Ros-diffs

ros-diffs@reactos.org

81390 discussions

[cwittich] 73173: [PSDK] disable SAL for WIDL as well
by cwittich＠svn.reactos.org 08 Nov '16

08 Nov '16

Author: cwittich Date: Tue Nov 8 11:33:54 2016 New Revision: 73173 URL: http://svn.reactos.org/svn/reactos?rev=73173&view=rev Log: [PSDK] disable SAL for WIDL as well Modified: trunk/reactos/sdk/include/psdk/sal.h Modified: trunk/reactos/sdk/include/psdk/sal.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/sdk/include/psdk/sal.h?rev… ============================================================================== --- trunk/reactos/sdk/include/psdk/sal.h [iso-8859-1] (original) +++ trunk/reactos/sdk/include/psdk/sal.h [iso-8859-1] Tue Nov 8 11:33:54 2016 @@ -30,7 +30,7 @@ #endif /* Disable expansion for MIDL and RC */ -#if defined(MIDL_PASS) || defined(__midl) || defined(RC_INVOKED) // [ +#if defined(MIDL_PASS) || defined(__midl) || defined(__WIDL__) || defined(RC_INVOKED) // [ #undef _PREFAST_ #endif // ]

1 0

[tfaber] 73172: [USETUP] - Critical errors are worth a debug print CORE-11819
by tfaber＠svn.reactos.org 08 Nov '16

08 Nov '16

Author: tfaber Date: Tue Nov 8 09:40:05 2016 New Revision: 73172 URL: http://svn.reactos.org/svn/reactos?rev=73172&view=rev Log: [USETUP] - Critical errors are worth a debug print CORE-11819 Modified: trunk/reactos/base/setup/usetup/cabinet.c Modified: trunk/reactos/base/setup/usetup/cabinet.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/setup/usetup/cabinet.… ============================================================================== --- trunk/reactos/base/setup/usetup/cabinet.c [iso-8859-1] (original) +++ trunk/reactos/base/setup/usetup/cabinet.c [iso-8859-1] Tue Nov 8 09:40:05 2016 @@ -529,7 +529,7 @@ if (!NT_SUCCESS(NtStatus)) { - DPRINT("Cannot open file (%S) (%x)\n", CabinetName, NtStatus); + DPRINT1("Cannot open file (%S) (%x)\n", CabinetName, NtStatus); return CAB_STATUS_CANNOT_OPEN; } @@ -544,7 +544,7 @@ if (!NT_SUCCESS(NtStatus)) { - DPRINT("NtCreateSection failed: %x\n", NtStatus); + DPRINT1("NtCreateSection failed: %x\n", NtStatus); return CAB_STATUS_NOMEMORY; } @@ -562,7 +562,7 @@ if (!NT_SUCCESS(NtStatus)) { - DPRINT("NtMapViewOfSection failed: %x\n", NtStatus); + DPRINT1("NtMapViewOfSection failed: %x\n", NtStatus); return CAB_STATUS_NOMEMORY; } @@ -578,7 +578,7 @@ PCABHeader->FileTableOffset < sizeof(CFHEADER)) { CloseCabinet(); - DPRINT("File has invalid header\n"); + DPRINT1("File has invalid header\n"); return CAB_STATUS_INVALID_CAB; } @@ -932,13 +932,13 @@ if (!NT_SUCCESS(NtStatus)) { - DPRINT("NtCreateFile() failed (%S) (%x)\n", DestName, NtStatus); + DPRINT1("NtCreateFile() failed (%S) (%x)\n", DestName, NtStatus); return CAB_STATUS_CANNOT_CREATE; } } else { - DPRINT("File (%S) exists\n", DestName); + DPRINT1("File (%S) exists\n", DestName); return CAB_STATUS_FILE_EXISTS; } } @@ -954,7 +954,7 @@ if (!NT_SUCCESS(NtStatus)) { - DPRINT("NtCreateSection failed: %x\n", NtStatus); + DPRINT1("NtCreateSection failed: %x\n", NtStatus); Status = CAB_STATUS_NOMEMORY; goto CloseDestFile; } @@ -972,7 +972,7 @@ if (!NT_SUCCESS(NtStatus)) { - DPRINT("NtMapViewOfSection failed: %x\n", NtStatus); + DPRINT1("NtMapViewOfSection failed: %x\n", NtStatus); Status = CAB_STATUS_NOMEMORY; goto CloseDestFileSection; } @@ -982,7 +982,7 @@ Search->File->FileTime, &FileTime)) { - DPRINT("DosDateTimeToFileTime() failed\n"); + DPRINT1("DosDateTimeToFileTime() failed\n"); Status = CAB_STATUS_CANNOT_WRITE; goto UnmapDestFile; }

1 0

[hbelusca] 73171: [NTOS]: Fix MmPt and DOPE tags.
by hbelusca＠svn.reactos.org 07 Nov '16

07 Nov '16

Author: hbelusca Date: Mon Nov 7 20:41:24 2016 New Revision: 73171 URL: http://svn.reactos.org/svn/reactos?rev=73171&view=rev Log: [NTOS]: Fix MmPt and DOPE tags. Modified: trunk/reactos/ntoskrnl/cache/section/sptab.c trunk/reactos/ntoskrnl/po/povolume.c Modified: trunk/reactos/ntoskrnl/cache/section/sptab.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/cache/section/spt… ============================================================================== --- trunk/reactos/ntoskrnl/cache/section/sptab.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/cache/section/sptab.c [iso-8859-1] Mon Nov 7 20:41:24 2016 @@ -71,7 +71,7 @@ MiSectionPageTableAllocate(PRTL_GENERIC_TABLE Table, CLONG Bytes) { PVOID Result; - Result = ExAllocatePoolWithTag(NonPagedPool, Bytes, 'MmPt'); + Result = ExAllocatePoolWithTag(NonPagedPool, Bytes, 'tPmM'); //DPRINT("MiSectionPageTableAllocate(%d) => %p\n", Bytes, Result); return Result; } @@ -83,7 +83,7 @@ MiSectionPageTableFree(PRTL_GENERIC_TABLE Table, PVOID Data) { //DPRINT("MiSectionPageTableFree(%p)\n", Data); - ExFreePoolWithTag(Data, 'MmPt'); + ExFreePoolWithTag(Data, 'tPmM'); } _Function_class_(RTL_GENERIC_COMPARE_ROUTINE) Modified: trunk/reactos/ntoskrnl/po/povolume.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/po/povolume.c?rev… ============================================================================== --- trunk/reactos/ntoskrnl/po/povolume.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/po/povolume.c [iso-8859-1] Mon Nov 7 20:41:24 2016 @@ -27,6 +27,8 @@ LIST_ENTRY PopVolumeDevices; KSPIN_LOCK PopDopeGlobalLock; +#define TAG_PO_DOPE 'EPOD' + /* PRIVATE FUNCTIONS *********************************************************/ PDEVICE_OBJECT_POWER_EXTENSION @@ -45,7 +47,7 @@ /* Allocate some dope for the device */ Dope = ExAllocatePoolWithTag(NonPagedPool, sizeof(DEVICE_OBJECT_POWER_EXTENSION), - 'Dope'); + TAG_PO_DOPE); if (!Dope) goto Return; /* Initialize the initial contents of the dope */ @@ -69,7 +71,7 @@ KeReleaseSpinLock(&PopDopeGlobalLock, OldIrql); /* Check if someone other than us already assigned the dope, so free ours */ - if (Dope) ExFreePoolWithTag(Dope, 'Dope'); + if (Dope) ExFreePoolWithTag(Dope, TAG_PO_DOPE); /* Return the dope to the caller */ Return: @@ -140,7 +142,7 @@ KeReleaseSpinLock(&PopDopeGlobalLock, OldIrql); /* Free dope */ - ExFreePoolWithTag(Dope, 'Dope'); + ExFreePoolWithTag(Dope, TAG_PO_DOPE); } VOID

1 0

[hbelusca] 73170: [NTOS:IO]: IopCreateDriver(): Set the returned DriverObject value only in case of success.
by hbelusca＠svn.reactos.org 07 Nov '16

07 Nov '16

Author: hbelusca Date: Mon Nov 7 15:51:56 2016 New Revision: 73170 URL: http://svn.reactos.org/svn/reactos?rev=73170&view=rev Log: [NTOS:IO]: IopCreateDriver(): Set the returned DriverObject value only in case of success. Modified: trunk/reactos/ntoskrnl/io/iomgr/driver.c Modified: trunk/reactos/ntoskrnl/io/iomgr/driver.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/io/iomgr/driver.c… ============================================================================== --- trunk/reactos/ntoskrnl/io/iomgr/driver.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/io/iomgr/driver.c [iso-8859-1] Mon Nov 7 15:51:56 2016 @@ -527,12 +527,13 @@ RtlFreeUnicodeString(&RegistryKey); RtlFreeUnicodeString(&DriverName); - *DriverObject = Driver; if (!NT_SUCCESS(Status)) { DPRINT("IopCreateDriver() failed (Status 0x%08lx)\n", Status); return Status; } + + *DriverObject = Driver; MmFreeDriverInitialization((PLDR_DATA_TABLE_ENTRY)Driver->DriverSection); @@ -1426,7 +1427,7 @@ &DriverReinitListLock); while (Entry) { - /* Get the item*/ + /* Get the item */ ReinitItem = CONTAINING_RECORD(Entry, DRIVER_REINIT_ITEM, ItemEntry); /* Increment reinitialization counter */ @@ -1462,7 +1463,7 @@ &DriverBootReinitListLock); while (Entry) { - /* Get the item*/ + /* Get the item */ ReinitItem = CONTAINING_RECORD(Entry, DRIVER_REINIT_ITEM, ItemEntry); /* Increment reinitialization counter */ @@ -1510,7 +1511,7 @@ /* First, create a unique name for the driver if we don't have one */ if (!DriverName) { - /* Create a random name and set up the string*/ + /* Create a random name and set up the string */ NameLength = (USHORT)swprintf(NameBuffer, DRIVER_ROOT_NAME L"%08u", KeTickCount.LowPart);

1 0

[hbelusca] 73169: [TCPIP] - Enable logging now that IoWriteErrorLogEntry works. - Check for log event size before calling IoAllocateErrorLogEntry. - Reduce code indentation in the logging function.
by hbelusca＠svn.reactos.org 07 Nov '16

07 Nov '16

Author: hbelusca Date: Mon Nov 7 15:48:34 2016 New Revision: 73169 URL: http://svn.reactos.org/svn/reactos?rev=73169&view=rev Log: [TCPIP] - Enable logging now that IoWriteErrorLogEntry works. - Check for log event size before calling IoAllocateErrorLogEntry. - Reduce code indentation in the logging function. Modified: trunk/reactos/drivers/network/tcpip/tcpip/main.c Modified: trunk/reactos/drivers/network/tcpip/tcpip/main.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/network/tcpip/tcpi… ============================================================================== --- trunk/reactos/drivers/network/tcpip/tcpip/main.c [iso-8859-1] (original) +++ trunk/reactos/drivers/network/tcpip/tcpip/main.c [iso-8859-1] Mon Nov 7 15:48:34 2016 @@ -50,7 +50,6 @@ * DumpData = Pointer to dump data for the log entry */ { -#if 0 PIO_ERROR_LOG_PACKET LogEntry; UCHAR EntrySize; ULONG StringSize; @@ -65,35 +64,37 @@ EntrySize += (UCHAR)StringSize; } - LogEntry = (PIO_ERROR_LOG_PACKET)IoAllocateErrorLogEntry( - DriverContext, EntrySize); - - if (LogEntry) { - LogEntry->MajorFunctionCode = -1; - LogEntry->RetryCount = -1; - LogEntry->DumpDataSize = (USHORT)(DumpDataCount * sizeof(ULONG)); - LogEntry->NumberOfStrings = (String == NULL) ? 1 : 2; - LogEntry->StringOffset = sizeof(IO_ERROR_LOG_PACKET) + (DumpDataCount-1) * sizeof(ULONG); - LogEntry->EventCategory = 0; - LogEntry->ErrorCode = ErrorCode; - LogEntry->UniqueErrorValue = UniqueErrorValue; - LogEntry->FinalStatus = FinalStatus; - LogEntry->SequenceNumber = -1; - LogEntry->IoControlCode = 0; - - if (DumpDataCount) - RtlCopyMemory(LogEntry->DumpData, DumpData, DumpDataCount * sizeof(ULONG)); - - pString = ((PUCHAR)LogEntry) + LogEntry->StringOffset; - RtlCopyMemory(pString, DriverName, sizeof(DriverName)); - pString += sizeof(DriverName); - - if (String) - RtlCopyMemory(pString, String, StringSize); - - IoWriteErrorLogEntry(LogEntry); - } -#endif + /* Fail if the required error log entry is too large */ + if (EntrySize > ERROR_LOG_MAXIMUM_SIZE) + return; + + LogEntry = (PIO_ERROR_LOG_PACKET)IoAllocateErrorLogEntry(DriverContext, EntrySize); + if (!LogEntry) + return; + + LogEntry->MajorFunctionCode = -1; + LogEntry->RetryCount = -1; + LogEntry->DumpDataSize = (USHORT)(DumpDataCount * sizeof(ULONG)); + LogEntry->NumberOfStrings = (String == NULL) ? 1 : 2; + LogEntry->StringOffset = sizeof(IO_ERROR_LOG_PACKET) + (DumpDataCount * sizeof(ULONG)); + LogEntry->EventCategory = 0; + LogEntry->ErrorCode = ErrorCode; + LogEntry->UniqueErrorValue = UniqueErrorValue; + LogEntry->FinalStatus = FinalStatus; + LogEntry->SequenceNumber = -1; + LogEntry->IoControlCode = 0; + + if (DumpDataCount) + RtlCopyMemory(LogEntry->DumpData, DumpData, DumpDataCount * sizeof(ULONG)); + + pString = ((PUCHAR)LogEntry) + LogEntry->StringOffset; + RtlCopyMemory(pString, DriverName, sizeof(DriverName)); + pString += sizeof(DriverName); + + if (String) + RtlCopyMemory(pString, String, StringSize); + + IoWriteErrorLogEntry(LogEntry); } /*

1 0

[hbelusca] 73168: [NTOS:IO]: An improvement for the total log size check (addendum to r73167).
by hbelusca＠svn.reactos.org 07 Nov '16

07 Nov '16

Author: hbelusca Date: Mon Nov 7 13:57:11 2016 New Revision: 73168 URL: http://svn.reactos.org/svn/reactos?rev=73168&view=rev Log: [NTOS:IO]: An improvement for the total log size check (addendum to r73167). Modified: trunk/reactos/ntoskrnl/io/iomgr/error.c Modified: trunk/reactos/ntoskrnl/io/iomgr/error.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/io/iomgr/error.c?… ============================================================================== --- trunk/reactos/ntoskrnl/io/iomgr/error.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/io/iomgr/error.c [iso-8859-1] Mon Nov 7 13:57:11 2016 @@ -554,10 +554,6 @@ return NULL; } - /* Check if we're past our buffer */ - // FIXME/TODO: Perform the checks by taking into account EntrySize. - if (IopTotalLogSize > IOP_MAXIMUM_LOG_SIZE) return NULL; - /* Check whether the size is too small or too large */ if ((EntrySize < sizeof(IO_ERROR_LOG_PACKET)) || (EntrySize > ERROR_LOG_MAXIMUM_SIZE)) @@ -566,11 +562,15 @@ return NULL; } - /* Round up the size */ + /* Round up the size and calculate the total size */ EntrySize = ROUND_UP(EntrySize, sizeof(PVOID)); - - /* Calculate the total size and allocate it */ LogEntrySize = sizeof(ERROR_LOG_ENTRY) + EntrySize; + + /* Check if we're past our buffer */ + // TODO: Improve (what happens in case of concurrent calls?) + if (IopTotalLogSize + LogEntrySize > IOP_MAXIMUM_LOG_SIZE) return NULL; + + /* Allocate the entry */ LogEntry = ExAllocatePoolWithTag(NonPagedPool, LogEntrySize, TAG_ERROR_LOG);

1 0

[hbelusca] 73167: [NTOS:IO][INCLUDES][EVENTLOG]: Fix support for event logging through the "ErrorLogPort" LPC. See the details in CORE-12301 #resolve
by hbelusca＠svn.reactos.org 07 Nov '16

07 Nov '16

Author: hbelusca Date: Mon Nov 7 13:29:09 2016 New Revision: 73167 URL: http://svn.reactos.org/svn/reactos?rev=73167&view=rev Log: [NTOS:IO][INCLUDES][EVENTLOG]: Fix support for event logging through the "ErrorLogPort" LPC. See the details in CORE-12301 #resolve Added: trunk/reactos/sdk/include/reactos/subsys/iolog/ trunk/reactos/sdk/include/reactos/subsys/iolog/iolog.h (with props) Modified: trunk/reactos/base/services/eventlog/CMakeLists.txt trunk/reactos/base/services/eventlog/eventlog.c trunk/reactos/base/services/eventlog/eventlog.h trunk/reactos/base/services/eventlog/file.c trunk/reactos/base/services/eventlog/logport.c trunk/reactos/base/services/eventlog/rpc.c trunk/reactos/ntoskrnl/include/internal/io.h trunk/reactos/ntoskrnl/io/iomgr/error.c Modified: trunk/reactos/base/services/eventlog/CMakeLists.txt URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/services/eventlog/CMa… ============================================================================== --- trunk/reactos/base/services/eventlog/CMakeLists.txt [iso-8859-1] (original) +++ trunk/reactos/base/services/eventlog/CMakeLists.txt [iso-8859-1] Mon Nov 7 13:29:09 2016 @@ -1,6 +1,7 @@ include_directories( ${REACTOS_SOURCE_DIR}/sdk/lib/evtlib + ${REACTOS_SOURCE_DIR}/sdk/include/reactos/subsys ${REACTOS_SOURCE_DIR}/sdk/include/reactos/idl ${CMAKE_CURRENT_BINARY_DIR}) Modified: trunk/reactos/base/services/eventlog/eventlog.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/services/eventlog/eve… ============================================================================== --- trunk/reactos/base/services/eventlog/eventlog.c [iso-8859-1] (original) +++ trunk/reactos/base/services/eventlog/eventlog.c [iso-8859-1] Mon Nov 7 13:29:09 2016 @@ -548,71 +548,73 @@ LARGE_INTEGER SystemTime; TIME_FIELDS Time; - DPRINT("Length = %lu\n", pRec->Length); - DPRINT("Reserved = 0x%x\n", pRec->Reserved); - DPRINT("RecordNumber = %lu\n", pRec->RecordNumber); + DPRINT1("PRINT_RECORD(0x%p)\n", pRec); + + DbgPrint("Length = %lu\n", pRec->Length); + DbgPrint("Reserved = 0x%x\n", pRec->Reserved); + DbgPrint("RecordNumber = %lu\n", pRec->RecordNumber); RtlSecondsSince1970ToTime(pRec->TimeGenerated, &SystemTime); RtlTimeToTimeFields(&SystemTime, &Time); - DPRINT("TimeGenerated = %hu.%hu.%hu %hu:%hu:%hu\n", - Time.Day, Time.Month, Time.Year, - Time.Hour, Time.Minute, Time.Second); + DbgPrint("TimeGenerated = %hu.%hu.%hu %hu:%hu:%hu\n", + Time.Day, Time.Month, Time.Year, + Time.Hour, Time.Minute, Time.Second); RtlSecondsSince1970ToTime(pRec->TimeWritten, &SystemTime); RtlTimeToTimeFields(&SystemTime, &Time); - DPRINT("TimeWritten = %hu.%hu.%hu %hu:%hu:%hu\n", - Time.Day, Time.Month, Time.Year, - Time.Hour, Time.Minute, Time.Second); - - DPRINT("EventID = %lu\n", pRec->EventID); + DbgPrint("TimeWritten = %hu.%hu.%hu %hu:%hu:%hu\n", + Time.Day, Time.Month, Time.Year, + Time.Hour, Time.Minute, Time.Second); + + DbgPrint("EventID = %lu\n", pRec->EventID); switch (pRec->EventType) { case EVENTLOG_ERROR_TYPE: - DPRINT("EventType = EVENTLOG_ERROR_TYPE\n"); + DbgPrint("EventType = EVENTLOG_ERROR_TYPE\n"); break; case EVENTLOG_WARNING_TYPE: - DPRINT("EventType = EVENTLOG_WARNING_TYPE\n"); + DbgPrint("EventType = EVENTLOG_WARNING_TYPE\n"); break; case EVENTLOG_INFORMATION_TYPE: - DPRINT("EventType = EVENTLOG_INFORMATION_TYPE\n"); + DbgPrint("EventType = EVENTLOG_INFORMATION_TYPE\n"); break; case EVENTLOG_AUDIT_SUCCESS: - DPRINT("EventType = EVENTLOG_AUDIT_SUCCESS\n"); + DbgPrint("EventType = EVENTLOG_AUDIT_SUCCESS\n"); break; case EVENTLOG_AUDIT_FAILURE: - DPRINT("EventType = EVENTLOG_AUDIT_FAILURE\n"); + DbgPrint("EventType = EVENTLOG_AUDIT_FAILURE\n"); break; default: - DPRINT("EventType = %hu\n", pRec->EventType); - } - - DPRINT("NumStrings = %hu\n", pRec->NumStrings); - DPRINT("EventCategory = %hu\n", pRec->EventCategory); - DPRINT("ReservedFlags = 0x%x\n", pRec->ReservedFlags); - DPRINT("ClosingRecordNumber = %lu\n", pRec->ClosingRecordNumber); - DPRINT("StringOffset = %lu\n", pRec->StringOffset); - DPRINT("UserSidLength = %lu\n", pRec->UserSidLength); - DPRINT("UserSidOffset = %lu\n", pRec->UserSidOffset); - DPRINT("DataLength = %lu\n", pRec->DataLength); - DPRINT("DataOffset = %lu\n", pRec->DataOffset); - - DPRINT("SourceName: %S\n", (PWSTR)((ULONG_PTR)pRec + sizeof(EVENTLOGRECORD))); - - i = (wcslen((PWSTR)((ULONG_PTR)pRec + sizeof(EVENTLOGRECORD))) + 1) * sizeof(WCHAR); - - DPRINT("ComputerName: %S\n", (PWSTR)((ULONG_PTR)pRec + sizeof(EVENTLOGRECORD) + i)); + DbgPrint("EventType = %hu\n", pRec->EventType); + } + + DbgPrint("NumStrings = %hu\n", pRec->NumStrings); + DbgPrint("EventCategory = %hu\n", pRec->EventCategory); + DbgPrint("ReservedFlags = 0x%x\n", pRec->ReservedFlags); + DbgPrint("ClosingRecordNumber = %lu\n", pRec->ClosingRecordNumber); + DbgPrint("StringOffset = %lu\n", pRec->StringOffset); + DbgPrint("UserSidLength = %lu\n", pRec->UserSidLength); + DbgPrint("UserSidOffset = %lu\n", pRec->UserSidOffset); + DbgPrint("DataLength = %lu\n", pRec->DataLength); + DbgPrint("DataOffset = %lu\n", pRec->DataOffset); + + i = sizeof(EVENTLOGRECORD); + DbgPrint("SourceName: %S\n", (PWSTR)((ULONG_PTR)pRec + i)); + + i += (wcslen((PWSTR)((ULONG_PTR)pRec + i)) + 1) * sizeof(WCHAR); + DbgPrint("ComputerName: %S\n", (PWSTR)((ULONG_PTR)pRec + i)); if (pRec->StringOffset < pRec->Length && pRec->NumStrings) { - DPRINT("Strings:\n"); + DbgPrint("Strings:\n"); str = (PWSTR)((ULONG_PTR)pRec + pRec->StringOffset); for (i = 0; i < pRec->NumStrings; i++) { - DPRINT("[%u] %S\n", i, str); + DbgPrint("[%u] %S\n", i, str); str += wcslen(str) + 1; } } - DPRINT("Length2 = %lu\n", *(PULONG)((ULONG_PTR)pRec + pRec->Length - 4)); -} + DbgPrint("Length2 = %lu\n", *(PULONG)((ULONG_PTR)pRec + pRec->Length - 4)); +} Modified: trunk/reactos/base/services/eventlog/eventlog.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/services/eventlog/eve… ============================================================================== --- trunk/reactos/base/services/eventlog/eventlog.h [iso-8859-1] (original) +++ trunk/reactos/base/services/eventlog/eventlog.h [iso-8859-1] Mon Nov 7 13:29:09 2016 @@ -27,15 +27,6 @@ #include <eventlogrpc_s.h> #include <strsafe.h> - -// FIXME: For that we may directly include NTOS header?? -typedef struct _IO_ERROR_LPC -{ - PORT_MESSAGE Header; - IO_ERROR_LOG_MESSAGE Message; -} IO_ERROR_LPC, *PIO_ERROR_LPC; - -// C_ASSERT(sizeof(IO_ERROR_LPC) == 0x100); /* Defined in evtlib.h */ // #define LOGFILE_SIGNATURE 0x654c664c // "LfLe" @@ -140,8 +131,8 @@ USHORT wType, USHORT wCategory, ULONG dwEventId, - PCWSTR SourceName, - PCWSTR ComputerName, + PUNICODE_STRING SourceName, + PUNICODE_STRING ComputerName, ULONG dwSidLength, PSID pUserSid, USHORT wNumStrings, Modified: trunk/reactos/base/services/eventlog/file.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/services/eventlog/fil… ============================================================================== --- trunk/reactos/base/services/eventlog/file.c [iso-8859-1] (original) +++ trunk/reactos/base/services/eventlog/file.c [iso-8859-1] Mon Nov 7 13:29:09 2016 @@ -898,8 +898,8 @@ USHORT wType, USHORT wCategory, ULONG dwEventId, - PCWSTR SourceName, - PCWSTR ComputerName, + PUNICODE_STRING SourceName, + PUNICODE_STRING ComputerName, ULONG dwSidLength, PSID pUserSid, USHORT wNumStrings, @@ -908,16 +908,17 @@ PVOID pRawData) { SIZE_T RecSize; + SIZE_T SourceNameSize, ComputerNameSize, StringLen; PBYTE Buffer; PEVENTLOGRECORD pRec; PWSTR str; UINT i, pos; - SIZE_T SourceNameLen, ComputerNameLen, StringLen; - - SourceNameLen = (SourceName ? wcslen(SourceName) : 0) + 1; - ComputerNameLen = (ComputerName ? wcslen(ComputerName) : 0) + 1; - - RecSize = sizeof(EVENTLOGRECORD) + (SourceNameLen + ComputerNameLen) * sizeof(WCHAR); + + SourceNameSize = (SourceName && SourceName->Buffer) ? SourceName->Length : 0; + ComputerNameSize = (ComputerName && ComputerName->Buffer) ? ComputerName->Length : 0; + + RecSize = sizeof(EVENTLOGRECORD) + /* Add the sizes of the strings, NULL-terminated */ + SourceNameSize + ComputerNameSize + 2*sizeof(UNICODE_NULL); /* Align on DWORD boundary for the SID */ RecSize = ROUND_UP(RecSize, sizeof(ULONG)); @@ -975,12 +976,19 @@ pos = sizeof(EVENTLOGRECORD); - if (SourceName) - StringCchCopyW((PWSTR)(Buffer + pos), SourceNameLen, SourceName); - pos += SourceNameLen * sizeof(WCHAR); - if (ComputerName) - StringCchCopyW((PWSTR)(Buffer + pos), ComputerNameLen, ComputerName); - pos += ComputerNameLen * sizeof(WCHAR); + /* NOTE: Equivalents of RtlStringCbCopyUnicodeString calls */ + if (SourceNameSize) + { + StringCbCopyNW((PWSTR)(Buffer + pos), SourceNameSize + sizeof(UNICODE_NULL), + SourceName->Buffer, SourceNameSize); + } + pos += SourceNameSize + sizeof(UNICODE_NULL); + if (ComputerNameSize) + { + StringCbCopyNW((PWSTR)(Buffer + pos), ComputerNameSize + sizeof(UNICODE_NULL), + ComputerName->Buffer, ComputerNameSize); + } + pos += ComputerNameSize + sizeof(UNICODE_NULL); /* Align on DWORD boundary for the SID */ pos = ROUND_UP(pos, sizeof(ULONG)); @@ -1035,20 +1043,24 @@ PVOID pRawData) { NTSTATUS Status; - WCHAR szComputerName[MAX_COMPUTERNAME_LENGTH + 1]; - DWORD dwComputerNameLength = MAX_COMPUTERNAME_LENGTH + 1; + UNICODE_STRING SourceName, ComputerName; PEVENTLOGRECORD LogBuffer; LARGE_INTEGER SystemTime; ULONG Time; SIZE_T RecSize; + DWORD dwComputerNameLength; + WCHAR szComputerName[MAX_COMPUTERNAME_LENGTH + 1]; if (!EventLogSource) return; + RtlInitUnicodeString(&SourceName, EventLogSource->szName); + + dwComputerNameLength = ARRAYSIZE(szComputerName); if (!GetComputerNameW(szComputerName, &dwComputerNameLength)) - { szComputerName[0] = L'\0'; - } + + RtlInitUnicodeString(&ComputerName, szComputerName); NtQuerySystemTime(&SystemTime); RtlTimeToSecondsSince1970(&SystemTime, &Time); @@ -1058,14 +1070,19 @@ wType, wCategory, dwEventId, - EventLogSource->szName, - szComputerName, + &SourceName, + &ComputerName, 0, NULL, wNumStrings, pStrings, dwDataSize, pRawData); + if (LogBuffer == NULL) + { + DPRINT1("LogfAllocAndBuildNewRecord failed!\n"); + return; + } Status = LogfWriteRecord(EventLogSource->LogFile, LogBuffer, RecSize); if (!NT_SUCCESS(Status)) Modified: trunk/reactos/base/services/eventlog/logport.