From 66084878627f636d0bebabbecc79842ac954d209 Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Wed, 15 Jan 2025 15:08:57 +1100
Subject: [PATCH] Linux: pagecache:  Fix issue with incosistent inode page
 caches

---
 volatility3/framework/plugins/linux/pagecache.py   |  6 +++++-
 volatility3/framework/symbols/linux/__init__.py    | 14 ++++++++++++--
 .../framework/symbols/linux/extensions/__init__.py |  9 +++++++++
 3 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py
index 9aff0e4f9..b2766be8d 100644
--- a/volatility3/framework/plugins/linux/pagecache.py
+++ b/volatility3/framework/plugins/linux/pagecache.py
@@ -520,7 +520,11 @@ class InodePages(plugins.PluginInterface):
             page_mapping_addr = page_obj.mapping
             page_index = int(page_obj.index)
             page_file_offset = page_index * vmlinux_layer.page_size
-            dump_safe = page_file_offset < inode_size
+            dump_safe = (
+                page_file_offset < inode_size
+                and page_mapping_addr
+                and page_mapping_addr.is_readable()
+            )
             page_flags_list = page_obj.get_flags_list()
             page_flags = ",".join([x.replace("PG_", "") for x in page_flags_list])
             fields = (
diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py
index 3265dfd37..08f69c326 100644
--- a/volatility3/framework/symbols/linux/__init__.py
+++ b/volatility3/framework/symbols/linux/__init__.py
@@ -3,6 +3,7 @@
 #
 import math
 import contextlib
+import logging
 from abc import ABC, abstractmethod
 from typing import Iterator, List, Tuple, Optional, Union
 
@@ -12,6 +13,8 @@ from volatility3.framework.objects import utility
 from volatility3.framework.symbols import intermed
 from volatility3.framework.symbols.linux import extensions
 
+vollog = logging.getLogger(__name__)
+
 
 class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable):
     provides = {"type": "interface"}
@@ -612,7 +615,7 @@ class IDStorage(ABC):
         raise NotImplementedError
 
     def nodep_to_node(self, nodep) -> interfaces.objects.ObjectInterface:
-        """Instanciates a tree node from its pointer
+        """Instantiates a tree node from its pointer
 
         Args:
             nodep: Pointer to the XArray/RadixTree node
@@ -846,4 +849,11 @@ class PageCache:
             if not layer.is_valid(page_addr):
                 continue
 
-            yield self.vmlinux.object("page", offset=page_addr, absolute=True)
+            page = self.vmlinux.object("page", offset=page_addr, absolute=True)
+            if not page.is_valid():
+                vollog.error(
+                    f"Invalid cached page at {page.vol.offset:#x}, aborting",
+                )
+                break
+
+            yield page
diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index 187b1e280..6ae022923 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -2534,6 +2534,15 @@ class address_space(objects.StructType):
 
 
 class page(objects.StructType):
+    def is_valid(self) -> bool:
+        if self.mapping and not self.mapping.is_readable():
+            return False
+
+        if self.to_paddr() < 0:
+            return False
+
+        return True
+
     @functools.cached_property
     def pageflags_enum(self) -> Dict:
         """Returns 'pageflags' enumeration key/values