Author: tfaber
Date: Wed Apr 19 14:40:53 2017
New Revision: 74378
URL: http://svn.reactos.org/svn/reactos?rev=74378&view=rev
Log:
[NTOS:MM]
- Never use special pool for prototype PTEs. Avoids "(PointerPte >= (PMMPTE)MmPagedPoolStart) && (PointerPte <= (PMMPTE)MmPagedPoolEnd)" assertion failure in MiDecrementShareCount.
CORE-11474
Modified:
trunk/reactos/ntoskrnl/mm/ARM3/special.c
Modified: trunk/reactos/ntoskrnl/mm/ARM3/special.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/mm/ARM3/special.c…
==============================================================================
--- trunk/reactos/ntoskrnl/mm/ARM3/special.c [iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/mm/ARM3/special.c [iso-8859-1] Wed Apr 19 14:40:53 2017
@@ -275,6 +275,13 @@
0x30);
}
+ /* Some allocations from Mm must never use special pool */
+ if (Tag == 'tSmM')
+ {
+ /* Reject and let normal pool handle it */
+ return NULL;
+ }
+
/* TODO: Take into account various limitations */
/* Heed the maximum limit of nonpaged pages */
Author: tfaber
Date: Wed Apr 19 12:21:57 2017
New Revision: 74375
URL: http://svn.reactos.org/svn/reactos?rev=74375&view=rev
Log:
[KMTESTS:OB]
- After ObCreateObject+ObInsertObject a handle close is enough to destroy the object, so do not dereference it in addition. Fixes use after free.
CORE-11474
Modified:
trunk/rostests/kmtests/ntos_ob/ObType.c
Modified: trunk/rostests/kmtests/ntos_ob/ObType.c
URL: http://svn.reactos.org/svn/reactos/trunk/rostests/kmtests/ntos_ob/ObType.c?…
==============================================================================
--- trunk/rostests/kmtests/ntos_ob/ObType.c [iso-8859-1] (original)
+++ trunk/rostests/kmtests/ntos_ob/ObType.c [iso-8859-1] Wed Apr 19 12:21:57 2017
@@ -341,9 +341,11 @@
if (!skip(ObBody[i] != NULL, "Nothing to dereference\n"))
{
if (ObHandle1[i]) CheckObject(ObHandle1[i], 3LU, 1LU);
+ Ret = ObReferenceObject(ObBody[i]);
+ if (ObHandle1[i]) CheckObject(ObHandle1[i], 4LU, 1LU);
Ret = ObDereferenceObject(ObBody[i]);
- ok_eq_longptr(Ret, (LONG_PTR)1);
- if (ObHandle1[i]) CheckObject(ObHandle1[i], 2LU, 1LU);
+ ok_eq_longptr(Ret, (LONG_PTR)2);
+ if (ObHandle1[i]) CheckObject(ObHandle1[i], 3LU, 1LU);
ObBody[i] = NULL;
}
if (!skip(ObHandle1[i] != NULL, "Nothing to close\n"))