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/services/eventlog/log… ============================================================================== --- trunk/reactos/base/services/eventlog/logport.c [iso-8859-1] (original) +++ trunk/reactos/base/services/eventlog/logport.c [iso-8859-1] Mon Nov 7 13:29:09 2016 @@ -11,6 +11,7 @@ #include "eventlog.h" #include <ndk/lpcfuncs.h> +#include <iolog/iolog.h> #define NDEBUG #include <debug.h> @@ -46,22 +47,20 @@ NTSTATUS InitLogPort(VOID) { NTSTATUS Status; - UNICODE_STRING PortName; + UNICODE_STRING PortName = RTL_CONSTANT_STRING(ELF_PORT_NAME); OBJECT_ATTRIBUTES ObjectAttributes; PORT_MESSAGE Request; ConnectPortHandle = NULL; MessagePortHandle = NULL; - RtlInitUnicodeString(&PortName, L"\\ErrorLogPort"); InitializeObjectAttributes(&ObjectAttributes, &PortName, 0, NULL, NULL); Status = NtCreatePort(&ConnectPortHandle, &ObjectAttributes, 0, - 0x100, - 0x2000); - + PORT_MAXIMUM_MESSAGE_LENGTH, // IO_ERROR_LOG_MESSAGE_LENGTH, + 2 * PAGE_SIZE); if (!NT_SUCCESS(Status)) { DPRINT1("NtCreatePort() failed (Status %lx)\n", Status); @@ -76,7 +75,7 @@ } Status = NtAcceptConnectPort(&MessagePortHandle, ConnectPortHandle, - NULL, TRUE, NULL, NULL); + &Request, TRUE, NULL, NULL); if (!NT_SUCCESS(Status)) { DPRINT1("NtAcceptConnectPort() failed (Status %lx)\n", Status); @@ -105,14 +104,17 @@ NTSTATUS ProcessPortMessage(VOID) { NTSTATUS Status; - IO_ERROR_LPC Request; - PIO_ERROR_LOG_MESSAGE Message; + PLOGFILE SystemLog = NULL; + UCHAR Buffer[PORT_MAXIMUM_MESSAGE_LENGTH]; // IO_ERROR_LOG_MESSAGE_LENGTH + PELF_API_MSG Message = (PELF_API_MSG)Buffer; + PIO_ERROR_LOG_MESSAGE ErrorMessage; + PEVENTLOGRECORD LogBuffer; + SIZE_T RecSize; ULONG Time; - PEVENTLOGRECORD pRec; - SIZE_T RecSize; - PLOGFILE SystemLog = NULL; + USHORT EventType; + UNICODE_STRING SourceName, ComputerName; + DWORD dwComputerNameLength; WCHAR szComputerName[MAX_COMPUTERNAME_LENGTH + 1]; - DWORD dwComputerNameLength = MAX_COMPUTERNAME_LENGTH + 1; DPRINT("ProcessPortMessage() called\n"); @@ -121,9 +123,9 @@ while (TRUE) { Status = NtReplyWaitReceivePort(MessagePortHandle, - 0, NULL, - &Request.Header); + NULL, + &Message->Header); if (!NT_SUCCESS(Status)) { @@ -133,69 +135,108 @@ DPRINT("Received message\n"); - if (Request.Header.u2.s2.Type == LPC_PORT_CLOSED) + if (Message->Header.u2.s2.Type == LPC_PORT_CLOSED) { DPRINT("Port closed\n"); return STATUS_SUCCESS; } - if (Request.Header.u2.s2.Type == LPC_REQUEST) + if (Message->Header.u2.s2.Type == LPC_REQUEST) { DPRINT("Received request\n"); } - else if (Request.Header.u2.s2.Type == LPC_DATAGRAM) - { - DPRINT("Received datagram\n"); - // Message = (PIO_ERROR_LOG_MESSAGE)&Request.Message; - Message = &Request.Message; - + else if (Message->Header.u2.s2.Type == LPC_DATAGRAM) + { + DPRINT("Received datagram (0x%x, 0x%x)\n", + Message->Unknown[0], Message->Unknown[1]); + ErrorMessage = &Message->IoErrorMessage; + + // ASSERT(ErrorMessage->Type == IO_TYPE_ERROR_MESSAGE); + + RtlInitEmptyUnicodeString(&SourceName, NULL, 0); + if (ErrorMessage->DriverNameLength > sizeof(UNICODE_NULL)) // DriverNameLength counts NULL-terminator + { + SourceName.Buffer = (PWSTR)((ULONG_PTR)ErrorMessage + ErrorMessage->DriverNameOffset); + SourceName.MaximumLength = ErrorMessage->DriverNameLength; + SourceName.Length = SourceName.MaximumLength - sizeof(UNICODE_NULL); + } + + dwComputerNameLength = ARRAYSIZE(szComputerName); if (!GetComputerNameW(szComputerName, &dwComputerNameLength)) - { szComputerName[0] = L'\0'; - } - - RtlTimeToSecondsSince1970(&Message->TimeStamp, &Time); - - // TODO: Log more information?? - - pRec = LogfAllocAndBuildNewRecord( - &RecSize, - Time, - Message->Type, - Message->EntryData.EventCategory, - Message->EntryData.ErrorCode, - (PWSTR)((ULONG_PTR)Message + Message->DriverNameOffset), // FIXME: Use DriverNameLength too! - szComputerName, - 0, - NULL, - Message->EntryData.NumberOfStrings, - (PWSTR)((ULONG_PTR)Message + Message->EntryData.StringOffset), - Message->EntryData.DumpDataSize, - (PVOID)((ULONG_PTR)Message + FIELD_OFFSET(IO_ERROR_LOG_PACKET, DumpData))); - - if (pRec == NULL) - { - DPRINT("LogfAllocAndBuildNewRecord failed!\n"); - return STATUS_NO_MEMORY; - } - - DPRINT("RecSize = %d\n", RecSize); - - DPRINT("\n --- EVENTLOG RECORD ---\n"); - PRINT_RECORD(pRec); - DPRINT("\n"); + + RtlInitUnicodeString(&ComputerName, szComputerName); + + RtlTimeToSecondsSince1970(&ErrorMessage->TimeStamp, &Time); + + /* Set the event type based on the error code severity */ + EventType = (USHORT)(ErrorMessage->EntryData.ErrorCode >> 30); + if (EventType == STATUS_SEVERITY_SUCCESS) + { + EventType = EVENTLOG_SUCCESS; + } + else if (EventType == STATUS_SEVERITY_INFORMATIONAL) // NT_INFORMATION + { + EventType = EVENTLOG_INFORMATION_TYPE; + } + else if (EventType == STATUS_SEVERITY_WARNING) // NT_WARNING + { + EventType = EVENTLOG_WARNING_TYPE; + } + else if (EventType == STATUS_SEVERITY_ERROR) // NT_ERROR + { + EventType = EVENTLOG_ERROR_TYPE; + } + else + { + /* Unknown severity, set to error */ + EventType = EVENTLOG_ERROR_TYPE; + } + + /* + * The data being saved consists of the IO_ERROR_LOG_PACKET structure + * header, plus the additional raw data from the driver. + */ + LogBuffer = LogfAllocAndBuildNewRecord( + &RecSize, + Time, + EventType, + ErrorMessage->EntryData.EventCategory, + ErrorMessage->EntryData.ErrorCode, + &SourceName, + &ComputerName, + 0, + NULL, + ErrorMessage->EntryData.NumberOfStrings, + (PWSTR)((ULONG_PTR)ErrorMessage + + ErrorMessage->EntryData.StringOffset), + FIELD_OFFSET(IO_ERROR_LOG_PACKET, DumpData) + + ErrorMessage->EntryData.DumpDataSize, + (PVOID)&ErrorMessage->EntryData); + if (LogBuffer == NULL) + { + DPRINT1("LogfAllocAndBuildNewRecord failed!\n"); + // return STATUS_NO_MEMORY; + continue; + } if (!onLiveCD && SystemLog) { - Status = LogfWriteRecord(SystemLog, pRec, RecSize); + Status = LogfWriteRecord(SystemLog, LogBuffer, RecSize); if (!NT_SUCCESS(Status)) { DPRINT1("ERROR writing to event log `%S' (Status 0x%08lx)\n", SystemLog->LogName, Status); } } - - LogfFreeRecord(pRec); + else + { + DPRINT1("\n--- EVENTLOG RECORD ---\n"); + PRINT_RECORD(LogBuffer); + DPRINT1("\n"); + } + + LogfFreeRecord(LogBuffer); } } Modified: trunk/reactos/base/services/eventlog/rpc.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/services/eventlog/rpc… ============================================================================== --- trunk/reactos/base/services/eventlog/rpc.c [iso-8859-1] (original) +++ trunk/reactos/base/services/eventlog/rpc.c [iso-8859-1] Mon Nov 7 13:29:09 2016 @@ -586,6 +586,7 @@ { NTSTATUS Status; PLOGHANDLE pLogHandle; + UNICODE_STRING LocalSourceName, LocalComputerName; PEVENTLOGRECORD LogBuffer; USHORT i; SIZE_T RecSize; @@ -655,21 +656,32 @@ if (UserSID) dwUserSidLength = FIELD_OFFSET(SID, SubAuthority[UserSID->SubAuthorityCount]); + if (SourceName && SourceName->Buffer) + LocalSourceName = *(PUNICODE_STRING)SourceName; + else + RtlInitUnicodeString(&LocalSourceName, pLogHandle->szName); + + LocalComputerName = *(PUNICODE_STRING)ComputerName; + LogBuffer = LogfAllocAndBuildNewRecord(&RecSize, Time, EventType, EventCategory, EventID, - (SourceName && SourceName->Buffer) - ? SourceName->Buffer - : pLogHandle->szName, - ComputerName->Buffer, + &LocalSourceName, + &LocalComputerName, dwUserSidLength, UserSID, NumStrings, lpStrings, DataSize, Data); + if (LogBuffer == NULL) + { + DPRINT1("LogfAllocAndBuildNewRecord failed!\n"); + HeapFree(GetProcessHeap(), 0, lpStrings); + return STATUS_NO_MEMORY; + } Status = LogfWriteRecord(pLogHandle->LogFile, LogBuffer, RecSize); if (!NT_SUCCESS(Status)) Modified: trunk/reactos/ntoskrnl/include/internal/io.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/include/internal/… ============================================================================== --- trunk/reactos/ntoskrnl/include/internal/io.h [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/include/internal/io.h [iso-8859-1] Mon Nov 7 13:29:09 2016 @@ -5,6 +5,7 @@ * PURPOSE: Internal header for the I/O Manager * PROGRAMMERS: Alex Ionescu (alex.ionescu(a)reactos.org) */ + #include "ntdddisk.h" // @@ -331,16 +332,6 @@ PDRIVER_OBJECT DriverObject; LARGE_INTEGER TimeStamp; } ERROR_LOG_ENTRY, *PERROR_LOG_ENTRY; - -// -// Event Log LPC Message -// -typedef struct _ELF_API_MSG -{ - PORT_MESSAGE h; - ULONG Unknown[2]; - IO_ERROR_LOG_MESSAGE IoErrorMessage; -} ELF_API_MSG, *PELF_API_MSG; // // To simplify matters, the kernel is made to support both the checked and free Modified: trunk/reactos/ntoskrnl/io/iomgr/error.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/io/iomgr/error.c?… ============================================================================== --- trunk/reactos/ntoskrnl/io/iomgr/error.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/io/iomgr/error.c [iso-8859-1] Mon Nov 7 13:29:09 2016 @@ -6,9 +6,12 @@ * PROGRAMMERS: Alex Ionescu (alex.ionescu(a)reactos.org) * Eric Kohl */ + /* INCLUDES *****************************************************************/ #include <ntoskrnl.h> +#include <subsys/iolog/iolog.h> + #define NDEBUG #include <debug.h> @@ -22,6 +25,7 @@ /* GLOBALS *******************************************************************/ +#define IOP_MAXIMUM_LOG_SIZE (100 * PAGE_SIZE) LONG IopTotalLogSize; LIST_ENTRY IopErrorLogListHead; KSPIN_LOCK IopLogListLock; @@ -105,16 +109,23 @@ NTAPI IopConnectLogPort(VOID) { - UNICODE_STRING PortName = RTL_CONSTANT_STRING(L"\\ErrorLogPort"); NTSTATUS Status; + UNICODE_STRING PortName = RTL_CONSTANT_STRING(ELF_PORT_NAME); + SECURITY_QUALITY_OF_SERVICE SecurityQos; /* Make sure we're not already connected */ if (IopLogPortConnected) return TRUE; + + /* Setup the QoS structure */ + SecurityQos.Length = sizeof(SecurityQos); + SecurityQos.ImpersonationLevel = SecurityIdentification; + SecurityQos.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING; + SecurityQos.EffectiveOnly = TRUE; /* Connect the port */ Status = ZwConnectPort(&IopLogPort, &PortName, - NULL, + &SecurityQos, NULL, NULL, NULL, @@ -136,6 +147,9 @@ NTAPI IopLogWorker(IN PVOID Parameter) { +#define IO_ERROR_OBJECT_NAMES_LENGTH 100 + + NTSTATUS Status; PELF_API_MSG Message; PIO_ERROR_LOG_MESSAGE ErrorMessage; PLIST_ENTRY ListEntry; @@ -144,22 +158,24 @@ PCHAR StringBuffer; ULONG RemainingLength; PDRIVER_OBJECT DriverObject; - ULONG DriverNameLength = 0, DeviceNameLength; - UNICODE_STRING DriverNameString; - NTSTATUS Status; - UCHAR Buffer[256]; + PWCHAR NameString; + ULONG DriverNameLength, DeviceNameLength; + UCHAR Buffer[sizeof(OBJECT_NAME_INFORMATION) + IO_ERROR_OBJECT_NAMES_LENGTH]; POBJECT_NAME_INFORMATION ObjectNameInfo = (POBJECT_NAME_INFORMATION)&Buffer; - POBJECT_NAME_INFORMATION PoolObjectNameInfo = NULL; + POBJECT_NAME_INFORMATION PoolObjectNameInfo; ULONG ReturnedLength, MessageLength; + ULONG ExtraStringLength; PWCHAR p; - ULONG ExtraStringLength; + PAGED_CODE(); + + UNREFERENCED_PARAMETER(Parameter); /* Connect to the port */ if (!IopConnectLogPort()) return; /* Allocate the message */ - Message = ExAllocatePool(PagedPool, IO_ERROR_LOG_MESSAGE_LENGTH); + Message = ExAllocatePoolWithTag(PagedPool, IO_ERROR_LOG_MESSAGE_LENGTH, TAG_IO); if (!Message) { /* Couldn't allocate, try again */ @@ -167,10 +183,8 @@ return; } - /* Copy the message */ - RtlZeroMemory(Message, sizeof(ELF_API_MSG)); - - /* Get the actual I/O Structure */ + /* Zero out the message and get the actual I/O structure */ + RtlZeroMemory(Message, sizeof(*Message)); ErrorMessage = &Message->IoErrorMessage; /* Start loop */ @@ -225,21 +239,28 @@ IO_ERROR_LOG_MESSAGE_LENGTH - (ULONG_PTR)StringBuffer); + NameString = NULL; + DriverNameLength = 0; DeviceNameLength = 0; + PoolObjectNameInfo = NULL; + ObjectNameInfo = (POBJECT_NAME_INFORMATION)&Buffer; + /* Now check if there is a driver object */ DriverObject = LogEntry->DriverObject; if (DriverObject) { - /* Check if the driver has a name */ + /* Check if the driver has a name, and use it if so */ if (DriverObject->DriverName.Buffer) { - /* Use its name */ - DriverNameString.Buffer = DriverObject->DriverName.Buffer; + NameString = DriverObject->DriverName.Buffer; DriverNameLength = DriverObject->DriverName.Length; } else - DriverNameString.Buffer = NULL; - - /* Check if there isn't a valid name*/ + { + NameString = NULL; + DriverNameLength = 0; + } + + /* Check if there isn't a valid name */ if (!DriverNameLength) { /* Query the name directly */ @@ -247,30 +268,35 @@ ObjectNameInfo, sizeof(Buffer), &ReturnedLength); - if (!(NT_SUCCESS(Status)) || !