Author: sir_richard
Date: Sun Sep 12 19:10:27 2010
New Revision: 48759
URL: http://svn.reactos.org/svn/reactos?rev=48759&view=rev
Log:
Likely fix for bug 5600:
[NTOS]: Using IsBadRead/CodePtr, it's possible for user-mode code to generate cases where we *think* this is an ARM3-managed piece of VA, which will always have a VAD (Since we only manage the PEB/TEB), but actually it's a bogus VA-looking address that is actually invalid. We didn't consider this case. We now implement the same code Windows normally would also handle, when the VA is bogus, and accept that no VAD might be found, so MM_NOACCESS is returned and thus an access violation sent to the caller. In the case of the IsBad...Ptr, this function would then return TRUE, as the caller expects.
Modified:
trunk/reactos/ntoskrnl/mm/ARM3/pagfault.c
Modified: trunk/reactos/ntoskrnl/mm/ARM3/pagfault.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/mm/ARM3/pagfault.…
==============================================================================
--- trunk/reactos/ntoskrnl/mm/ARM3/pagfault.c [iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/mm/ARM3/pagfault.c [iso-8859-1] Sun Sep 12 19:10:27 2010
@@ -42,9 +42,14 @@
return MmSharedUserDataPte;
}
- /* Find the VAD, it must exist, since we only handle PEB/TEB */
+ /* Find the VAD, it might not exist if the address is bogus */
Vad = MiLocateAddress(VirtualAddress);
- ASSERT(Vad);
+ if (!Vad)
+ {
+ /* Bogus virtual address */
+ *ProtectCode = MM_NOACCESS;
+ return NULL;
+ }
/* This must be a TEB/PEB VAD */
ASSERT(Vad->u.VadFlags.PrivateMemory == TRUE);
@@ -726,8 +731,23 @@
/* Check if this address range belongs to a valid allocation (VAD) */
ProtoPte = MiCheckVirtualAddress(Address, &ProtectionCode, &Vad);
- ASSERT(ProtectionCode != MM_NOACCESS);
-
+ if (ProtectionCode == MM_NOACCESS)
+ {
+ /* This is a bogus VA */
+ Status = STATUS_ACCESS_VIOLATION;
+
+ /* Could be a not-yet-mapped paged pool page table */
+#if (_MI_PAGING_LEVELS == 2)
+ MiCheckPdeForPagedPool(Address);
+#endif
+ /* See if that fixed it */
+ if (PointerPte->u.Hard.Valid == 1) Status = STATUS_SUCCESS;
+
+ /* Return the status */
+ MiUnlockProcessWorkingSet(CurrentProcess, CurrentThread);
+ return Status;
+ }
+
/* Did we get a prototype PTE back? */
if (!ProtoPte)
{
Author: cgutman
Date: Sun Sep 12 11:57:55 2010
New Revision: 48752
URL: http://svn.reactos.org/svn/reactos?rev=48752&view=rev
Log:
[NDIS]
- Fix timer queuing
- See issue #5461 for details
Modified:
trunk/reactos/drivers/network/ndis/ndis/time.c
Modified: trunk/reactos/drivers/network/ndis/ndis/time.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/network/ndis/ndis/…
==============================================================================
--- trunk/reactos/drivers/network/ndis/ndis/time.c [iso-8859-1] (original)
+++ trunk/reactos/drivers/network/ndis/ndis/time.c [iso-8859-1] Sun Sep 12 11:57:55 2010
@@ -247,16 +247,21 @@
/* relative delays are negative, absolute are positive; resolution is 100ns */
Timeout.QuadPart = Int32x32To64(MillisecondsPeriod, -10000);
-
+
+ /* Lock the miniport block */
KeAcquireSpinLock(&Timer->Miniport->Lock, &OldIrql);
- /* If KeSetTimer(Ex) returns FALSE then the timer is not in the system's queue (and not in ours either) */
- if (!KeSetTimerEx(&Timer->Timer, Timeout, MillisecondsPeriod, &Timer->Dpc))
- {
- /* Add the timer at the head of the timer queue */
- Timer->NextDeferredTimer = Timer->Miniport->TimerQueue;
- Timer->Miniport->TimerQueue = Timer;
- }
+
+ /* Attempt to dequeue the timer */
+ DequeueMiniportTimer(Timer);
+
+ /* Add the timer at the head of the timer queue */
+ Timer->NextDeferredTimer = Timer->Miniport->TimerQueue;
+ Timer->Miniport->TimerQueue = Timer;
+
+ /* Unlock the miniport block */
KeReleaseSpinLock(&Timer->Miniport->Lock, OldIrql);
+
+ KeSetTimerEx(&Timer->Timer, Timeout, MillisecondsPeriod, &Timer->Dpc);
}
@@ -288,15 +293,20 @@
/* relative delays are negative, absolute are positive; resolution is 100ns */
Timeout.QuadPart = Int32x32To64(MillisecondsToDelay, -10000);
+ /* Lock the miniport block */
KeAcquireSpinLock(&Timer->Miniport->Lock, &OldIrql);
- /* If KeSetTimer(Ex) returns FALSE then the timer is not in the system's queue (and not in ours either) */
- if (!KeSetTimer(&Timer->Timer, Timeout, &Timer->Dpc))
- {
- /* Add the timer at the head of the timer queue */
- Timer->NextDeferredTimer = Timer->Miniport->TimerQueue;
- Timer->Miniport->TimerQueue = Timer;
- }
+
+ /* Attempt to dequeue the timer */
+ DequeueMiniportTimer(Timer);
+
+ /* Add the timer at the head of the timer queue */
+ Timer->NextDeferredTimer = Timer->Miniport->TimerQueue;
+ Timer->Miniport->TimerQueue = Timer;
+
+ /* Unlock the miniport block */
KeReleaseSpinLock(&Timer->Miniport->Lock, OldIrql);
+
+ KeSetTimer(&Timer->Timer, Timeout, &Timer->Dpc);
}