From 94652fd2fbf8cc79dc8446ea38b366c0464d6d98 Mon Sep 17 00:00:00 2001 From: Andreas Kling Date: Sat, 22 Feb 2020 09:56:22 +0100 Subject: [PATCH] Kernel: Fully validate pointers when walking stack during profiling It's not enough to just check that things wouldn't page fault, we also need to verify that addresses are accessible to the profiled thread. --- Kernel/Thread.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Kernel/Thread.cpp b/Kernel/Thread.cpp index dcba4fae39..de857a0662 100644 --- a/Kernel/Thread.cpp +++ b/Kernel/Thread.cpp @@ -813,7 +813,7 @@ Vector Thread::raw_backtrace(uintptr_t ebp) const ProcessPagingScope paging_scope(process); Vector backtrace; backtrace.append(ebp); - for (uintptr_t* stack_ptr = (uintptr_t*)ebp; MM.can_read_without_faulting(process, VirtualAddress(stack_ptr), sizeof(uintptr_t) * 2); stack_ptr = (uintptr_t*)*stack_ptr) { + for (uintptr_t* stack_ptr = (uintptr_t*)ebp; process.validate_read_from_kernel(VirtualAddress(stack_ptr), sizeof(uintptr_t) * 2) && MM.can_read_without_faulting(process, VirtualAddress(stack_ptr), sizeof(uintptr_t) * 2); stack_ptr = (uintptr_t*)*stack_ptr) { uintptr_t retaddr = stack_ptr[1]; backtrace.append(retaddr); if (backtrace.size() == Profiling::max_stack_frame_count)