(ObjectNameInfo->Name.Length)) + if (!NT_SUCCESS(Status) || (ObjectNameInfo->Name.Length == 0)) { /* We don't have a name */ DriverNameLength = 0; } + else + { + NameString = ObjectNameInfo->Name.Buffer; + DriverNameLength = ObjectNameInfo->Name.Length; + } } } else { /* Use default name */ - DriverNameString.Buffer = L"Application Popup"; - DriverNameLength = (ULONG)wcslen(DriverNameString.Buffer) * sizeof(WCHAR); - } - - /* Check if we have a driver name by here */ + NameString = L"Application Popup"; + DriverNameLength = (ULONG)wcslen(NameString) * sizeof(WCHAR); + } + + /* Check if we have a driver name */ if (DriverNameLength) { /* Skip to the end of the driver's name */ - p = &DriverNameString.Buffer[DriverNameLength / sizeof(WCHAR)]; + p = &NameString[DriverNameLength / sizeof(WCHAR)]; /* Now we'll walk backwards and assume the minimum size */ DriverNameLength = sizeof(WCHAR); p--; - while ((*p != L'\\') && (p != DriverNameString.Buffer)) + while ((*p != L'\\') && (p != NameString)) { /* No backslash found, keep going */ p--; @@ -285,8 +311,9 @@ } /* - * Now make sure that the driver name fits in our buffer, minus 3 - * NULL chars, and copy the name in our string buffer + * Now make sure that the driver name fits in the buffer, minus + * 3 NULL chars (driver name, device name, and remaining strings), + * and copy the driver name in the string buffer. */ DriverNameLength = min(DriverNameLength, RemainingLength - 3 * sizeof(UNICODE_NULL)); @@ -294,29 +321,29 @@ } /* Null-terminate the driver name */ - *((PWSTR)(StringBuffer + DriverNameLength)) = L'\0'; + *((PWSTR)(StringBuffer + DriverNameLength)) = UNICODE_NULL; DriverNameLength += sizeof(WCHAR); /* Go to the next string buffer position */ StringBuffer += DriverNameLength; RemainingLength -= DriverNameLength; - /* Update the string offset and check if we have a device object */ - ErrorMessage->EntryData.StringOffset = (USHORT) - ((ULONG_PTR)StringBuffer - - (ULONG_PTR)ErrorMessage); + /* Update the string offset */ + ErrorMessage->EntryData.StringOffset = + (USHORT)((ULONG_PTR)StringBuffer - (ULONG_PTR)ErrorMessage); + + /* Check if we have a device object */ if (LogEntry->DeviceObject) { /* We do, query its name */ Status = ObQueryNameString(LogEntry->DeviceObject, ObjectNameInfo, - sizeof(Buffer), + sizeof(Buffer) - DriverNameLength, &ReturnedLength); if (!NT_SUCCESS(Status) || (ObjectNameInfo->Name.Length == 0)) { /* Setup an empty name */ - ObjectNameInfo->Name.Length = 0; - ObjectNameInfo->Name.Buffer = L""; + RtlInitEmptyUnicodeString(&ObjectNameInfo->Name, L"", 0); /* Check if we failed because our buffer wasn't large enough */ if (Status == STATUS_INFO_LENGTH_MISMATCH) @@ -337,39 +364,40 @@ { /* Success, update the information */ ObjectNameInfo->Name.Length = - 100 - (USHORT)DriverNameLength; + IO_ERROR_OBJECT_NAMES_LENGTH - (USHORT)DriverNameLength; } } } } + + NameString = ObjectNameInfo->Name.Buffer; + DeviceNameLength = ObjectNameInfo->Name.Length; } else { /* No device object, setup an empty name */ - ObjectNameInfo->Name.Length = 0; - ObjectNameInfo->Name.Buffer = L""; + NameString = L""; + DeviceNameLength = 0; } /* - * Now make sure that the device name fits in our buffer, minus 2 - * NULL chars, and copy the name in our string buffer + * Now make sure that the device name fits in the buffer, minus + * 2 NULL chars (device name, and remaining strings), and copy + * the device name in the string buffer. */ - DeviceNameLength = min(ObjectNameInfo->Name.Length, + DeviceNameLength = min(DeviceNameLength, RemainingLength - 2 * sizeof(UNICODE_NULL)); - RtlCopyMemory(StringBuffer, - ObjectNameInfo->Name.Buffer, - DeviceNameLength); + RtlCopyMemory(StringBuffer, NameString, DeviceNameLength); /* Null-terminate the device name */ - *((PWSTR)(StringBuffer + DeviceNameLength)) = L'\0'; + *((PWSTR)(StringBuffer + DeviceNameLength)) = UNICODE_NULL; DeviceNameLength += sizeof(WCHAR); /* Free the buffer if we had one */ if (PoolObjectNameInfo) { - ExFreePool(PoolObjectNameInfo); + ExFreePoolWithTag(PoolObjectNameInfo, TAG_IO); PoolObjectNameInfo = NULL; - ObjectNameInfo = (POBJECT_NAME_INFORMATION)&Buffer; } /* Go to the next string buffer position */ @@ -384,6 +412,9 @@ ExtraStringLength = LogEntry->Size - sizeof(ERROR_LOG_ENTRY) - Packet->StringOffset; + + /* Round up the length */ + ExtraStringLength = ROUND_UP(ExtraStringLength, sizeof(WCHAR)); /* Make sure that the extra strings fit in our buffer */ if (ExtraStringLength > (RemainingLength - sizeof(UNICODE_NULL))) @@ -399,50 +430,58 @@ ExtraStringLength); /* Null-terminate them */ - *((PWSTR)(StringBuffer + ExtraStringLength)) = L'\0'; + *((PWSTR)(StringBuffer + ExtraStringLength)) = UNICODE_NULL; } /* Set the driver name length */ ErrorMessage->DriverNameLength = (USHORT)DriverNameLength; - /* Update the message length to include the device and driver names */ - MessageLength += DeviceNameLength + DriverNameLength; + /* Update the message length to include the driver and device names */ + MessageLength += DriverNameLength + DeviceNameLength; ErrorMessage->Size = (USHORT)MessageLength; - /* Now update it again, internally, for the size of the actual LPC */ + /* Now update it again for the size of the actual LPC */ MessageLength += (FIELD_OFFSET(ELF_API_MSG, IoErrorMessage) - FIELD_OFFSET(ELF_API_MSG, Unknown[0])); /* Set the total and data lengths */ - Message->h.u1.s1.TotalLength = (USHORT)(sizeof(PORT_MESSAGE) + - MessageLength); - Message->h.u1.s1.DataLength = (USHORT)(MessageLength); + Message->Header.u1.s1.TotalLength = + (USHORT)(sizeof(PORT_MESSAGE) + MessageLength); + Message->Header.u1.s1.DataLength = (USHORT)MessageLength; /* Send the message */ - Status = NtRequestPort(IopLogPort, (PPORT_MESSAGE)Message); + Status = ZwRequestPort(IopLogPort, &Message->Header); if (!NT_SUCCESS(Status)) { - /* Requeue log message and restart the worker */ - ExInterlockedInsertTailList(&IopErrorLogListHead, + /* + * An error happened while sending the message on the port. + * Close the port, requeue the log message on top of the list + * and restart the worker. + */ + ZwClose(IopLogPort); + IopLogPortConnected = FALSE; + + ExInterlockedInsertHeadList(&IopErrorLogListHead, &LogEntry->ListEntry, &IopLogListLock); - IopLogWorkerRunning = FALSE; + IopRestartLogWorker(); break; } - /* Dereference the device object */ + /* NOTE: The following is basically 'IoFreeErrorLogEntry(Packet)' */ + + /* Dereference both objects */ if (LogEntry->DeviceObject) ObDereferenceObject(LogEntry->DeviceObject); - if (DriverObject) ObDereferenceObject(LogEntry->DriverObject); - - /* Update size */ - InterlockedExchangeAdd(&IopTotalLogSize, - -(LONG)(LogEntry->Size - - sizeof(ERROR_LOG_ENTRY))); + if (LogEntry->DriverObject) ObDereferenceObject(LogEntry->DriverObject); + + /* Decrease the total allocation size and free the entry */ + InterlockedExchangeAdd(&IopTotalLogSize, -(LONG)LogEntry->Size); + ExFreePoolWithTag(LogEntry, TAG_ERROR_LOG); } /* Free the LPC Message */ - ExFreePool(Message); + ExFreePoolWithTag(Message, TAG_IO); } VOID @@ -495,17 +534,15 @@ /* Make sure we have an object */ if (!IoObject) return NULL; - /* Check if we're past our buffer */ - if (IopTotalLogSize > PAGE_SIZE) return NULL; - /* Check if this is a device object or driver object */ - if (((PDEVICE_OBJECT)IoObject)->Type == IO_TYPE_DEVICE) + DeviceObject = (PDEVICE_OBJECT)IoObject; + if (DeviceObject->Type == IO_TYPE_DEVICE) { /* It's a device, get the driver */ - DeviceObject = (PDEVICE_OBJECT)IoObject; + // DeviceObject = (PDEVICE_OBJECT)IoObject; DriverObject = DeviceObject->DriverObject; } - else if (((PDEVICE_OBJECT)IoObject)->Type == IO_TYPE_DRIVER) + else if (DeviceObject->Type == IO_TYPE_DRIVER) { /* It's a driver, so we don't have a device */ DeviceObject = NULL; @@ -516,6 +553,21 @@ /* Fail */ return NULL; } + + /* Check if we're past our buffer */ + // FIXME/TODO: Perform the checks by taking into account EntrySize. + if (IopTotalLogSize > IOP_MAXIMUM_LOG_SIZE) return NULL; + + /* Check whether the size is too small or too large */ + if ((EntrySize < sizeof(IO_ERROR_LOG_PACKET)) || + (EntrySize > ERROR_LOG_MAXIMUM_SIZE)) + { + /* Fail */ + return NULL; + } + + /* Round up the size */ + EntrySize = ROUND_UP(EntrySize, sizeof(PVOID)); /* Calculate the total size and allocate it */ LogEntrySize = sizeof(ERROR_LOG_ENTRY) + EntrySize; @@ -529,12 +581,12 @@ if (DriverObject) ObReferenceObject(DriverObject); /* Update log size */ - InterlockedExchangeAdd(&IopTotalLogSize, EntrySize); + InterlockedExchangeAdd(&IopTotalLogSize, LogEntrySize); /* Clear the entry and set it up */ - RtlZeroMemory(LogEntry, EntrySize); + RtlZeroMemory(LogEntry, LogEntrySize); LogEntry->Type = IO_TYPE_ERROR_LOG; - LogEntry->Size = EntrySize; + LogEntry->Size = LogEntrySize; LogEntry->DeviceObject = DeviceObject; LogEntry->DriverObject = DriverObject; @@ -551,7 +603,7 @@ { PERROR_LOG_ENTRY LogEntry; - /* Make sure there's an entry */ + /* Make sure there is an entry */ if (!ElEntry) return; /* Get the actual header */ @@ -561,10 +613,9 @@ if (LogEntry->DeviceObject) ObDereferenceObject(LogEntry->DeviceObject); if (LogEntry->DriverObject) ObDereferenceObject(LogEntry->DriverObject); - /* Decrease total allocation size and free the entry */ - InterlockedExchangeAdd(&IopTotalLogSize, - -(LONG)(LogEntry->Size - sizeof(ERROR_LOG_ENTRY))); - ExFreePool(LogEntry); + /* Decrease the total allocation size and free the entry */ + InterlockedExchangeAdd(&IopTotalLogSize, -(LONG)LogEntry->Size); + ExFreePoolWithTag(LogEntry, TAG_ERROR_LOG); } /* @@ -577,9 +628,11 @@ PERROR_LOG_ENTRY LogEntry; KIRQL Irql; - /* Get the main header */ - LogEntry = (PERROR_LOG_ENTRY)((ULONG_PTR)ElEntry - - sizeof(ERROR_LOG_ENTRY)); + /* Make sure there is an entry */ + if (!ElEntry) return; + + /* Get the actual header */ + LogEntry = (PERROR_LOG_ENTRY)((ULONG_PTR)ElEntry - sizeof(ERROR_LOG_ENTRY)); /* Get time stamp */ KeQuerySystemTime(&LogEntry->TimeStamp); @@ -591,14 +644,10 @@ /* Check if the worker is running */ if (!IopLogWorkerRunning) { -#if 0 /* It's not, initialize it and queue it */ - ExInitializeWorkItem(&IopErrorLogWorkItem, - IopLogWorker, - &IopErrorLogWorkItem); + IopLogWorkerRunning = TRUE; + ExInitializeWorkItem(&IopErrorLogWorkItem, IopLogWorker, NULL); ExQueueWorkItem(&IopErrorLogWorkItem, DelayedWorkQueue); - IopLogWorkerRunning = TRUE; -#endif } /* Release the lock and return */ Added: trunk/reactos/sdk/include/reactos/subsys/iolog/iolog.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/sdk/include/reactos/subsys… ============================================================================== --- trunk/reactos/sdk/include/reactos/subsys/iolog/iolog.h (added) +++ trunk/reactos/sdk/include/reactos/subsys/iolog/iolog.h [iso-8859-1] Mon Nov 7 13:29:09 2016 @@ -0,0 +1,31 @@ +/* + * PROJECT: ReactOS EventLog Service + * LICENSE: GPL - See COPYING in the top level directory + * FILE: include/reactos/subsys/iolog/iolog.h + * PURPOSE: EventLog LPC API definitions + */ + +#ifndef _IOLOG_H +#define _IOLOG_H + +#pragma once + +// #include <iotypes.h> // For IO_ERROR_LOG_MESSAGE and associated + +#define ELF_PORT_NAME L"\\ErrorLogPort" + +typedef struct _ELF_API_MSG +{ + PORT_MESSAGE Header; + ULONG Unknown[2]; // FIXME + IO_ERROR_LOG_MESSAGE IoErrorMessage; +} ELF_API_MSG, *PELF_API_MSG; + +/* + * NOTE: The maximum data size sent to the EventLog LPC port + * is equal to: PORT_MAXIMUM_MESSAGE_LENGTH == 0x100 . + */ + +#endif // _IOLOG_H + +/* EOF */ Propchange: trunk/reactos/sdk/include/reactos/subsys/iolog/iolog.h ------------------------------------------------------------------------------ svn:eol-style = native

