Skip to content

fix: handle page fault errors when reading envs - #28

Merged
RonFed merged 1 commit into
mainfrom
handle_envp_page_faults
Aug 3, 2025
Merged

fix: handle page fault errors when reading envs#28
RonFed merged 1 commit into
mainfrom
handle_envp_page_faults

Conversation

@RonFed

@RonFed RonFed commented Aug 2, 2025

Copy link
Copy Markdown
Collaborator

This PR slightly changes the algorithm for env prefix filtering:

  • If we reached a NULL pointer in the envp vector we return and not pass a process exec event. This happens often when we successfully scan the env vector of an un-relevant process.
  • If we read an env pointer successfully but fail to de-reference it and read the underlying string - we have no certainty about the envs - and this can happen if the memory referenced by the env pointer is not paged in yet. In this case we continue as if we found a relevant env prefix.

emergency-ticket id: EMR-1

@RonFed
RonFed merged commit 728e533 into main Aug 3, 2025
5 of 7 checks passed
@RonFed
RonFed deleted the handle_envp_page_faults branch August 3, 2025 10:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants