[ros-diffs] [reactos] 02/09: [NTOS:MM] Fix address space locking in MiProtectVirtualMemory

[Timo Kreuzer]

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=a8b57f0a6ba6061ce8102…

commit a8b57f0a6ba6061ce810290b7d8e64ac5b73e7f3
Author:     Timo Kreuzer <timo.kreuzer(a)reactos.org>
AuthorDate: Mon Oct 9 22:01:56 2023 +0300
Commit:     Timo Kreuzer <timo.kreuzer(a)reactos.org>
CommitDate: Tue Oct 24 21:45:27 2023 +0300

    [NTOS:MM] Fix address space locking in MiProtectVirtualMemory
---
 ntoskrnl/mm/ARM3/virtual.c | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/ntoskrnl/mm/ARM3/virtual.c b/ntoskrnl/mm/ARM3/virtual.c
index e0804520435..ec081c8110d 100644
--- a/ntoskrnl/mm/ARM3/virtual.c
+++ b/ntoskrnl/mm/ARM3/virtual.c
@@ -2213,6 +2213,9 @@ MiProtectVirtualMemory(IN PEPROCESS Process,
     PETHREAD Thread = PsGetCurrentThread();
     TABLE_SEARCH_RESULT Result;
 
+    /* We must be attached */
+    ASSERT(Process == PsGetCurrentProcess());
+
     /* Calculate base address for the VAD */
     StartingAddress = (ULONG_PTR)PAGE_ALIGN((*BaseAddress));
     EndingAddress = (((ULONG_PTR)*BaseAddress + *NumberOfBytesToProtect - 1) | (PAGE_SIZE
- 1));
@@ -2225,11 +2228,22 @@ MiProtectVirtualMemory(IN PEPROCESS Process,
         return STATUS_INVALID_PAGE_PROTECTION;
     }
 
+    /* Lock the address space and make sure the process isn't already dead */
+    AddressSpace = MmGetCurrentAddressSpace();
+    MmLockAddressSpace(AddressSpace);
+    if (Process->VmDeleted)
+    {
+        DPRINT1("Process is dying\n");
+        Status = STATUS_PROCESS_IS_TERMINATING;
+        goto FailPath;
+    }
+
     /* Check for ROS specific memory area */
     MemoryArea = MmLocateMemoryAreaByAddress(&Process->Vm, *BaseAddress);
     if ((MemoryArea) && (MemoryArea->Type != MEMORY_AREA_OWNED_BY_ARM3))
     {
         /* Evil hack */
+        MmUnlockAddressSpace(AddressSpace);
         return MiRosProtectVirtualMemory(Process,
                                          BaseAddress,
                                          NumberOfBytesToProtect,
@@ -2237,16 +2251,6 @@ MiProtectVirtualMemory(IN PEPROCESS Process,
                                          OldAccessProtection);
     }
 
-    /* Lock the address space and make sure the process isn't already dead */
-    AddressSpace = MmGetCurrentAddressSpace();
-    MmLockAddressSpace(AddressSpace);
-    if (Process->VmDeleted)
-    {
-        DPRINT1("Process is dying\n");
-        Status = STATUS_PROCESS_IS_TERMINATING;
-        goto FailPath;
-    }
-
     /* Get the VAD for this address range, and make sure it exists */
     Result = MiCheckForConflictingNode(StartingAddress >> PAGE_SHIFT,
                                        EndingAddress >> PAGE_SHIFT,