1 0

[hbelusca] 73166: [NTOS:LPC] - Capture the ServerView/ClientView *only* when those pointers are not NULL. - Fix a LpcRequest vs. CapturedLpcRequest in a call to LpcpMoveMessage. Caught by Thomas. C...
by hbelusca＠svn.reactos.org 07 Nov '16

07 Nov '16

Author: hbelusca Date: Mon Nov 7 12:35:09 2016 New Revision: 73166 URL: http://svn.reactos.org/svn/reactos?rev=73166&view=rev Log: [NTOS:LPC] - Capture the ServerView/ClientView *only* when those pointers are not NULL. - Fix a LpcRequest vs. CapturedLpcRequest in a call to LpcpMoveMessage. Caught by Thomas. CORE-7371 CR-100 Modified: trunk/reactos/ntoskrnl/lpc/complete.c trunk/reactos/ntoskrnl/lpc/connect.c trunk/reactos/ntoskrnl/lpc/send.c Modified: trunk/reactos/ntoskrnl/lpc/complete.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/complete.c?re… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/complete.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/complete.c [iso-8859-1] Mon Nov 7 12:35:09 2016 @@ -84,7 +84,9 @@ ProbeForRead(ReplyMessage + 1, ConnectionInfoLength, 1); /* The following parameters are optional */ - if (ServerView != NULL) + + /* Capture the server view */ + if (ServerView) { ProbeForWrite(ServerView, sizeof(*ServerView), sizeof(ULONG)); CapturedServerView = *(volatile PORT_VIEW*)ServerView; @@ -97,7 +99,8 @@ } } - if (ClientView != NULL) + /* Capture the client view */ + if (ClientView) { ProbeForWrite(ClientView, sizeof(*ClientView), sizeof(ULONG)); @@ -121,19 +124,27 @@ CapturedReplyMessage = *ReplyMessage; ConnectionInfoLength = CapturedReplyMessage.u1.s1.DataLength; - /* Validate the size of the server view */ - if ((ServerView) && (ServerView->Length != sizeof(*ServerView))) - { - /* Invalid size */ - return STATUS_INVALID_PARAMETER; - } - CapturedServerView = *ServerView; - - /* Validate the size of the client view */ - if ((ClientView) && (ClientView->Length != sizeof(*ClientView))) - { - /* Invalid size */ - return STATUS_INVALID_PARAMETER; + /* Capture the server view */ + if (ServerView) + { + /* Validate the size of the server view */ + if (ServerView->Length != sizeof(*ServerView)) + { + /* Invalid size */ + return STATUS_INVALID_PARAMETER; + } + CapturedServerView = *ServerView; + } + + /* Capture the client view */ + if (ClientView) + { + /* Validate the size of the client view */ + if (ClientView->Length != sizeof(*ClientView)) + { + /* Invalid size */ + return STATUS_INVALID_PARAMETER; + } } } Modified: trunk/reactos/ntoskrnl/lpc/connect.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/connect.c?rev… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/connect.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/connect.c [iso-8859-1] Mon Nov 7 12:35:09 2016 @@ -130,7 +130,7 @@ /* The following parameters are optional */ /* Capture the client view */ - if (ClientView != NULL) + if (ClientView) { ProbeForWrite(ClientView, sizeof(*ClientView), sizeof(ULONG)); CapturedClientView = *(volatile PORT_VIEW*)ClientView; @@ -145,7 +145,7 @@ } /* Capture the server view */ - if (ServerView != NULL) + if (ServerView) { ProbeForWrite(ServerView, sizeof(*ServerView), sizeof(ULONG)); @@ -202,7 +202,7 @@ /* The following parameters are optional */ /* Capture the client view */ - if (ClientView != NULL) + if (ClientView) { /* Validate the size of the client view */ if (ClientView->Length != sizeof(*ClientView)) @@ -214,7 +214,7 @@ } /* Capture the server view */ - if (ServerView != NULL) + if (ServerView) { /* Validate the size of the server view */ if (ServerView->Length != sizeof(*ServerView)) Modified: trunk/reactos/ntoskrnl/lpc/send.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/send.c?rev=73… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/send.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/send.c [iso-8859-1] Mon Nov 7 12:35:09 2016 @@ -857,7 +857,7 @@ /* Copy it */ LpcpMoveMessage(&Message->Request, - LpcRequest, + &CapturedLpcRequest, LpcRequest + 1, MessageType, &Thread->Cid);

1 0

[phater] 73165: [MSAFD] Implement SOL_SOCKET/SO_ERROR. CORE-12104
by phater＠svn.reactos.org 07 Nov '16

07 Nov '16

Author: phater Date: Mon Nov 7 08:50:31 2016 New Revision: 73165 URL: http://svn.reactos.org/svn/reactos?rev=73165&view=rev Log: [MSAFD] Implement SOL_SOCKET/SO_ERROR. CORE-12104 Modified: trunk/reactos/dll/win32/msafd/misc/dllmain.c Modified: trunk/reactos/dll/win32/msafd/misc/dllmain.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/msafd/misc/dllma… ============================================================================== --- trunk/reactos/dll/win32/msafd/misc/dllmain.c [iso-8859-1] (original) +++ trunk/reactos/dll/win32/msafd/misc/dllmain.c [iso-8859-1] Mon Nov 7 08:50:31 2016 @@ -914,6 +914,7 @@ NtClose( SockEvent ); HeapFree(GlobalHeap, 0, BindData); + Socket->SharedData->SocketLastError = TranslateNtStatusError(Status); if (Status != STATUS_SUCCESS) return MsafdReturnWithErrno ( Status, lpErrno, 0, NULL ); @@ -997,6 +998,7 @@ NtClose( SockEvent ); + Socket->SharedData->SocketLastError = TranslateNtStatusError(Status); if (Status != STATUS_SUCCESS) return MsafdReturnWithErrno ( Status, lpErrno, 0, NULL ); @@ -1250,6 +1252,10 @@ TRACE("Event %x on handle %x\n", Events, Handle); + if ((Events & x) == AFD_EVENT_DISCONNECT || (Events & x) == AFD_EVENT_CLOSE) + Socket->SharedData->SocketLastError = WSAECONNRESET; + if ((Events & x) == AFD_EVENT_ABORT) + Socket->SharedData->SocketLastError = WSAECONNABORTED; if( readfds ) FD_SET(Handle, readfds); break; @@ -1643,6 +1649,7 @@ Status = IOSB.Status; } + Socket->SharedData->SocketLastError = TranslateNtStatusError(Status); if (!NT_SUCCESS(Status)) { NtClose(SockEvent); @@ -1871,6 +1878,7 @@ Status = IOSB.Status; } + Socket->SharedData->SocketLastError = TranslateNtStatusError(Status); if (Status != STATUS_SUCCESS) goto notify; @@ -2017,6 +2025,7 @@ NtClose( SockEvent ); + Socket->SharedData->SocketLastError = TranslateNtStatusError(Status); return MsafdReturnWithErrno( Status, lpErrno, 0, NULL ); } @@ -2428,8 +2437,9 @@ PVOID Buffer; INT BufferSize; BOOL BoolBuffer; - INT IntBuffer; INT Errno; + + TRACE("Called\n"); /* Get the Socket Structure associate to this Socket*/ Socket = GetSocketStructure(Handle); @@ -2438,8 +2448,11 @@ if (lpErrno) *lpErrno = WSAENOTSOCK; return SOCKET_ERROR; } - - TRACE("Called\n"); + if (!OptionLength || !OptionValue) + { + if (lpErrno) *lpErrno = WSAEFAULT; + return SOCKET_ERROR; + } switch (Level) { @@ -2525,13 +2538,10 @@ break; case SO_ERROR: - /* HACK: This needs to be properly tracked */ - IntBuffer = 0; - DbgPrint("MSAFD: Hacked SO_ERROR returning error %d\n", IntBuffer); - - Buffer = &IntBuffer; + Buffer = &Socket->SharedData->SocketLastError; BufferSize = sizeof(INT); break; + case SO_SNDTIMEO: Buffer = &Socket->SharedData->SendTimeout; BufferSize = sizeof(DWORD); @@ -2603,6 +2613,11 @@ if (lpErrno) *lpErrno = WSAENOTSOCK; return SOCKET_ERROR; } + if (!optval) + { + if (lpErrno) *lpErrno = WSAEFAULT; + return SOCKET_ERROR; + } /* FIXME: We should handle some more cases here */ @@ -2675,6 +2690,18 @@ /* TODO: The total per-socket buffer space reserved for sends */ ERR("Setting send buf to %x is not implemented yet\n", optval); + return NO_ERROR; + + case SO_ERROR: + if (optlen < sizeof(INT)) + { + if (lpErrno) *lpErrno = WSAEFAULT; + return SOCKET_ERROR; + } + + RtlCopyMemory(&Socket->SharedData->SocketLastError, + optval, + sizeof(INT)); return NO_ERROR; case SO_SNDTIMEO:

