Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-06-24 23:11:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

[NTOS:Mm] Fix locking for MmGetSectionAssociation

Browse source 
MmGetSectionAssociation races with _MmSetPageEntrySectionSegment without sharing a lock. So we need to hold the PFN lock, until we have referenced the section segment found in the RMAP. This prevents that a section segment, which still has associated RMAPs from being deleted behind our back.
This commit is contained in:
Timo Kreuzer 2023-04-10 00:26:34 +03:00
parent 477792856e
commit 54d1b39676
2 changed files with 9 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
ntoskrnl/cache/section/sptab.c vendored
View file

@ -364,6 +364,8 @@ MmGetSectionAssociation(PFN_NUMBER Page,
PMM_SECTION_SEGMENT Segment = NULL;
PCACHE_SECTION_PAGE_TABLE PageTable;
KIRQL OldIrql = MiAcquirePfnLock();
PageTable = MmGetSegmentRmap(Page, &RawOffset);
if (PageTable)
{
@ -374,6 +376,8 @@ MmGetSectionAssociation(PFN_NUMBER Page,
InterlockedIncrement64(Segment->ReferenceCount);
}
MiReleasePfnLock(OldIrql);
return Segment;
}

9
ntoskrnl/mm/rmap.c
View file

@ -469,7 +469,9 @@ MmGetSegmentRmap(PFN_NUMBER Page, PULONG RawOffset)
{
PCACHE_SECTION_PAGE_TABLE Result = NULL;
PMM_RMAP_ENTRY current_entry;//, previous_entry;
KIRQL OldIrql = MiAcquirePfnLock();
/* Must hold the PFN lock */
ASSERT(KeGetCurrentIrql() == DISPATCH_LEVEL);
//previous_entry = NULL;
current_entry = MmGetRmapListHeadPage(Page);
@ -481,16 +483,15 @@ MmGetSegmentRmap(PFN_NUMBER Page, PULONG RawOffset)
*RawOffset = (ULONG_PTR)current_entry->Address & ~RMAP_SEGMENT_MASK;
if (*Result->Segment->Flags & MM_SEGMENT_INDELETE)
{
MiReleasePfnLock(OldIrql);
return NULL;
}
MiReleasePfnLock(OldIrql);
return Result;
}
//previous_entry = current_entry;
current_entry = current_entry->Next;
}
MiReleasePfnLock(OldIrql);
return NULL;
}