Skip to content

Fix per-instance TEB stack cache validation - #64

Merged
ntoskrnl7 merged 1 commit into
mainfrom
fix/teb-instance-cache-validation
Jul 9, 2026
Merged

ntoskrnl7 merged 1 commit into
mainfrom
fix/teb-instance-cache-validation

Conversation

@ntoskrnl7

Copy link
Copy Markdown
Owner

Summary

Fix LdkCurrentTeb() so the stack-low-limit TEB cache is only accepted when it belongs to the current statically linked LDK instance and the current ETHREAD.

This matters when more than one LDK-linked driver is loaded. The kernel stack cache slot is shared by the executing thread, so one driver instance can observe a TEB pointer left by another instance unless the cached TEB is validated against this instance's PEB.

Changes

  • Validate cached TEB ProcessEnvironmentBlock against LdkCurrentPeb().
  • Keep the existing current-thread validation.
  • Add TebForeignStackCacheTest to simulate a foreign cached TEB in the stack slot.
  • Add a two-driver integration test:
    • LdkMultiA.sys
    • LdkMultiB.sys
    • LdkMultiProbe.exe
  • The probe opens both drivers from one user-mode thread and verifies that A/B keep distinct TEB/PEB/TLS/LastError state while running on the same ETHREAD.

Validation

  • cmake -S test -B artifacts\build\teb-instance-pr-x64 -A x64 -DCMAKE_BUILD_TYPE=Debug
  • cmake --build artifacts\build\teb-instance-pr-x64 --config Debug -- /m
  • cmake --build artifacts\build\teb-instance-pr-x64 --config Release -- /m
  • VM Debug multi-instance load/probe/unload: PASS
  • VM Release multi-instance load/probe/unload: PASS

Representative VM output:

[LdkMultiProbe] PASS A_TEB=... B_TEB=... A_PEB=... B_PEB=... Thread=...
PROBE_RC=0
STOP_B_RC=0
STOP_A_RC=0
DELETE_B_RC=0
DELETE_A_RC=0
PASS

@ntoskrnl7
ntoskrnl7 marked this pull request as ready for review July 9, 2026 07:06
@ntoskrnl7
ntoskrnl7 merged commit df34a18 into main Jul 9, 2026
160 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant