptr_t* stack_ptr = (uintptr_t*)ebp; process.validate_read_from_kernel(VirtualAddress(stack_ptr), sizeof(uintptr_t) * 2) && MM.can_read_without_faulting(process, VirtualAddress(stack_ptr), sizeof(uintptr_t) * 2); stack_ptr = (uintptr_t*)*stack_ptr) {
         uintptr_t retaddr = stack_ptr[1];
         uintptr_t retaddr = stack_ptr[1];
         backtrace.append(retaddr);
         backtrace.append(retaddr);
         if (backtrace.size() == Profiling::max_stack_frame_count)
         if (backtrace.size() == Profiling::max_stack_frame_count)