1 0

[hbelusca] 73164: [NTOS:LPC] - Fix the usage, or add support (for NtSecureConnectPort based on patches by Alexander Andrejevic, and for NtReplyPort, NtReplyWaitReceivePortEx, NtListenPort by me) fo...
by hbelusca＠svn.reactos.org 07 Nov '16

07 Nov '16

Author: hbelusca Date: Mon Nov 7 01:24:24 2016 New Revision: 73164 URL: http://svn.reactos.org/svn/reactos?rev=73164&view=rev Log: [NTOS:LPC] - Fix the usage, or add support (for NtSecureConnectPort based on patches by Alexander Andrejevic, and for NtReplyPort, NtReplyWaitReceivePortEx, NtListenPort by me) for capturing user-mode parameters and using SEH in LPC functions. CORE-7371 #resolve - Make NtSecureConnectPort call SeQueryInformationToken, now that the latter is implemented since r73122. - Fix ObDereferenceObject usage for Port vs. ClientPort in NtSecureConnectPort. - ObCloseHandle certainly needs to be called with the actual 'PreviousMode'. Modified: trunk/reactos/ntoskrnl/lpc/complete.c trunk/reactos/ntoskrnl/lpc/connect.c trunk/reactos/ntoskrnl/lpc/create.c trunk/reactos/ntoskrnl/lpc/listen.c trunk/reactos/ntoskrnl/lpc/port.c trunk/reactos/ntoskrnl/lpc/reply.c trunk/reactos/ntoskrnl/lpc/send.c Modified: trunk/reactos/ntoskrnl/lpc/complete.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/complete.c?re… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/complete.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/complete.c [iso-8859-1] Mon Nov 7 01:24:24 2016 @@ -46,6 +46,8 @@ { NTSTATUS Status; KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); + PORT_VIEW CapturedServerView; + PORT_MESSAGE CapturedReplyMessage; ULONG ConnectionInfoLength; PLPCP_PORT_OBJECT ConnectionPort, ServerPort, ClientPort; PLPCP_CONNECTION_MESSAGE ConnectMessage; @@ -55,8 +57,6 @@ PEPROCESS ClientProcess; PETHREAD ClientThread; LARGE_INTEGER SectionOffset; - CLIENT_ID ClientId; - ULONG MessageId; PAGED_CODE(); LPCTRACE(LPC_COMPLETE_DEBUG, @@ -70,18 +70,15 @@ /* Check if the call comes from user mode */ if (PreviousMode != KernelMode) { - /* Enter SEH for probing the parameters */ _SEH2_TRY { + /* Probe the PortHandle */ ProbeForWriteHandle(PortHandle); /* Probe the basic ReplyMessage structure */ - ProbeForRead(ReplyMessage, sizeof(PORT_MESSAGE), sizeof(ULONG)); - - /* Grab some values */ - ClientId = ReplyMessage->ClientId; - MessageId = ReplyMessage->MessageId; - ConnectionInfoLength = ReplyMessage->u1.s1.DataLength; + ProbeForRead(ReplyMessage, sizeof(*ReplyMessage), sizeof(ULONG)); + CapturedReplyMessage = *(volatile PORT_MESSAGE*)ReplyMessage; + ConnectionInfoLength = CapturedReplyMessage.u1.s1.DataLength; /* Probe the connection info */ ProbeForRead(ReplyMessage + 1, ConnectionInfoLength, 1); @@ -89,10 +86,11 @@ /* The following parameters are optional */ if (ServerView != NULL) { - ProbeForWrite(ServerView, sizeof(PORT_VIEW), sizeof(ULONG)); + ProbeForWrite(ServerView, sizeof(*ServerView), sizeof(ULONG)); + CapturedServerView = *(volatile PORT_VIEW*)ServerView; /* Validate the size of the server view */ - if (ServerView->Length != sizeof(PORT_VIEW)) + if (CapturedServerView.Length != sizeof(CapturedServerView)) { /* Invalid size */ _SEH2_YIELD(return STATUS_INVALID_PARAMETER); @@ -101,10 +99,10 @@ if (ClientView != NULL) { - ProbeForWrite(ClientView, sizeof(REMOTE_PORT_VIEW), sizeof(ULONG)); + ProbeForWrite(ClientView, sizeof(*ClientView), sizeof(ULONG)); /* Validate the size of the client view */ - if (ClientView->Length != sizeof(REMOTE_PORT_VIEW)) + if (((volatile REMOTE_PORT_VIEW*)ClientView)->Length != sizeof(*ClientView)) { /* Invalid size */ _SEH2_YIELD(return STATUS_INVALID_PARAMETER); @@ -120,20 +118,19 @@ } else { - /* Grab some values */ - ClientId = ReplyMessage->ClientId; - MessageId = ReplyMessage->MessageId; - ConnectionInfoLength = ReplyMessage->u1.s1.DataLength; + CapturedReplyMessage = *ReplyMessage; + ConnectionInfoLength = CapturedReplyMessage.u1.s1.DataLength; /* Validate the size of the server view */ - if ((ServerView) && (ServerView->Length != sizeof(PORT_VIEW))) + if ((ServerView) && (ServerView->Length != sizeof(*ServerView))) { /* Invalid size */ return STATUS_INVALID_PARAMETER; } + CapturedServerView = *ServerView; /* Validate the size of the client view */ - if ((ClientView) && (ClientView->Length != sizeof(REMOTE_PORT_VIEW))) + if ((ClientView) && (ClientView->Length != sizeof(*ClientView))) { /* Invalid size */ return STATUS_INVALID_PARAMETER; @@ -141,7 +138,7 @@ } /* Get the client process and thread */ - Status = PsLookupProcessThreadByCid(&ClientId, + Status = PsLookupProcessThreadByCid(&CapturedReplyMessage.ClientId, &ClientProcess, &ClientThread); if (!NT_SUCCESS(Status)) return Status; @@ -151,8 +148,8 @@ /* Make sure that the client wants a reply, and this is the right one */ if (!(LpcpGetMessageFromThread(ClientThread)) || - !(MessageId) || - (ClientThread->LpcReplyMessageId != MessageId)) + !(CapturedReplyMessage.MessageId) || + (ClientThread->LpcReplyMessageId != CapturedReplyMessage.MessageId)) { /* Not the reply asked for, or no reply wanted, fail */ KeReleaseGuardedMutex(&LpcpLock); @@ -203,8 +200,8 @@ /* Setup the reply message */ Message->Request.u2.s2.Type = LPC_REPLY; Message->Request.u2.s2.DataInfoOffset = 0; - Message->Request.ClientId = ClientId; - Message->Request.MessageId = MessageId; + Message->Request.ClientId = CapturedReplyMessage.ClientId; + Message->Request.MessageId = CapturedReplyMessage.MessageId; Message->Request.ClientViewSize = 0; _SEH2_TRY @@ -310,6 +307,7 @@ if (ServerView) { /* FIXME: TODO */ + UNREFERENCED_PARAMETER(CapturedServerView); ASSERT(FALSE); } @@ -347,7 +345,7 @@ _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { /* Cleanup and return the exception code */ - ObCloseHandle(Handle, UserMode); + ObCloseHandle(Handle, PreviousMode); ObDereferenceObject(ServerPort); Status = _SEH2_GetExceptionCode(); _SEH2_YIELD(goto Cleanup); Modified: trunk/reactos/ntoskrnl/lpc/connect.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/connect.c?rev… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/connect.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/connect.c [iso-8859-1] Mon Nov 7 01:24:24 2016 @@ -90,6 +90,9 @@ NTSTATUS Status = STATUS_SUCCESS; KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); PETHREAD Thread = PsGetCurrentThread(); + SECURITY_QUALITY_OF_SERVICE CapturedQos; + PORT_VIEW CapturedClientView; + PSID CapturedServerSid; ULONG ConnectionInfoLength = 0; PLPCP_PORT_OBJECT Port, ClientPort; PLPCP_MESSAGE Message; @@ -110,25 +113,122 @@ ServerView, ServerSid); - /* Validate client view */ - if ((ClientView) && (ClientView->Length != sizeof(PORT_VIEW))) - { - /* Fail */ - return STATUS_INVALID_PARAMETER; - } - - /* Validate server view */ - if ((ServerView) && (ServerView->Length != sizeof(REMOTE_PORT_VIEW))) - { - /* Fail */ - return STATUS_INVALID_PARAMETER; - } - - /* Check if caller sent connection information length */ - if (ConnectionInformationLength) - { - /* Retrieve the input length */ - ConnectionInfoLength = *ConnectionInformationLength; + /* Check if the call comes from user mode */ + if (PreviousMode != KernelMode) + { + /* Enter SEH for probing the parameters */ + _SEH2_TRY + { + /* Probe the PortHandle */ + ProbeForWriteHandle(PortHandle); + + /* Probe and capture the QoS */ + ProbeForRead(SecurityQos, sizeof(*SecurityQos), sizeof(ULONG)); + CapturedQos = *(volatile SECURITY_QUALITY_OF_SERVICE*)SecurityQos; + /* NOTE: Do not care about CapturedQos.Length */ + + /* The following parameters are optional */ + + /* Capture the client view */ + if (ClientView != NULL) + { + ProbeForWrite(ClientView, sizeof(*ClientView), sizeof(ULONG)); + CapturedClientView = *(volatile PORT_VIEW*)ClientView; + + /* Validate the size of the client view */ + if (CapturedClientView.Length != sizeof(CapturedClientView)) + { + /* Invalid size */ + _SEH2_YIELD(return STATUS_INVALID_PARAMETER); + } + + } + + /* Capture the server view */ + if (ServerView != NULL) + { + ProbeForWrite(ServerView, sizeof(*ServerView), sizeof(ULONG)); + + /* Validate the size of the server view */ + if (((volatile REMOTE_PORT_VIEW*)ServerView)->Length != sizeof(*ServerView)) + { + /* Invalid size */ + _SEH2_YIELD(return STATUS_INVALID_PARAMETER); + } + } + + if (MaxMessageLength) + ProbeForWriteUlong(MaxMessageLength); + + /* Capture connection information length */ + if (ConnectionInformationLength) + { + ProbeForWriteUlong(ConnectionInformationLength); + ConnectionInfoLength = *(volatile ULONG*)ConnectionInformationLength; + } + + /* Probe the ConnectionInformation */ + if (ConnectionInformation) + ProbeForWrite(ConnectionInformation, ConnectionInfoLength, sizeof(ULONG)); + + CapturedServerSid = ServerSid; + if (ServerSid != NULL) + { + /* Capture it */ + Status = SepCaptureSid(ServerSid, + PreviousMode, + PagedPool, + TRUE, + &CapturedServerSid); + if (!NT_SUCCESS(Status)) + { + DPRINT1("Failed to capture ServerSid!\n"); + _SEH2_YIELD(return Status); + } + } + } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { + /* There was an exception, return the exception code */ + _SEH2_YIELD(return _SEH2_GetExceptionCode()); + } + _SEH2_END; + } + else + { + CapturedQos = *SecurityQos; + /* NOTE: Do not care about CapturedQos.Length */ + + /* The following parameters are optional */ + + /* Capture the client view */ + if (ClientView != NULL) + { + /* Validate the size of the client view */ + if (ClientView->Length != sizeof(*ClientView)) + { + /* Invalid size */ + return STATUS_INVALID_PARAMETER; + } + CapturedClientView = *ClientView; + } + + /* Capture the server view */ + if (ServerView != NULL) + { + /* Validate the size of the server view */ + if (ServerView->Length != sizeof(*ServerView)) + { + /* Invalid size */ + return STATUS_INVALID_PARAMETER; + } + } + + /* Capture connection information length */ + if (ConnectionInformationLength) + ConnectionInfoLength = *ConnectionInformationLength; + + CapturedServerSid = ServerSid; } /* Get the port */ @@ -143,6 +243,10 @@ if (!NT_SUCCESS(Status)) { DPRINT1("Failed to reference port '%wZ': 0x%lx\n", PortName, Status); + + if (CapturedServerSid != ServerSid) + SepReleaseSid(CapturedServerSid, PreviousMode, TRUE); + return Status; } @@ -151,10 +255,14 @@ { /* It isn't, so fail */ ObDereferenceObject(Port); + + if (CapturedServerSid != ServerSid) + SepReleaseSid(CapturedServerSid, PreviousMode, TRUE); + return STATUS_INVALID_PORT_HANDLE; } - /* Check if we have a SID */ + /* Check if we have a (captured) SID */ if (ServerSid) { /* Make sure that we have a server */ @@ -162,18 +270,14 @@ { /* Get its token and query user information */ Token = PsReferencePrimaryToken(Port->ServerProcess); - //Status = SeQueryInformationToken(Token, TokenUser, (PVOID*)&TokenUserInfo); - // FIXME: Need SeQueryInformationToken - Status = STATUS_SUCCESS; - TokenUserInfo = ExAllocatePoolWithTag(PagedPool, sizeof(TOKEN_USER), TAG_SE); - TokenUserInfo->User.Sid = ServerSid; + Status = SeQueryInformationToken(Token, TokenUser, (PVOID*)&TokenUserInfo); PsDereferencePrimaryToken(Token); /* Check for success */ if (NT_SUCCESS(Status)) { /* Compare the SIDs */ - if (!RtlEqualSid(ServerSid, TokenUserInfo->User.Sid)) + if (!RtlEqualSid(CapturedServerSid, TokenUserInfo->User.Sid)) { /* Fail */ Status = STATUS_SERVER_SID_MISMATCH; @@ -188,6 +292,10 @@ /* Invalid SID */ Status = STATUS_SERVER_SID_MISMATCH; } + + /* Finally release the captured SID, we don't need it anymore */ + if (CapturedServerSid != ServerSid) + SepReleaseSid(CapturedServerSid, PreviousMode, TRUE); /* Check if SID failed */ if (!NT_SUCCESS(Status)) @@ -215,17 +323,20 @@ return Status; } - /* Setup the client port */ + /* + * Setup the client port -- From now on, dereferencing the client port + * will automatically dereference the connection port too. + */ RtlZeroMemory(ClientPort, sizeof(LPCP_PORT_OBJECT)); ClientPort->Flags = LPCP_CLIENT_PORT; ClientPort->ConnectionPort = Port; ClientPort->MaxMessageLength = Port->MaxMessageLength; - ClientPort->SecurityQos = *Qos; + ClientPort->SecurityQos = CapturedQos; InitializeListHead(&ClientPort->LpcReplyChainHead); InitializeListHead(&ClientPort->LpcDataInfoChainHead); /* Check if we have dynamic security */ - if (Qos->ContextTrackingMode == SECURITY_DYNAMIC_TRACKING) + if (CapturedQos.ContextTrackingMode == SECURITY_DYNAMIC_TRACKING) { /* Remember that */ ClientPort->Flags |= LPCP_SECURITY_DYNAMIC; @@ -234,7 +345,7 @@ { /* Create our own client security */ Status = SeCreateClientSecurity(Thread, - Qos, + &CapturedQos, FALSE, &ClientPort->StaticSecurity); if (!NT_SUCCESS(Status)) @@ -258,7 +369,7 @@ if (ClientView) { /* Get the section handle */ - Status = ObReferenceObjectByHandle(ClientView->SectionHandle, + Status = ObReferenceObjectByHandle(CapturedClientView.SectionHandle, SECTION_MAP_READ | SECTION_MAP_WRITE, MmSectionObjectType, @@ -268,12 +379,12 @@ if (!NT_SUCCESS(Status)) { /* Fail */ - ObDereferenceObject(Port); + ObDereferenceObject(ClientPort); return Status; } /* Set the section offset */ - SectionOffset.QuadPart = ClientView->SectionOffset; + SectionOffset.QuadPart = CapturedClientView.SectionOffset; /* Map it */ Status = MmMapViewOfSection(SectionToMap, @@ -282,25 +393,25 @@ 0, 0, &SectionOffset, - &ClientView->ViewSize, + &CapturedClientView.ViewSize, ViewUnmap, 0, PAGE_READWRITE); /* Update the offset */ - ClientView->SectionOffset = SectionOffset.LowPart; + CapturedClientView.SectionOffset = SectionOffset.LowPart; /* Check for failure */ if (!NT_SUCCESS(Status)) { /* Fail */ ObDereferenceObject(SectionToMap); - ObDereferenceObject(Port); + ObDereferenceObject(ClientPort); return Status; } /* Update the base */ - ClientView->ViewBase = ClientPort->ClientSectionBase; + CapturedClientView.ViewBase = ClientPort->ClientSectionBase; /* Reference and remember the process */ ClientPort->MappingProcess = PsGetCurrentProcess(); @@ -337,12 +448,12 @@ if (ClientView) { /* Set the view size */ - Message->Request.ClientViewSize = ClientView->ViewSize; + Message->Request.ClientViewSize = CapturedClientView.ViewSize; /* Copy the client view and clear the server view */ RtlCopyMemory(&ConnectMessage->ClientView, - ClientView, - sizeof(PORT_VIEW)); + &CapturedClientView, + sizeof(CapturedClientView)); RtlZeroMemory(&ConnectMessage->ServerView, sizeof(REMOTE_PORT_VIEW)); } else @@ -366,11 +477,32 @@ /* Check if we have connection information */ if (ConnectionInformation) { - /* Copy it in */ - RtlCopyMemory(ConnectMessage + 1, - ConnectionInformation, - ConnectionInfoLength); - } + _SEH2_TRY + { + /* Copy it in */ + RtlCopyMemory(ConnectMessage + 1, + ConnectionInformation, + ConnectionInfoLength); + } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { + /* Cleanup and return the exception code */ + + /* Free the message we have */ + LpcpFreeToPortZone(Message, 0); + + /* Dereference other objects */ + if (SectionToMap) ObDereferenceObject(SectionToMap); + ObDereferenceObject(ClientPort); + + /* Return status */ + _SEH2_YIELD(return _SEH2_GetExceptionCode()); + } + _SEH2_END; + } + + /* Reset the status code */ + Status = STATUS_SUCCESS; /* Acquire the port lock */ KeAcquireGuardedMutex(&LpcpLock); @@ -433,11 +565,25 @@ LpcpConnectWait(&Thread->LpcReplySemaphore, PreviousMode); } + /* Now, always free the connection message */ + SectionToMap = LpcpFreeConMsg(&Message, &ConnectMessage, Thread); + /* Check for failure */ - if (!NT_SUCCESS(Status)) goto Cleanup; - - /* Free the connection message */ - SectionToMap = LpcpFreeConMsg(&Message, &ConnectMessage, Thread); + if (!NT_SUCCESS(Status)) + { + /* Check if the semaphore got signaled in the meantime */ + if (KeReadStateSemaphore(&Thread->LpcReplySemaphore)) + { + /* Wait on it */ + KeWaitForSingleObject(&Thread->LpcReplySemaphore, + WrExecutive, + KernelMode, + FALSE, + NULL); + } + + goto Failure; + } /* Check if we got a message back */ if (Message) @@ -451,20 +597,27 @@ sizeof(LPCP_CONNECTION_MESSAGE); } - /* Check if we had connection information */ + /* Check if the caller had connection information */ if (ConnectionInformation) { - /* Check if we had a length pointer */ - if (ConnectionInformationLength) - { - /* Return the length */ - *ConnectionInformationLength = ConnectionInfoLength; - } - - /* Return the connection information */ - RtlCopyMemory(ConnectionInformation, - ConnectMessage + 1, - ConnectionInfoLength ); + _SEH2_TRY + { + /* Return the connection information length if needed */ + if (ConnectionInformationLength) + *ConnectionInformationLength = ConnectionInfoLength; + + /* Return the connection information */ + RtlCopyMemory(ConnectionInformation, + ConnectMessage + 1, + ConnectionInfoLength); + } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { + /* Cleanup and return the exception code */ + Status = _SEH2_GetExceptionCode(); + _SEH2_YIELD(goto Failure); + } + _SEH2_END; } /* Make sure we had a connected port */ @@ -482,33 +635,45 @@ &Handle); if (NT_SUCCESS(Status)) { - /* Return the handle */ - *PortHandle = Handle; LPCTRACE(LPC_CONNECT_DEBUG, "Handle: %p. Length: %lx\n", Handle, PortMessageLength); - /* Check if maximum length was requested */ - if (MaxMessageLength) *MaxMessageLength = PortMessageLength; - - /* Check if we had a client view */ - if (ClientView) + _SEH2_TRY { - /* Copy it back */ - RtlCopyMemory(ClientView, - &ConnectMessage->ClientView, - sizeof(PORT_VIEW)); + /* Return the handle */ + *PortHandle = Handle; + + /* Check if maximum length was requested */ + if (MaxMessageLength) + *MaxMessageLength = PortMessageLength; + + /* Check if we had a client view */ + if (ClientView) + { + /* Copy it back */ + RtlCopyMemory(ClientView, + &ConnectMessage->ClientView, + sizeof(*ClientView)); + } + + /* Check if we had a server view */ + if (ServerView) + { + /* Copy it back */ + RtlCopyMemory(ServerView, + &ConnectMessage->ServerView, + sizeof(*ServerView)); + } } - - /* Check if we had a server view */ - if (ServerView) + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { - /* Copy it back */ - RtlCopyMemory(ServerView, - &ConnectMessage->ServerView, - sizeof(REMOTE_PORT_VIEW)); + /* An exception happened, close the opened handle */ + ObCloseHandle(Handle, PreviousMode); + Status = _SEH2_GetExceptionCode(); } + _SEH2_END; } } else @@ -545,39 +710,25 @@ else { /* No reply message, fail */ - if (SectionToMap) ObDereferenceObject(SectionToMap); - ObDereferenceObject(ClientPort); Status = STATUS_PORT_CONNECTION_REFUSED; - } + goto Failure; + } + + ObDereferenceObject(Port); /* Return status */ - ObDereferenceObject(Port); return Status; -Cleanup: - /* We failed, free the message */ - SectionToMap = LpcpFreeConMsg(&Message, &ConnectMessage, Thread); - - /* Check if the semaphore got signaled */ - if (KeReadStateSemaphore(&Thread->LpcReplySemaphore)) - { - /* Wait on it */ - KeWaitForSingleObject(&Thread->LpcReplySemaphore, - WrExecutive, - KernelMode, - FALSE, - NULL); - } - +Failure: /* Check if we had a message and free it */ if (Message) LpcpFreeToPortZone(Message, 0); /* Dereference other objects */ if (SectionToMap) ObDereferenceObject(SectionToMap); ObDereferenceObject(ClientPort); + ObDereferenceObject(Port); /* Return status */ - ObDereferenceObject(Port); return Status; } Modified: trunk/reactos/ntoskrnl/lpc/create.