Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-11-18 13:01:40 +00:00
Code Issues Projects Releases Packages Wiki Activity

[NTOS:MM] Fix use-after-free error

Browse source 
The VAD / memory area can get deleted when calling MmUnmapViewOfSegment, so it must not be used after that.
This commit is contained in:
Timo Kreuzer 2023-07-29 13:48:46 +03:00
parent 2d7ff7ea33
commit 9bc5b8357a
1 changed files with 10 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
ntoskrnl/mm/section.c
View file

@ -3670,13 +3670,16 @@ MiRosUnmapViewOfSection(IN PEPROCESS Process,
{
PMM_SECTION_SEGMENT Segment = MemoryArea->SectionData.Segment;
PMMVAD Vad = &MemoryArea->VadNode;
PCONTROL_AREA ControlArea = Vad->ControlArea;
PFILE_OBJECT FileObject;
SIZE_T ViewSize;
LARGE_INTEGER ViewOffset;
ViewOffset.QuadPart = MemoryArea->SectionData.ViewOffset;
InterlockedIncrement64(Segment->ReferenceCount);
ViewSize = PAGE_SIZE + ((Vad->EndingVpn - Vad->StartingVpn) << PAGE_SHIFT);
Status = MmUnmapViewOfSegment(AddressSpace, BaseAddress);
if (!NT_SUCCESS(Status))
{
@ -3685,6 +3688,10 @@ MiRosUnmapViewOfSection(IN PEPROCESS Process,
ASSERT(NT_SUCCESS(Status));
}
/* These might be deleted now */
Vad = NULL;
MemoryArea = NULL;
if (FlagOn(*Segment->Flags, MM_PHYSICALMEMORY_SEGMENT))
{
/* Don't bother */
@ -3706,11 +3713,10 @@ MiRosUnmapViewOfSection(IN PEPROCESS Process,
/*
* Flush only when last mapping is deleted.
* FIXME: Why Vad->ControlArea == NULL?
* FIXME: Why ControlArea == NULL? Or rather: is ControlArea ever not NULL here?
*/
if (Vad->ControlArea == NULL || Vad->ControlArea->NumberOfMappedViews == 1)
if (ControlArea == NULL || ControlArea->NumberOfMappedViews == 1)
{
ViewSize = PAGE_SIZE + ((Vad->EndingVpn - Vad->StartingVpn) << PAGE_SHIFT);
while (ViewSize > 0)
{
ULONG FlushSize = min(ViewSize, PAGE_ROUND_DOWN(MAXULONG));