OmniNX/Atmosphere
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

kern: reject shadow stack accesses in syscalls

Browse Source
This commit is contained in:
Alula
2026-09-15 17:04:18 +02:00
parent 7e58f5fbae
commit dbfe192b2f
15 changed files with 60 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
libraries/libmesosphere/source/svc/kern_svc_lock.cpp
View File

@@ -21,13 +21,15 @@ namespace ams::kern::svc {
namespace {
constexpr bool IsKernelAddress(uintptr_t address) {
return KernelVirtualAddressSpaceBase <= address && address < KernelVirtualAddressSpaceEnd;
constexpr bool IsValidAddress(uintptr_t address) {
if (KernelVirtualAddressSpaceBase <= address && address < KernelVirtualAddressSpaceEnd) return false;
if (GetCurrentProcess().GetPageTable().IsInShadowStackRegion(address)) return false;
return true;
}
Result ArbitrateLock(ams::svc::Handle thread_handle, uintptr_t address, uint32_t tag) {
/* Validate the input address. */
R_UNLESS(!IsKernelAddress(address), svc::ResultInvalidCurrentMemory());
R_UNLESS(IsValidAddress(address), svc::ResultInvalidCurrentMemory());
R_UNLESS(util::IsAligned(address, sizeof(u32)), svc::ResultInvalidAddress());
R_RETURN(KConditionVariable::WaitForAddress(thread_handle, address, tag));
@@ -35,7 +37,7 @@ namespace ams::kern::svc {
Result ArbitrateUnlock(uintptr_t address) {
/* Validate the input address. */
R_UNLESS(!IsKernelAddress(address), svc::ResultInvalidCurrentMemory());
R_UNLESS(IsValidAddress(address), svc::ResultInvalidCurrentMemory());
R_UNLESS(util::IsAligned(address, sizeof(u32)), svc::ResultInvalidAddress());
R_RETURN(KConditionVariable::SignalToAddress(address));