OmniNX/Atmosphere
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

kern: reject shadow stack accesses in syscalls

Browse Source
This commit is contained in:
Alula
2026-09-15 17:04:18 +02:00
parent 7e58f5fbae
commit dbfe192b2f
15 changed files with 60 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
libraries/libmesosphere/source/svc/kern_svc_address_arbiter.cpp
View File

@@ -21,8 +21,10 @@ namespace ams::kern::svc {
namespace {
constexpr bool IsKernelAddress(uintptr_t address) {
return KernelVirtualAddressSpaceBase <= address && address < KernelVirtualAddressSpaceEnd;
constexpr bool IsValidAddress(uintptr_t address) {
if (KernelVirtualAddressSpaceBase <= address && address < KernelVirtualAddressSpaceEnd) return false;
if (GetCurrentProcess().GetPageTable().IsInShadowStackRegion(address)) return false;
return true;
}
constexpr bool IsValidSignalType(ams::svc::SignalType type) {
@@ -50,7 +52,7 @@ namespace ams::kern::svc {
Result WaitForAddress(uintptr_t address, ams::svc::ArbitrationType arb_type, int64_t value, int64_t timeout_ns) {
/* Validate input. */
R_UNLESS(AMS_LIKELY(!IsKernelAddress(address)), svc::ResultInvalidCurrentMemory());
R_UNLESS(AMS_LIKELY(IsValidAddress(address)), svc::ResultInvalidCurrentMemory());
if (arb_type == ams::svc::ArbitrationType_WaitIfEqual64) {
R_UNLESS(util::IsAligned(address, sizeof(int64_t)), svc::ResultInvalidAddress());
} else {
@@ -79,7 +81,7 @@ namespace ams::kern::svc {
Result SignalToAddress(uintptr_t address, ams::svc::SignalType signal_type, int32_t value, int32_t count) {
/* Validate input. */
R_UNLESS(AMS_LIKELY(!IsKernelAddress(address)), svc::ResultInvalidCurrentMemory());
R_UNLESS(AMS_LIKELY(IsValidAddress(address)), svc::ResultInvalidCurrentMemory());
R_UNLESS(util::IsAligned(address, sizeof(int32_t)), svc::ResultInvalidAddress());
R_UNLESS(IsValidSignalType(signal_type), svc::ResultInvalidEnumValue());