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/create.c?rev=… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/create.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/create.c [iso-8859-1] Mon Nov 7 01:24:24 2016 @@ -49,13 +49,14 @@ { NTSTATUS Status; KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); + UNICODE_STRING CapturedObjectName, *ObjectName; PLPCP_PORT_OBJECT Port; HANDLE Handle; - PUNICODE_STRING ObjectName; - BOOLEAN NoName; PAGED_CODE(); LPCTRACE(LPC_CREATE_DEBUG, "Name: %wZ\n", ObjectAttributes->ObjectName); + + RtlInitEmptyUnicodeString(&CapturedObjectName, NULL, 0); /* Check if the call comes from user mode */ if (PreviousMode != KernelMode) @@ -65,15 +66,14 @@ /* Probe the PortHandle */ ProbeForWriteHandle(PortHandle); - /* Probe the ObjectAttributes */ - ProbeForRead(ObjectAttributes, sizeof(OBJECT_ATTRIBUTES), sizeof(ULONG)); - - /* Get the object name and probe the unicode string */ - ObjectName = ObjectAttributes->ObjectName; - ProbeForRead(ObjectName, sizeof(UNICODE_STRING), 1); - - /* Check if we have no name */ - NoName = (ObjectName->Buffer == NULL) || (ObjectName->Length == 0); + /* Probe the ObjectAttributes and its object name (not the buffer) */ + ProbeForRead(ObjectAttributes, sizeof(*ObjectAttributes), sizeof(ULONG)); + ObjectName = ((volatile OBJECT_ATTRIBUTES*)ObjectAttributes)->ObjectName; + if (ObjectName) + { + ProbeForRead(ObjectName, sizeof(*ObjectName), 1); + CapturedObjectName = *(volatile UNICODE_STRING*)ObjectName; + } } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { @@ -84,10 +84,13 @@ } else { - /* Check if we have no name */ - NoName = (ObjectAttributes->ObjectName->Buffer == NULL) || - (ObjectAttributes->ObjectName->Length == 0); - } + if (ObjectAttributes->ObjectName) + CapturedObjectName = *(ObjectAttributes->ObjectName); + } + + /* Normalize the buffer pointer in case we don't have a name */ + if (CapturedObjectName.Length == 0) + CapturedObjectName.Buffer = NULL; /* Create the Object */ Status = ObCreateObject(PreviousMode, @@ -109,7 +112,7 @@ InitializeListHead(&Port->LpcReplyChainHead); /* Check if we don't have a name */ - if (NoName) + if (CapturedObjectName.Buffer == NULL) { /* Set up for an unconnected port */ Port->Flags = LPCP_UNCONNECTED_PORT; @@ -187,7 +190,8 @@ } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { - ObCloseHandle(Handle, UserMode); + /* An exception happened, close the opened handle */ + ObCloseHandle(Handle, PreviousMode); Status = _SEH2_GetExceptionCode(); } _SEH2_END; Modified: trunk/reactos/ntoskrnl/lpc/listen.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/listen.c?rev=… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/listen.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/listen.c [iso-8859-1] Mon Nov 7 01:24:24 2016 @@ -36,13 +36,22 @@ NULL, ConnectMessage); - /* Accept only LPC_CONNECTION_REQUEST requests */ - if ((Status != STATUS_SUCCESS) || - (LpcpGetMessageType(ConnectMessage) == LPC_CONNECTION_REQUEST)) + _SEH2_TRY { - /* Break out */ - break; + /* Accept only LPC_CONNECTION_REQUEST requests */ + if ((Status != STATUS_SUCCESS) || + (LpcpGetMessageType(ConnectMessage) == LPC_CONNECTION_REQUEST)) + { + /* Break out */ + _SEH2_YIELD(break); + } } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { + Status = _SEH2_GetExceptionCode(); + _SEH2_YIELD(break); + } + _SEH2_END; } /* Return status */ Modified: trunk/reactos/ntoskrnl/lpc/port.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/port.c?rev=73… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/port.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/port.c [iso-8859-1] Mon Nov 7 01:24:24 2016 @@ -136,27 +136,25 @@ PAGED_CODE(); - /* Check the previous mode */ - PreviousMode = ExGetPreviousMode(); - if (PreviousMode == KernelMode) - { - ClientId = ClientMessage->ClientId; - MessageId = ClientMessage->MessageId; - } - else + /* Check if the call comes from user mode */ + if (PreviousMode != KernelMode) { _SEH2_TRY { ProbeForRead(ClientMessage, sizeof(*ClientMessage), sizeof(PVOID)); - ClientId = ClientMessage->ClientId; - MessageId = ClientMessage->MessageId; + ClientId = ((volatile PORT_MESSAGE*)ClientMessage)->ClientId; + MessageId = ((volatile PORT_MESSAGE*)ClientMessage)->MessageId; } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { - DPRINT1("Got exception!\n"); _SEH2_YIELD(return _SEH2_GetExceptionCode()); } _SEH2_END; + } + else + { + ClientId = ClientMessage->ClientId; + MessageId = ClientMessage->MessageId; } /* Reference the port handle */ Modified: trunk/reactos/ntoskrnl/lpc/reply.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/reply.c?rev=7… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/reply.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/reply.c [iso-8859-1] Mon Nov 7 01:24:24 2016 @@ -192,7 +192,7 @@ { NTSTATUS Status; KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); - // PORT_MESSAGE CapturedReplyMessage; + PORT_MESSAGE CapturedReplyMessage; PLPCP_PORT_OBJECT Port; PLPCP_MESSAGE Message; PETHREAD Thread = PsGetCurrentThread(), WakeupThread; @@ -203,32 +203,35 @@ PortHandle, ReplyMessage); - if (KeGetPreviousMode() == UserMode) + /* Check if the call comes from user mode */ + if (PreviousMode != KernelMode) { _SEH2_TRY { - ProbeForRead(ReplyMessage, sizeof(PORT_MESSAGE), sizeof(ULONG)); - /*RtlCopyMemory(&CapturedReplyMessage, ReplyMessage, sizeof(PORT_MESSAGE)); - ReplyMessage = &CapturedReplyMessage;*/ - } - _SEH2_EXCEPT(ExSystemExceptionFilter()) - { - DPRINT1("SEH crash [1]\n"); + ProbeForRead(ReplyMessage, sizeof(*ReplyMessage), sizeof(ULONG)); + CapturedReplyMessage = *(volatile PORT_MESSAGE*)ReplyMessage; + } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { _SEH2_YIELD(return _SEH2_GetExceptionCode()); } _SEH2_END; } + else + { + CapturedReplyMessage = *ReplyMessage; + } /* Validate its length */ - if (((ULONG)ReplyMessage->u1.s1.DataLength + sizeof(PORT_MESSAGE)) > - (ULONG)ReplyMessage->u1.s1.TotalLength) + if (((ULONG)CapturedReplyMessage.u1.s1.DataLength + sizeof(PORT_MESSAGE)) > + (ULONG)CapturedReplyMessage.u1.s1.TotalLength) { /* Fail */ return STATUS_INVALID_PARAMETER; } /* Make sure it has a valid ID */ - if (!ReplyMessage->MessageId) return STATUS_INVALID_PARAMETER; + if (!CapturedReplyMessage.MessageId) return STATUS_INVALID_PARAMETER; /* Get the Port object */ Status = ObReferenceObjectByHandle(PortHandle, @@ -240,9 +243,9 @@ if (!NT_SUCCESS(Status)) return Status; /* Validate its length in respect to the port object */ - if (((ULONG)ReplyMessage->u1.s1.TotalLength > Port->MaxMessageLength) || - ((ULONG)ReplyMessage->u1.s1.TotalLength <= - (ULONG)ReplyMessage->u1.s1.DataLength)) + if (((ULONG)CapturedReplyMessage.u1.s1.TotalLength > Port->MaxMessageLength) || + ((ULONG)CapturedReplyMessage.u1.s1.TotalLength <= + (ULONG)CapturedReplyMessage.u1.s1.DataLength)) { /* Too large, fail */ ObDereferenceObject(Port); @@ -250,7 +253,7 @@ } /* Get the ETHREAD corresponding to it */ - Status = PsLookupProcessThreadByCid(&ReplyMessage->ClientId, + Status = PsLookupProcessThreadByCid(&CapturedReplyMessage.ClientId, NULL, &WakeupThread); if (!NT_SUCCESS(Status)) @@ -274,7 +277,7 @@ KeAcquireGuardedMutex(&LpcpLock); /* Make sure this is the reply the thread is waiting for */ - if ((WakeupThread->LpcReplyMessageId != ReplyMessage->MessageId) || + if ((WakeupThread->LpcReplyMessageId != CapturedReplyMessage.MessageId) || ((LpcpGetMessageFromThread(WakeupThread)) && (LpcpGetMessageType(&LpcpGetMessageFromThread(WakeupThread)-> Request) != LPC_REQUEST))) @@ -290,7 +293,7 @@ _SEH2_TRY { LpcpMoveMessage(&Message->Request, - ReplyMessage, + &CapturedReplyMessage, ReplyMessage + 1, LPC_REPLY, NULL); @@ -324,7 +327,7 @@ /* Check if this is the message the thread had received */ if ((Thread->LpcReceivedMsgIdValid) && - (Thread->LpcReceivedMessageId == ReplyMessage->MessageId)) + (Thread->LpcReceivedMessageId == CapturedReplyMessage.MessageId)) { /* Clear this data */ Thread->LpcReceivedMessageId = 0; @@ -333,9 +336,9 @@ /* Free any data information */ LpcpFreeDataInfoMessage(Port, - ReplyMessage->MessageId, - ReplyMessage->CallbackId, - ReplyMessage->ClientId); + CapturedReplyMessage.MessageId, + CapturedReplyMessage.CallbackId, + CapturedReplyMessage.ClientId); /* Release the lock and release the LPC semaphore to wake up waiters */ KeReleaseGuardedMutex(&LpcpLock); @@ -362,7 +365,7 @@ { NTSTATUS Status; KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(), WaitMode = PreviousMode; - // PORT_MESSAGE CapturedReplyMessage; + PORT_MESSAGE CapturedReplyMessage; LARGE_INTEGER CapturedTimeout; PLPCP_PORT_OBJECT Port, ReceivePort, ConnectionPort = NULL; PLPCP_MESSAGE Message; @@ -378,30 +381,29 @@ ReceiveMessage, PortContext); - if (KeGetPreviousMode() == UserMode) + /* Check if the call comes from user mode */ + if (PreviousMode != KernelMode) { _SEH2_TRY { + if (PortContext != NULL) + ProbeForWritePointer(PortContext); + if (ReplyMessage != NULL) { - ProbeForRead(ReplyMessage, sizeof(PORT_MESSAGE), sizeof(ULONG)); - /*RtlCopyMemory(&CapturedReplyMessage, ReplyMessage, sizeof(PORT_MESSAGE)); - ReplyMessage = &CapturedReplyMessage;*/ + ProbeForRead(ReplyMessage, sizeof(*ReplyMessage), sizeof(ULONG)); + CapturedReplyMessage = *(volatile PORT_MESSAGE*)ReplyMessage; } if (Timeout != NULL) { ProbeForReadLargeInteger(Timeout); - RtlCopyMemory(&CapturedTimeout, Timeout, sizeof(LARGE_INTEGER)); + CapturedTimeout = *(volatile LARGE_INTEGER*)Timeout; Timeout = &CapturedTimeout; } - - if (PortContext != NULL) - ProbeForWritePointer(PortContext); - } - _SEH2_EXCEPT(ExSystemExceptionFilter()) - { - DPRINT1("SEH crash [1]\n"); + } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { _SEH2_YIELD(return _SEH2_GetExceptionCode()); } _SEH2_END; @@ -410,21 +412,24 @@ { /* If this is a system thread, then let it page out its stack */ if (Thread->SystemThread) WaitMode = UserMode; + + if (ReplyMessage != NULL) + CapturedReplyMessage = *ReplyMessage; } /* Check if caller has a reply message */ if (ReplyMessage) { /* Validate its length */ - if (((ULONG)ReplyMessage->u1.s1.DataLength + sizeof(PORT_MESSAGE)) > - (ULONG)ReplyMessage->u1.s1.TotalLength) + if (((ULONG)CapturedReplyMessage.u1.s1.DataLength + sizeof(PORT_MESSAGE)) > + (ULONG)CapturedReplyMessage.u1.s1.TotalLength) { /* Fail */ return STATUS_INVALID_PARAMETER; } /* Make sure it has a valid ID */ - if (!ReplyMessage->MessageId) return STATUS_INVALID_PARAMETER; + if (!CapturedReplyMessage.MessageId) return STATUS_INVALID_PARAMETER; } /* Get the Port object */ @@ -440,9 +445,9 @@ if (ReplyMessage) { /* Validate its length in respect to the port object */ - if (((ULONG)ReplyMessage->u1.s1.TotalLength > Port->MaxMessageLength) || - ((ULONG)ReplyMessage->u1.s1.TotalLength <= - (ULONG)ReplyMessage->u1.s1.DataLength)) + if (((ULONG)CapturedReplyMessage.u1.s1.TotalLength > Port->MaxMessageLength) || + ((ULONG)CapturedReplyMessage.u1.s1.TotalLength <= + (ULONG)CapturedReplyMessage.u1.s1.DataLength)) { /* Too large, fail */ ObDereferenceObject(Port); @@ -490,7 +495,7 @@ if (ReplyMessage) { /* Get the ETHREAD corresponding to it */ - Status = PsLookupProcessThreadByCid(&ReplyMessage->ClientId, + Status = PsLookupProcessThreadByCid(&CapturedReplyMessage.ClientId, NULL, &WakeupThread); if (!NT_SUCCESS(Status)) @@ -516,7 +521,7 @@ KeAcquireGuardedMutex(&LpcpLock); /* Make sure this is the reply the thread is waiting for */ - if ((WakeupThread->LpcReplyMessageId != ReplyMessage->MessageId) || + if ((WakeupThread->LpcReplyMessageId != CapturedReplyMessage.MessageId) || ((LpcpGetMessageFromThread(WakeupThread)) && (LpcpGetMessageType(&LpcpGetMessageFromThread(WakeupThread)->Request) != LPC_REQUEST))) @@ -530,11 +535,24 @@ } /* Copy the message */ - LpcpMoveMessage(&Message->Request, - ReplyMessage, - ReplyMessage + 1, - LPC_REPLY, - NULL); + _SEH2_TRY + { + LpcpMoveMessage(&Message->Request, + &CapturedReplyMessage, + ReplyMessage + 1, + LPC_REPLY, + NULL); + } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { + /* Cleanup and return the exception code */ + LpcpFreeToPortZone(Message, LPCP_LOCK_HELD | LPCP_LOCK_RELEASE); + if (ConnectionPort) ObDereferenceObject(ConnectionPort); + ObDereferenceObject(WakeupThread); + ObDereferenceObject(Port); + _SEH2_YIELD(return _SEH2_GetExceptionCode()); + } + _SEH2_END; /* Reference the thread while we use it */ ObReferenceObject(WakeupThread); @@ -555,7 +573,7 @@ /* Check if this is the message the thread had received */ if ((Thread->LpcReceivedMsgIdValid) && - (Thread->LpcReceivedMessageId == ReplyMessage->MessageId)) + (Thread->LpcReceivedMessageId == CapturedReplyMessage.MessageId)) { /* Clear this data */ Thread->LpcReceivedMessageId = 0; @@ -564,9 +582,9 @@ /* Free any data information */ LpcpFreeDataInfoMessage(Port, - ReplyMessage->MessageId, - ReplyMessage->CallbackId, - ReplyMessage->ClientId); + CapturedReplyMessage.MessageId, + CapturedReplyMessage.CallbackId, + CapturedReplyMessage.ClientId); /* Release the lock and release the LPC semaphore to wake up waiters */ KeReleaseGuardedMutex(&LpcpLock); @@ -688,9 +706,8 @@ ASSERT(FALSE); } } - _SEH2_EXCEPT(ExSystemExceptionFilter()) - { - DPRINT1("SEH crash [2]\n"); + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { Status = _SEH2_GetExceptionCode(); } _SEH2_END; @@ -771,25 +788,23 @@ PAGED_CODE(); - /* Check the previous mode */ - PreviousMode = ExGetPreviousMode(); - if (PreviousMode == KernelMode) + /* Check if the call comes from user mode */ + if (PreviousMode != KernelMode) + { + _SEH2_TRY + { + ProbeForRead(Message, sizeof(*Message), sizeof(PVOID)); + CapturedMessage = *(volatile PORT_MESSAGE*)Message; + } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { + _SEH2_YIELD(return _SEH2_GetExceptionCode()); + } + _SEH2_END; + } + else { CapturedMessage = *Message; - } - else - { - _SEH2_TRY - { - ProbeForRead(Message, sizeof(*Message), sizeof(PVOID)); - CapturedMessage = *Message; - } - _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) - { - DPRINT1("Got exception!\n"); - _SEH2_YIELD(return _SEH2_GetExceptionCode()); - } - _SEH2_END; } /* Make sure there is any data to copy */ Modified: trunk/reactos/ntoskrnl/lpc/send.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/lpc/send.c?rev=73… ============================================================================== --- trunk/reactos/ntoskrnl/lpc/send.c [iso-8859-1] (original) +++ trunk/reactos/ntoskrnl/lpc/send.c [iso-8859-1] Mon Nov 7 01:24:24 2016 @@ -461,9 +461,8 @@ _SEH2_TRY { /* Probe and capture the LpcRequest */ - ProbeForRead(LpcRequest, sizeof(PORT_MESSAGE), sizeof(ULONG)); - ProbeForRead(LpcRequest, LpcRequest->u1.s1.TotalLength, sizeof(ULONG)); - CapturedLpcRequest = *LpcRequest; + ProbeForRead(LpcRequest, sizeof(*LpcRequest), sizeof(ULONG)); + CapturedLpcRequest = *(volatile PORT_MESSAGE*)LpcRequest; } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { @@ -523,7 +522,7 @@ { /* Copy it */ LpcpMoveMessage(&Message->Request, - LpcRequest, + &CapturedLpcRequest, LpcRequest + 1, MessageType, &Thread->Cid); @@ -725,10 +724,9 @@ { _SEH2_TRY { - /* Probe the full request message and copy the base structure */ + /* Probe and capture the LpcRequest */ ProbeForRead(LpcRequest, sizeof(*LpcRequest), sizeof(ULONG)); - ProbeForRead(LpcRequest, LpcRequest->u1.s1.TotalLength, sizeof(ULONG)); - CapturedLpcRequest = *LpcRequest; + CapturedLpcRequest = *(volatile PORT_MESSAGE*)LpcRequest; /* Probe the reply message for write */ ProbeForWrite(LpcReply, sizeof(*LpcReply), sizeof(ULONG));

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Ros-diffs