[NTOS:EX] Fix returned number of handles for Idle System Process (#4661)

PsIdleProcess and PsInitialSystemProcess share the same handle table. This
leads ObGetProcessHandleCount() to report the same number of handles
when called on those system processes, when being enumerated by
NtQuerySystemInformation(SystemProcessInformation).

Instead, just return 0 for the handle count of the Idle process in SystemProcessInformation.
This is not done in ObGetProcessHandleCount(), since a separate
NtQueryInformationProcess(ProcessHandleCount) for the idle process should return
a non-zero value.

CORE-16577
This commit is contained in:
Kyle Katarn 2022-09-03 22:56:33 +02:00 committed by GitHub
parent de5af76811
commit 7ed0284e8e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -1031,7 +1031,11 @@ QSI_DEF(SystemProcessInformation)
SpiCurrent->BasePriority = Process->Pcb.BasePriority;
SpiCurrent->UniqueProcessId = Process->UniqueProcessId;
SpiCurrent->InheritedFromUniqueProcessId = Process->InheritedFromUniqueProcessId;
SpiCurrent->HandleCount = ObGetProcessHandleCount(Process);
/* PsIdleProcess shares its handle table with PsInitialSystemProcess,
* so return the handle count for System only, not Idle one. */
SpiCurrent->HandleCount = (Process == PsIdleProcess) ? 0 : ObGetProcessHandleCount(Process);
SpiCurrent->PeakVirtualSize = Process->PeakVirtualSize;
SpiCurrent->VirtualSize = Process->VirtualSize;
SpiCurrent->PageFaultCount = Process->Vm.PageFaultCount;