[NTOS:MM] Attach to the target process in MmMapViewOfSection

This is required to satisfy VAD locking rules.
This commit is contained in:
Timo Kreuzer 2023-10-09 21:45:01 +03:00
parent 601bb49c0d
commit 07ad8c4c11

View file

@ -4008,6 +4008,8 @@ MmMapViewOfSection(IN PVOID SectionObject,
PMMSUPPORT AddressSpace; PMMSUPPORT AddressSpace;
NTSTATUS Status = STATUS_SUCCESS; NTSTATUS Status = STATUS_SUCCESS;
BOOLEAN NotAtBase = FALSE; BOOLEAN NotAtBase = FALSE;
BOOLEAN IsAttached = FALSE;
KAPC_STATE ApcState;
if (MiIsRosSectionObject(SectionObject) == FALSE) if (MiIsRosSectionObject(SectionObject) == FALSE)
{ {
@ -4031,6 +4033,12 @@ MmMapViewOfSection(IN PVOID SectionObject,
return STATUS_INVALID_PAGE_PROTECTION; return STATUS_INVALID_PAGE_PROTECTION;
} }
if (PsGetCurrentProcess() != Process)
{
KeStackAttachProcess(&Process->Pcb, &ApcState);
IsAttached = TRUE;
}
/* FIXME: We should keep this, but it would break code checking equality */ /* FIXME: We should keep this, but it would break code checking equality */
Protect &= ~PAGE_NOCACHE; Protect &= ~PAGE_NOCACHE;
@ -4097,15 +4105,15 @@ MmMapViewOfSection(IN PVOID SectionObject,
/* Fail if the user requested a fixed base address. */ /* Fail if the user requested a fixed base address. */
if ((*BaseAddress) != NULL) if ((*BaseAddress) != NULL)
{ {
MmUnlockAddressSpace(AddressSpace); Status = STATUS_CONFLICTING_ADDRESSES;
return STATUS_CONFLICTING_ADDRESSES; goto Exit;
} }
/* Otherwise find a gap to map the image. */ /* Otherwise find a gap to map the image. */
ImageBase = (ULONG_PTR)MmFindGap(AddressSpace, PAGE_ROUND_UP(ImageSize), MM_VIRTMEM_GRANULARITY, FALSE); ImageBase = (ULONG_PTR)MmFindGap(AddressSpace, PAGE_ROUND_UP(ImageSize), MM_VIRTMEM_GRANULARITY, FALSE);
if (ImageBase == 0) if (ImageBase == 0)
{ {
MmUnlockAddressSpace(AddressSpace); Status = STATUS_CONFLICTING_ADDRESSES;
return STATUS_CONFLICTING_ADDRESSES; goto Exit;
} }
/* Remember that we loaded image at a different base address */ /* Remember that we loaded image at a different base address */
NotAtBase = TRUE; NotAtBase = TRUE;
@ -4136,8 +4144,7 @@ MmMapViewOfSection(IN PVOID SectionObject,
MmUnlockSectionSegment(&SectionSegments[i]); MmUnlockSectionSegment(&SectionSegments[i]);
} }
MmUnlockAddressSpace(AddressSpace); goto Exit;
return Status;
} }
} }
@ -4160,22 +4167,22 @@ MmMapViewOfSection(IN PVOID SectionObject,
if ((Protect & (PAGE_READWRITE|PAGE_EXECUTE_READWRITE)) && if ((Protect & (PAGE_READWRITE|PAGE_EXECUTE_READWRITE)) &&
!(Section->InitialPageProtection & (PAGE_READWRITE|PAGE_EXECUTE_READWRITE))) !(Section->InitialPageProtection & (PAGE_READWRITE|PAGE_EXECUTE_READWRITE)))
{ {
MmUnlockAddressSpace(AddressSpace); Status = STATUS_SECTION_PROTECTION;
return STATUS_SECTION_PROTECTION; goto Exit;
} }
/* check for read access */ /* check for read access */
if ((Protect & (PAGE_READONLY|PAGE_WRITECOPY|PAGE_EXECUTE_READ|PAGE_EXECUTE_WRITECOPY)) && if ((Protect & (PAGE_READONLY|PAGE_WRITECOPY|PAGE_EXECUTE_READ|PAGE_EXECUTE_WRITECOPY)) &&
!(Section->InitialPageProtection & (PAGE_READONLY|PAGE_READWRITE|PAGE_WRITECOPY|PAGE_EXECUTE_READ|PAGE_EXECUTE_READWRITE|PAGE_EXECUTE_WRITECOPY))) !(Section->InitialPageProtection & (PAGE_READONLY|PAGE_READWRITE|PAGE_WRITECOPY|PAGE_EXECUTE_READ|PAGE_EXECUTE_READWRITE|PAGE_EXECUTE_WRITECOPY)))
{ {
MmUnlockAddressSpace(AddressSpace); Status = STATUS_SECTION_PROTECTION;
return STATUS_SECTION_PROTECTION; goto Exit;
} }
/* check for execute access */ /* check for execute access */
if ((Protect & (PAGE_EXECUTE|PAGE_EXECUTE_READ|PAGE_EXECUTE_READWRITE|PAGE_EXECUTE_WRITECOPY)) && if ((Protect & (PAGE_EXECUTE|PAGE_EXECUTE_READ|PAGE_EXECUTE_READWRITE|PAGE_EXECUTE_WRITECOPY)) &&
!(Section->InitialPageProtection & (PAGE_EXECUTE|PAGE_EXECUTE_READ|PAGE_EXECUTE_READWRITE|PAGE_EXECUTE_WRITECOPY))) !(Section->InitialPageProtection & (PAGE_EXECUTE|PAGE_EXECUTE_READ|PAGE_EXECUTE_READWRITE|PAGE_EXECUTE_WRITECOPY)))
{ {
MmUnlockAddressSpace(AddressSpace); Status = STATUS_SECTION_PROTECTION;
return STATUS_SECTION_PROTECTION; goto Exit;
} }
if (SectionOffset == NULL) if (SectionOffset == NULL)
@ -4189,8 +4196,8 @@ MmMapViewOfSection(IN PVOID SectionObject,
if ((ViewOffset % PAGE_SIZE) != 0) if ((ViewOffset % PAGE_SIZE) != 0)
{ {
MmUnlockAddressSpace(AddressSpace); Status = STATUS_MAPPED_ALIGNMENT;
return STATUS_MAPPED_ALIGNMENT; goto Exit;
} }
if ((*ViewSize) == 0) if ((*ViewSize) == 0)
@ -4219,18 +4226,24 @@ MmMapViewOfSection(IN PVOID SectionObject,
MmUnlockSectionSegment(Segment); MmUnlockSectionSegment(Segment);
if (!NT_SUCCESS(Status)) if (!NT_SUCCESS(Status))
{ {
MmUnlockAddressSpace(AddressSpace); goto Exit;
return Status;
} }
} }
MmUnlockAddressSpace(AddressSpace);
if (NotAtBase) if (NotAtBase)
Status = STATUS_IMAGE_NOT_AT_BASE; Status = STATUS_IMAGE_NOT_AT_BASE;
else else
Status = STATUS_SUCCESS; Status = STATUS_SUCCESS;
Exit:
MmUnlockAddressSpace(AddressSpace);
if (IsAttached)
{
KeUnstackDetachProcess(&ApcState);
}
return Status; return Status;
} }