Author: sir_richard
Date: Thu Nov 11 13:08:41 2010
New Revision: 49557
URL: http://svn.reactos.org/svn/reactos?rev=49557&view=rev
Log:
[NTOS]: Fix a bug in MiRemovePageByColor which caused corruption of the page list and could lead to crashes, re-use of freed memory, assuming active memory was free, etc.
Modified:
trunk/reactos/ntoskrnl/mm/ARM3/pfnlist.c
Modified: trunk/reactos/ntoskrnl/mm/ARM3/pfnlist.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/mm/ARM3/pfnlist.c…
==============================================================================
--- trunk/reactos/ntoskrnl/mm/ARM3/pfnlist.c [iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/mm/ARM3/pfnlist.c [iso-8859-1] Thu Nov 11 13:08:41 2010
@@ -265,7 +265,7 @@
else
{
/* Set the list head's backlink instead */
- ListHead->Blink = OldFlink;
+ ListHead->Blink = OldBlink;
}
/* Check if the back entry is the list head */
Author: sir_richard
Date: Thu Nov 11 13:05:52 2010
New Revision: 49556
URL: http://svn.reactos.org/svn/reactos?rev=49556&view=rev
Log:
[NTOS]: Fix another bug in the continuous memory allocation code, which would go off-by-one while looping the PFN entries for the allocation, and corrupt the PteFrame/PteAddress of an unrelated PFN entry. If this PFN was in the active lists, it would cause page table leaks and faults, if the page was on a free list, it would override the colored list backlink and corrupt the list, later causing unlinked pages to remain linked to the list.
Modified:
trunk/reactos/ntoskrnl/mm/ARM3/contmem.c
Modified: trunk/reactos/ntoskrnl/mm/ARM3/contmem.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/mm/ARM3/contmem.c…
==============================================================================
--- trunk/reactos/ntoskrnl/mm/ARM3/contmem.c [iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/mm/ARM3/contmem.c [iso-8859-1] Thu Nov 11 13:05:52 2010
@@ -79,7 +79,6 @@
//
if (MiIsPfnInUse(Pfn1))
{
- //DPRINT1("In use: reset\n");
Length = 0;
continue;
}
@@ -94,7 +93,6 @@
//
// It does not, so bail out
//
- //DPRINT1("Doesn't match restrictions: reset\n");
continue;
}
@@ -368,7 +366,7 @@
/* Write the PTE address */
Pfn1->PteAddress = PointerPte;
Pfn1->u4.PteFrame = PFN_FROM_PTE(MiAddressToPte(PointerPte++));
- } while (Pfn1++ < EndPfn);
+ } while (++Pfn1 < EndPfn);
/* Return the address */
return BaseAddress;