Linux: pagecache: Fix issue with incosistent inode page caches

volatility3/framework/plugins/linux/pagecache.py

@@ -520,7 +520,11 @@ class InodePages(plugins.PluginInterface):
             page_mapping_addr = page_obj.mapping
             page_index = int(page_obj.index)
             page_file_offset = page_index * vmlinux_layer.page_size
-            dump_safe = page_file_offset < inode_size
+            dump_safe = (
+                page_file_offset < inode_size
+                and page_mapping_addr
+                and page_mapping_addr.is_readable()
+            )
             page_flags_list = page_obj.get_flags_list()
             page_flags = ",".join([x.replace("PG_", "") for x in page_flags_list])
             fields = (

volatility3/framework/symbols/linux/__init__.py

@@ -3,6 +3,7 @@
 #
 import math
 import contextlib
+import logging
 from abc import ABC, abstractmethod
 from typing import Iterator, List, Tuple, Optional, Union
 
@@ -12,6 +13,8 @@ from volatility3.framework.objects import utility
 from volatility3.framework.symbols import intermed
 from volatility3.framework.symbols.linux import extensions
 
+vollog = logging.getLogger(__name__)
+
 
 class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable):
     provides = {"type": "interface"}
@@ -612,7 +615,7 @@ class IDStorage(ABC):
         raise NotImplementedError
 
     def nodep_to_node(self, nodep) -> interfaces.objects.ObjectInterface:
-        """Instanciates a tree node from its pointer
+        """Instantiates a tree node from its pointer
 
         Args:
             nodep: Pointer to the XArray/RadixTree node
@@ -846,4 +849,11 @@ class PageCache:
             if not layer.is_valid(page_addr):
                 continue
 
-            yield self.vmlinux.object("page", offset=page_addr, absolute=True)
+            page = self.vmlinux.object("page", offset=page_addr, absolute=True)
+            if not page.is_valid():
+                vollog.error(
+                    f"Invalid cached page at {page.vol.offset:#x}, aborting",
+                )
+                break
+
+            yield page

volatility3/framework/symbols/linux/extensions/__init__.py

@@ -2534,6 +2534,15 @@ class address_space(objects.StructType):
 
 
 class page(objects.StructType):
+    def is_valid(self) -> bool:
+        if self.mapping and not self.mapping.is_readable():
+            return False
+
+        if self.to_paddr() < 0:
+            return False
+
+        return True
+
     @functools.cached_property
     def pageflags_enum(self) -> Dict:
         """Returns 'pageflags' enumeration key/values