From 3141a741ebd3b7fe921fcd29e21be402eecd96be Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 5 Mar 2025 23:21:21 +0000 Subject: [PATCH] Gracefully terminate the plugin when the keyboard notifier list head is paged out --- volatility3/framework/plugins/linux/keyboard_notifiers.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/volatility3/framework/plugins/linux/keyboard_notifiers.py b/volatility3/framework/plugins/linux/keyboard_notifiers.py index 8577de848..726280cbe 100644 --- a/volatility3/framework/plugins/linux/keyboard_notifiers.py +++ b/volatility3/framework/plugins/linux/keyboard_notifiers.py @@ -61,6 +61,10 @@ class Keyboard_notifiers(interfaces.plugins.PluginInterface): "This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt." ) + if not self.context.layers[vmlinux.layer_name].is_valid(knl_addr.vol.offset): + vollog.error("The head of the keyboard notifier list is paged out.") + return + knl = vmlinux.object( object_type="atomic_notifier_head", offset=knl_addr.vol.offset,