fix(symbolizer): Device driver misattribution

pkg/symbolize/driver.go

@@ -49,7 +49,11 @@ func (d *driverStore) resolve(addr va.Address) *sys.Driver {
 	dev, isCached := d.drivers[addr]
 	d.mux.RUnlock()
 	if isCached {
-		return dev
+		// is this driver still loaded at the same base?
+		base := va.Address(dev.Base)
+		if addr >= base && addr < base.Inc(uint64(dev.Size)) {
+			return dev
+		}
 	}
 
 	d.mux.Lock()
@@ -67,15 +71,12 @@ func (d *driverStore) resolve(addr va.Address) *sys.Driver {
 }
 
 func (d *driverStore) addDriver(base va.Address, size uint64, path string) {
-	d.mux.Lock()
-	defer d.mux.Unlock()
-
 	dev := sys.Driver{
 		Path: path,
 		Base: base.Uintptr(),
 		Size: uint32(size),
 	}
-	d.devs = append(d.devs, dev)
+	d.addDev(dev)
 }
 
 func (d *driverStore) removeDriver(base va.Address, size uint64) {
@@ -92,6 +93,31 @@ func (d *driverStore) removeDriver(base va.Address, size uint64) {
 	for addr := range d.drivers {
 		if addr >= base && addr < base.Inc(size) {
 			delete(d.drivers, addr)
+			break
+		}
+	}
+}
+
+func (d *driverStore) addDev(drv sys.Driver) {
+	d.mux.Lock()
+	defer d.mux.Unlock()
+
+	exists := false
+
+	for i, dev := range d.devs {
+		switch {
+		case dev.Base == drv.Base && dev.Path != drv.Path:
+			// driver exists at identical base address but
+			// with different device path. Probably stale
+			d.devs = append(d.devs[:i], d.devs[i+1:]...)
+		case dev.Base == drv.Base && dev.Path == drv.Path:
+			// driver exists at identical base address and
+			// device path. Don't reappend
+			exists = true
 		}
 	}
+
+	if !exists {
+		d.devs = append(d.devs, drv)
+	}
 }

pkg/symbolize/driver_test.go

@@ -256,3 +256,25 @@ func TestAddRemoveRoundTrip(t *testing.T) {
 		t.Error("driver must be gone after round-trip removal")
 	}
 }
+
+func TestAddNewDriverSameBase(t *testing.T) {
+	ds := makeStore(realDrivers())
+
+	const base va.Address = 0xFFFFF80010000000
+	const size uint64 = 0x50000
+
+	ds.addDriver(base, size, `\Driver\fileinfo.sys`)
+	if len(ds.devs) != 3 {
+		t.Error("must be 3 drivers in the store")
+	}
+
+	ds.addDriver(base, size, `\Driver\FLTMGR.SYS.sys`)
+	if len(ds.devs) != 3 {
+		t.Error("must be 3 drivers in the store")
+	}
+
+	drv := ds.resolve(base)
+	if drv.Path != `\Driver\FLTMGR.SYS.sys` {
+		t.Error("unexpected driver resolved")
+	}
+}