Skip to content

fix(libkernel): reject malformed ranges in sceKernelReleaseDirectMemory - #2421

Merged
adriadam10 merged 1 commit into
boykopovar:mainfrom
Pouare514:fix/direct-memory-release-validation
Oct 10, 2026
Merged

fix(libkernel): reject malformed ranges in sceKernelReleaseDirectMemory#2421
adriadam10 merged 1 commit into
boykopovar:mainfrom
Pouare514:fix/direct-memory-release-validation

Conversation

@Pouare514

@Pouare514 Pouare514 commented Oct 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What

sceKernelReleaseDirectMemory only rejected a negative start and a zero length, so malformed ranges reached the physical pool: a sub-page length silently freed a whole page while fragmenting the block map at byte granularity, and an out-of-range length walked the page table past the backing store. Validate page alignment of start and length plus the range bound up front and return EINVAL instead, mirroring DoMunmap.

Tested

  • New CheckReleaseDirectMemoryRejectsInvalidRanges in core/libs/tests/GuestMemory.cpp: negative start, zero/misaligned/huge/out-of-range lengths.
  • guest_memory passes with the fix; with the fix stashed it aborts (0xc0000409), so the test pins the behavior.
  • CI green: conventions, eligibility, intake, report, relinker macos/ubuntu/windows (linux/windows jobs skip by design).

Checklist

  • Based on current main; no other open PR implements the same functions
  • One topic per PR; follow-ups go in a new PR
  • No comments in code except technical debt
  • Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed in TechnicalDebt
  • No notes, investigation .md files or images added to the repository
  • New third-party code is a submodule built from source
  • Generic behaviour, not specific to one title
  • Depends on: none
  • AI-assisted: yes

@github-actions github-actions Bot mentioned this pull request Oct 9, 2026
Merged
9 tasks done
@popcoder565

popcoder565 commented Oct 9, 2026

Copy link
Copy Markdown
Contributor

Native Windows run, since no Windows results were posted. Setup: Windows 10 (19045), MinGW-w64 GCC 15.2.0 (WinLibs r7), Release. Head aa77b2b8, merged onto main 8b393b6 in one build with 31 other PRs that had no Windows run.

No title was run.

🤖 Addressed by Claude Code

@Kikoarl

Kikoarl commented Oct 9, 2026

Copy link
Copy Markdown
Contributor

Tested on Linux (CachyOS x86_64, Intel RPL-S iGPU / Mesa 26.3.0-devel / Vulkan 1.4.363, GCC 16.2.1) at aa77b2b8:

  • Build: Built cleanly in RAM (/tmp/anyps5_build) with zero warnings/errors.
  • Conventions: python3 tools/check_conventions.py --base origin/main --head HEAD -> PASS (0 errors).
  • Verification: Verified GuestMemory.cpp (CheckReleaseDirectMemoryRejectsInvalidRanges). Page-alignment checks and bounds validation against DIRECT_MEMORY_SIZE cleanly reject unaligned and out-of-bounds ranges with SCE_KERNEL_ERROR_EINVAL.

LGTM!

This was referenced Oct 10, 2026
Merged
Merged
Closed
@github-actions github-actions Bot added the needs rebase Conflicts with main, rebase needed label Oct 10, 2026
@oneandonlydean

oneandonlydean commented Oct 10, 2026

Copy link
Copy Markdown
Collaborator

Conflicts with main in core/libs/prx/libkernel/DirectMemory/Export.cpp after #2236; please rebase.

@Pouare514 @adriadam10
fix(libkernel): reject malformed ranges in sceKernelReleaseDirectMemory
03d975a 
A zero, unaligned, overflowing or out-of-range length reached the physical pool, where a sub-page length silently freed a whole page and fragmented the block map, and an out-of-range length walked the page table past the backing store. Validate alignment and bounds up front and return EINVAL instead.
@adriadam10

adriadam10 commented Oct 10, 2026

Copy link
Copy Markdown
Collaborator

Rebased onto current main (conflict with #2236 in sceKernelReleaseDirectMemory: the range validation now runs before DirectMemoryViews). Build and ctest green on the rebase, including guest_memory. Page alignment matches KytyPS5 and shadPS4 (EINVAL); merging.

@adriadam10
adriadam10 force-pushed the fix/direct-memory-release-validation branch from aa77b2b to 03d975a Compare October 10, 2026 06:26
@github-actions github-actions Bot removed the needs rebase Conflicts with main, rebase needed label Oct 10, 2026
@github-actions

github-actions Bot commented Oct 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Other open pull requests touch the same code. Merging one will break the other, or both implement the same thing. If this one builds on them, list them in Depends on.

Pull request Conflicting files (lines on main) Same exports Same new files
#1905 core/libs/tests/GuestMemory.cpp L7
#1961 core/libs/tests/GuestMemory.cpp L7-8

@adriadam10

adriadam10 commented Oct 10, 2026

Copy link
Copy Markdown
Collaborator

The only red check was write-watch (macos-15-intel): write_watch_threads timed out at 30 s on a slow runner (the same job on macos-15 passes, and those tests don't touch libkernel). Re-running it; merging once green.

@adriadam10
adriadam10 merged commit b58b1cc into boykopovar:main Oct 10, 2026
25 of 26 checks passed
SleglJan pushed a commit to SleglJan/AnyPS5 that referenced this pull request Oct 10, 2026
@adriadam10
Merge pull request boykopovar#2421 from Pouare514/fix/direct-memory-r…
c7b06c4 
…elease-validation

fix(libkernel): reject malformed ranges in sceKernelReleaseDirectMemory
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

libkernel

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@Pouare514 @popcoder565 @Kikoarl @oneandonlydean @adriadam10