From bb1ff69e426ad688ea116bcdab2f1a9c77a182e6 Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Mon, 16 Dec 2024 19:25:24 +1100
Subject: [PATCH 1/2] linux: dentry: Fix dentry type support for kernels
 pre-3.19

---
 .../framework/symbols/linux/extensions/__init__.py       | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index 927f767e2..829622154 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -1107,9 +1107,16 @@ class dentry(objects.StructType):
             walk_member = "d_sib"
             list_head_member = self.d_children
         elif self.has_member("d_child") and self.has_member("d_subdirs"):
-            # 2.5.0 <= kernels < 6.8
+            # 3.19.0 <= kernels < 6.8
             walk_member = "d_child"
             list_head_member = self.d_subdirs
+        elif self.has_member("d_u") and self.has_member("d_subdirs"):
+            # kernels < 3.19
+
+            # Actually, 'd_u.d_child' but to_list() doesn't support something like that.
+            # Since, it's an union, everything is at the same offset than 'd_u'.
+            walk_member = "d_u"
+            list_head_member = self.d_subdirs
         else:
             raise exceptions.VolatilityException("Unsupported dentry type")
 

From 3b0f0915c7fd24512d12603ab989a53f6ac68928 Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Mon, 16 Dec 2024 19:36:54 +1100
Subject: [PATCH 2/2] linux: page_cache: add testcase for page_cache.files
 plugin

---
 test/test_volatility.py | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/test/test_volatility.py b/test/test_volatility.py
index f7cb23e93..b5910e1c8 100644
--- a/test/test_volatility.py
+++ b/test/test_volatility.py
@@ -632,6 +632,26 @@ def test_linux_vmayarascan_yara_string(image, volatility, python):
     assert rc == 0
 
 
+def test_linux_page_cache_files(image, volatility, python):
+    rc, out, _err = runvol_plugin(
+        "linux.pagecache.Files",
+        image,
+        volatility,
+        python,
+        pluginargs=["--find", "/etc/passwd"],
+    )
+    out = out.lower()
+
+    assert out.count(b"\n") > 4
+
+    # inode_num inode_addr ... file_path
+    assert re.search(
+        rb"146829\s0x88001ab5c270.*?/etc/passwd",
+        out,
+    )
+    assert rc == 0
+
+
 # MAC