Fix infinite loop in LL traversal, better reachability checks.

nedwill · Jan 7, 2017 · 49b7fde · 49b7fde
1 parent a171fe2
commit 49b7fde
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/source/cleanup.c b/source/cleanup.c
@@ -58,8 +58,9 @@ static void *find_orphan() {
     } else if (ktimer_base <= child && child < ktimer_end) {
       /* object is freed, next pointer is reachable */
       reachable[TOBJ_ADDR_TO_IDX(ktimer_base, child)] = true;
-    } else {
+    } else if (child != NULL && child != (void *)TIMER2_NEXT_KERNEL) {
       printf("[!] Warning! Timer table entry had non-vtable, non-freed entry!\n");
+      printf("It looks like this: %p -> %p\n", current_timer, child);
       wait_for_user();
     }
   }
@@ -96,7 +97,7 @@ static void **find_parent() {
   // traverse linked list until next points to userspace
   void *current_node = ktimer_pool_head;
   while (true) {
-    void *next = (void *)kreadint_real(ktimer_pool_head);
+    void *next = (void *)kreadint_real(current_node);
 
     if (next == (void *)TIMER2_NEXT_KERNEL) {
       return current_node;

diff --git a/source/exploit.c b/source/exploit.c
@@ -359,7 +359,6 @@ bool k11_exploit() {
   if (!cleanup_uaf()) {
     printf("[-] Warning! Exploit succeeded couldn't cleanup kernel.\n");
     printf("[-] System instability may occur.\n");
-
     return false;
   }