OmniNX/Atmosphere
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

kern: reject shadow stack accesses in syscalls

Browse Source
This commit is contained in:
Alula
2026-09-15 17:04:18 +02:00
parent 7e58f5fbae
commit dbfe192b2f
15 changed files with 60 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
libraries/libmesosphere/source/svc/kern_svc_port.cpp
View File

@@ -21,11 +21,22 @@ namespace ams::kern::svc {
namespace {
static Result GetPortName(char (&name)[KObjectName::NameLengthMax], KUserPointer<const char *> user_name) {
/* Copy the provided name from user memory to kernel memory. */
R_TRY(user_name.CopyStringTo(name, sizeof(name)));
/* Oddly enough N here first copies then validates if it's not in forbidden range. */
const auto name_len = util::Strnlen(name, sizeof(name));
R_UNLESS(GetCurrentProcess().GetPageTable().IsSafeUserPointer(KProcessAddress(user_name.GetUnsafePointer()), name_len + 1), svc::ResultInvalidPointer());
R_SUCCEED();
}
Result ManageNamedPort(ams::svc::Handle *out_server_handle, KUserPointer<const char *> user_name, s32 max_sessions) {
/* Copy the provided name from user memory to kernel memory. */
char name[KObjectName::NameLengthMax] = {};
R_TRY(user_name.CopyStringTo(name, sizeof(name)));
R_TRY(GetPortName(name, user_name));
/* Validate that sessions and name are valid. */
R_UNLESS(max_sessions >= 0, svc::ResultOutOfRange());
R_UNLESS(name[sizeof(name) - 1] == '\x00', svc::ResultOutOfRange());
@@ -106,7 +117,7 @@ namespace ams::kern::svc {
Result ConnectToNamedPort(ams::svc::Handle *out, KUserPointer<const char *> user_name) {
/* Copy the provided name from user memory to kernel memory. */
char name[KObjectName::NameLengthMax] = {};
R_TRY(user_name.CopyStringTo(name, sizeof(name)));
R_TRY(GetPortName(name, user_name));
/* Validate that name is valid. */
R_UNLESS(name[sizeof(name) - 1] == '\x00', svc::ResultOutOfRange());