Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-04-20 04:20:46 +00:00
Code Issues Projects Releases Packages Wiki Activity

[WIN32K]

Browse source 
There is a bug in win32k (who would have thought that?) that consists in holding a winstation spinlock while running PAGED_CODE MmCopyToCaller function, when building the list of desktops of a given window station (the bug is easily triggerable when calling EnumDesktopsW). Since this lock is never used in anyplace but in this function, which, by the way, is just a reader function that fills user buffer, I consider that it is safe to remove this lock. However I want approval from win32k specialists. Hence I just disable the code with a define USE_WINSTA_LOCK. If this lock is really needed, please rewrite the BuildDesktopNameList function !! Otherwise remove this lock and the associated code !!
This is a blocker for the shutdown code.

svn path=/trunk/; revision=63610
This commit is contained in:
Hermès Bélusca-Maïto 2014-06-17 20:01:23 +00:00
parent 55f8bd0cd2
commit 340e8ae45f
2 changed files with 23 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
reactos/win32ss/user/ntuser/winsta.c
View file

@ -451,7 +451,9 @@ NtUserCreateWindowStation(
/* Initialize the window station */ /* Initialize the window station */
RtlZeroMemory(WindowStationObject, sizeof(WINSTATION_OBJECT)); RtlZeroMemory(WindowStationObject, sizeof(WINSTATION_OBJECT));
#ifdef USE_WINSTA_LOCK
KeInitializeSpinLock(&WindowStationObject->Lock); KeInitializeSpinLock(&WindowStationObject->Lock);
#endif
InitializeListHead(&WindowStationObject->DesktopListHead); InitializeListHead(&WindowStationObject->DesktopListHead);
Status = RtlCreateAtomTable(37, &WindowStationObject->AtomTable); Status = RtlCreateAtomTable(37, &WindowStationObject->AtomTable);
WindowStationObject->Name = WindowStationName; WindowStationObject->Name = WindowStationName;
@ -1203,7 +1205,9 @@ BuildDesktopNameList(
{ {
NTSTATUS Status; NTSTATUS Status;
PWINSTATION_OBJECT WindowStation; PWINSTATION_OBJECT WindowStation;
#ifdef USE_WINSTA_LOCK
KIRQL OldLevel; KIRQL OldLevel;
#endif
PLIST_ENTRY DesktopEntry; PLIST_ENTRY DesktopEntry;
PDESKTOP DesktopObject; PDESKTOP DesktopObject;
DWORD EntryCount; DWORD EntryCount;
@ -1220,7 +1224,9 @@ BuildDesktopNameList(
return Status; return Status;
} }
#ifdef USE_WINSTA_LOCK
KeAcquireSpinLock(&WindowStation->Lock, &OldLevel); KeAcquireSpinLock(&WindowStation->Lock, &OldLevel);
#endif
/* /*
* Count the required size of buffer. * Count the required size of buffer.
@ -1242,7 +1248,9 @@ BuildDesktopNameList(
Status = MmCopyToCaller(pRequiredSize, &ReturnLength, sizeof(ULONG)); Status = MmCopyToCaller(pRequiredSize, &ReturnLength, sizeof(ULONG));
if (! NT_SUCCESS(Status)) if (! NT_SUCCESS(Status))
{ {
#ifdef USE_WINSTA_LOCK
KeReleaseSpinLock(&WindowStation->Lock, OldLevel); KeReleaseSpinLock(&WindowStation->Lock, OldLevel);
#endif
ObDereferenceObject(WindowStation); ObDereferenceObject(WindowStation);
return STATUS_BUFFER_TOO_SMALL; return STATUS_BUFFER_TOO_SMALL;
} }
@ -1253,7 +1261,9 @@ BuildDesktopNameList(
*/ */
if (dwSize < ReturnLength) if (dwSize < ReturnLength)
{ {
#ifdef USE_WINSTA_LOCK
KeReleaseSpinLock(&WindowStation->Lock, OldLevel); KeReleaseSpinLock(&WindowStation->Lock, OldLevel);
#endif
ObDereferenceObject(WindowStation); ObDereferenceObject(WindowStation);
return STATUS_BUFFER_TOO_SMALL; return STATUS_BUFFER_TOO_SMALL;
} }
@ -1264,7 +1274,9 @@ BuildDesktopNameList(
Status = MmCopyToCaller(lpBuffer, &EntryCount, sizeof(DWORD)); Status = MmCopyToCaller(lpBuffer, &EntryCount, sizeof(DWORD));
if (! NT_SUCCESS(Status)) if (! NT_SUCCESS(Status))
{ {
#ifdef USE_WINSTA_LOCK
KeReleaseSpinLock(&WindowStation->Lock, OldLevel); KeReleaseSpinLock(&WindowStation->Lock, OldLevel);
#endif
ObDereferenceObject(WindowStation); ObDereferenceObject(WindowStation);
return Status; return Status;
} }
@ -1280,7 +1292,9 @@ BuildDesktopNameList(
Status = MmCopyToCaller(lpBuffer, DesktopName.Buffer, DesktopName.Length); Status = MmCopyToCaller(lpBuffer, DesktopName.Buffer, DesktopName.Length);
if (! NT_SUCCESS(Status)) if (! NT_SUCCESS(Status))
{ {
#ifdef USE_WINSTA_LOCK
KeReleaseSpinLock(&WindowStation->Lock, OldLevel); KeReleaseSpinLock(&WindowStation->Lock, OldLevel);
#endif
ObDereferenceObject(WindowStation); ObDereferenceObject(WindowStation);
return Status; return Status;
} }
@ -1288,7 +1302,9 @@ BuildDesktopNameList(
Status = MmCopyToCaller(lpBuffer, &NullWchar, sizeof(WCHAR)); Status = MmCopyToCaller(lpBuffer, &NullWchar, sizeof(WCHAR));
if (! NT_SUCCESS(Status)) if (! NT_SUCCESS(Status))
{ {
#ifdef USE_WINSTA_LOCK
KeReleaseSpinLock(&WindowStation->Lock, OldLevel); KeReleaseSpinLock(&WindowStation->Lock, OldLevel);
#endif
ObDereferenceObject(WindowStation); ObDereferenceObject(WindowStation);
return Status; return Status;
} }
@ -1298,7 +1314,9 @@ BuildDesktopNameList(
/* /*
* Clean up * Clean up
*/ */
#ifdef USE_WINSTA_LOCK
KeReleaseSpinLock(&WindowStation->Lock, OldLevel); KeReleaseSpinLock(&WindowStation->Lock, OldLevel);
#endif
ObDereferenceObject(WindowStation); ObDereferenceObject(WindowStation);
return STATUS_SUCCESS; return STATUS_SUCCESS;

5
reactos/win32ss/user/ntuser/winsta.h
View file

@ -7,11 +7,16 @@
#define WSS_LOCKED (1) #define WSS_LOCKED (1)
#define WSS_NOINTERACTIVE (2) #define WSS_NOINTERACTIVE (2)
// Uncomment for using WinSta spinlock
// #define USE_WINSTA_LOCK
typedef struct _WINSTATION_OBJECT typedef struct _WINSTATION_OBJECT
{ {
DWORD dwSessionId; DWORD dwSessionId;
#ifdef USE_WINSTA_LOCK
KSPIN_LOCK Lock; KSPIN_LOCK Lock;
#endif
UNICODE_STRING Name; UNICODE_STRING Name;
LIST_ENTRY DesktopListHead; LIST_ENTRY DesktopListHead;
PRTL_ATOM_TABLE AtomTable; PRTL_ATOM_TABLE AtomTable;