Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-11-18 21:13:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

[NTOS:CC] Access SectionObjectPointers without lock in CcRosInitializeFileCache. CORE-14691

Browse source 
kmtest:NtCreateSection calls CcInitializeCacheMap with a
NULL value for SectionObjectPointers. This will cause an exception when
trying to access it, which in Windows can be handled gracefully.
However accessing it while holding ViewLock means the lock will not be
released, leading to an APC_INDEX_MISMATCH bugcheck.

This solves the problem by allocating SharedCacheMap outside the lock,
then freeing it again under lock if another thread has updated SharedCacheMap
in the mean time. This is also What Windows Does(TM).
This commit is contained in:
Thomas Faber 2018-06-04 14:36:07 +02:00
parent 2355838fbb
commit 1d398057a3
No known key found for this signature in database
GPG key ID: 076E7C3D44720826
1 changed files with 21 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
ntoskrnl/cc/view.c
View file

@ -1394,7 +1394,6 @@ CcRosInitializeFileCache (
DPRINT("CcRosInitializeFileCache(FileObject 0x%p)\n", FileObject);
Allocated = FALSE;
KeAcquireGuardedMutex(&ViewLock);
SharedCacheMap = FileObject->SectionObjectPointer->SharedCacheMap;
if (SharedCacheMap == NULL)
{
@ -1402,14 +1401,9 @@ CcRosInitializeFileCache (
SharedCacheMap = ExAllocateFromNPagedLookasideList(&SharedCacheMapLookasideList);
if (SharedCacheMap == NULL)
{
KeReleaseGuardedMutex(&ViewLock);
return STATUS_INSUFFICIENT_RESOURCES;
}
RtlZeroMemory(SharedCacheMap, sizeof(*SharedCacheMap));
ObReferenceObjectByPointer(FileObject,
FILE_ALL_ACCESS,
NULL,
KernelMode);
SharedCacheMap->NodeTypeCode = NODE_TYPE_SHARED_MAP;
SharedCacheMap->NodeByteSize = sizeof(*SharedCacheMap);
SharedCacheMap->FileObject = FileObject;
@ -1423,11 +1417,28 @@ CcRosInitializeFileCache (
InitializeListHead(&SharedCacheMap->PrivateList);
KeInitializeSpinLock(&SharedCacheMap->CacheMapLock);
InitializeListHead(&SharedCacheMap->CacheMapVacbListHead);
FileObject->SectionObjectPointer->SharedCacheMap = SharedCacheMap;
}
OldIrql = KeAcquireQueuedSpinLock(LockQueueMasterLock);
InsertTailList(&CcCleanSharedCacheMapList, &SharedCacheMap->SharedCacheMapLinks);
KeReleaseQueuedSpinLock(LockQueueMasterLock, OldIrql);
KeAcquireGuardedMutex(&ViewLock);
if (Allocated)
{
if (FileObject->SectionObjectPointer->SharedCacheMap == NULL)
{
ObReferenceObjectByPointer(FileObject,
FILE_ALL_ACCESS,
NULL,
KernelMode);
FileObject->SectionObjectPointer->SharedCacheMap = SharedCacheMap;
OldIrql = KeAcquireQueuedSpinLock(LockQueueMasterLock);
InsertTailList(&CcCleanSharedCacheMapList, &SharedCacheMap->SharedCacheMapLinks);
KeReleaseQueuedSpinLock(LockQueueMasterLock, OldIrql);
}
else
{
ExFreeToNPagedLookasideList(&SharedCacheMapLookasideList, SharedCacheMap);
SharedCacheMap = FileObject->SectionObjectPointer->SharedCacheMap;
}
}
if (FileObject->PrivateCacheMap == NULL)
{