Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-12-28 01:55:19 +00:00
Code Issues Projects Releases Packages Wiki Activity

[NTOS:PS] Enable alignment probing for thread/process information classes

Browse source 
In addition to that, here are some stuff done in this commit whilst testing:

- ICIF_QUERY_SIZE_VARIABLE and friends were badly misused, they should be used only when an information class whose information length size is dyanmic and not fixed. By removing such flags from erroneous classes, this fixes the STATUS_INFO_LENGTH_MISMATCH testcases.

- Use CHAR instead of UCHAR for classes that do not need alignment probing, as every other class in the table do, for the sake of consistency.

- ProcessEnableAlignmentFaultFixup uses BOOLEAN as type size, not CHAR. This fixes a testcase failure on ROS.

- Check for information length size before proceeding further on querying the process' cookie information.

- ProcessHandleTracing wants an alignment of a ULONG, not CHAR.

- Move PROCESS_LDT_INFORMATION and PROCESS_LDT_SIZE outside of NTOS_MODE_USER macro case. This fixes a compilation issue when enabling the alignment probing. My mistake of having them inside NTOS_MODE_USER case, sorry.

- On functions like NtQueryInformationThread and the Process equivalent, complete probing is not done at the beginning of the function, complete probing including if the buffer is writable alongside with datatype misalignment check that is. Instead such check is done on each information class case basis. With that said, we have to explicitly tell DefaultQueryInfoBufferCheck if we want a complete probing or not initially.
This commit is contained in:
George Bișoc 2021-05-03 15:46:35 +02:00
parent d30a1673d4
commit a330b56787
No known key found for this signature in database
GPG key ID: 688C4FBE25D7DEF6
11 changed files with 141 additions and 123 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
ntoskrnl/ex/event.c
View file

@ -333,7 +333,8 @@ NtQueryEvent(IN HANDLE EventHandle,
EventInformationLength, EventInformationLength,
ReturnLength, ReturnLength,
NULL, NULL,
PreviousMode); PreviousMode,
TRUE);
if(!NT_SUCCESS(Status)) if(!NT_SUCCESS(Status))
{ {
/* Invalid buffers */ /* Invalid buffers */

3
ntoskrnl/ex/mutant.c
View file

@ -243,7 +243,8 @@ NtQueryMutant(IN HANDLE MutantHandle,
MutantInformationLength, MutantInformationLength,
ResultLength, ResultLength,
NULL, NULL,
PreviousMode); PreviousMode,
TRUE);
if(!NT_SUCCESS(Status)) if(!NT_SUCCESS(Status))
{ {
DPRINT("NtQueryMutant() failed, Status: 0x%x\n", Status); DPRINT("NtQueryMutant() failed, Status: 0x%x\n", Status);

3
ntoskrnl/ex/sem.c
View file

@ -239,7 +239,8 @@ NtQuerySemaphore(IN HANDLE SemaphoreHandle,
SemaphoreInformationLength, SemaphoreInformationLength,
ReturnLength, ReturnLength,
NULL, NULL,
PreviousMode); PreviousMode,
TRUE);
if (!NT_SUCCESS(Status)) if (!NT_SUCCESS(Status))
{ {
/* Invalid buffers */ /* Invalid buffers */

3
ntoskrnl/ex/timer.c
View file

@ -536,7 +536,8 @@ NtQueryTimer(IN HANDLE TimerHandle,
TimerInformationLength, TimerInformationLength,
ReturnLength, ReturnLength,
NULL, NULL,
PreviousMode); PreviousMode,
TRUE);
if (!NT_SUCCESS(Status)) return Status; if (!NT_SUCCESS(Status)) return Status;
/* Get the Timer Object */ /* Get the Timer Object */

18
ntoskrnl/include/internal/probe.h
View file

@ -63,7 +63,8 @@ DefaultQueryInfoBufferCheck(ULONG Class,
ULONG BufferLength, ULONG BufferLength,
PULONG ReturnLength, PULONG ReturnLength,
PULONG_PTR ReturnLengthPtr, PULONG_PTR ReturnLengthPtr,
KPROCESSOR_MODE PreviousMode) KPROCESSOR_MODE PreviousMode,
BOOLEAN CompleteProbing)
{ {
NTSTATUS Status = STATUS_SUCCESS; NTSTATUS Status = STATUS_SUCCESS;
@ -90,9 +91,18 @@ DefaultQueryInfoBufferCheck(ULONG Class,
{ {
if (Buffer != NULL) if (Buffer != NULL)
{ {
ProbeForWrite(Buffer, if (!CompleteProbing)
BufferLength, {
ClassList[Class].AlignmentQUERY); ProbeForRead(Buffer,
BufferLength,
ClassList[Class].AlignmentQUERY);
}
else
{
ProbeForWrite(Buffer,
BufferLength,
ClassList[Class].AlignmentQUERY);
}
} }
if (ReturnLength != NULL) if (ReturnLength != NULL)

112
ntoskrnl/include/internal/ps_i.h
View file

@ -19,7 +19,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
PROCESS_BASIC_INFORMATION, PROCESS_BASIC_INFORMATION,
ULONG, ULONG,
ICIF_QUERY | ICIF_QUERY_SIZE_VARIABLE ICIF_QUERY
), ),
/* ProcessQuotaLimits */ /* ProcessQuotaLimits */
@ -27,7 +27,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
QUOTA_LIMITS, QUOTA_LIMITS,
ULONG, ULONG,
ICIF_QUERY | ICIF_SET | ICIF_SIZE_VARIABLE ICIF_QUERY | ICIF_SET
), ),
/* ProcessIoCounters */ /* ProcessIoCounters */
@ -35,7 +35,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
IO_COUNTERS, IO_COUNTERS,
ULONG, ULONG,
ICIF_QUERY | ICIF_QUERY_SIZE_VARIABLE ICIF_QUERY
), ),
/* ProcessVmCounters */ /* ProcessVmCounters */
@ -51,7 +51,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
KERNEL_USER_TIMES, KERNEL_USER_TIMES,
ULONG, ULONG,
ICIF_QUERY | ICIF_QUERY_SIZE_VARIABLE ICIF_QUERY
), ),
/* ProcessBasePriority */ /* ProcessBasePriority */
@ -59,7 +59,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
KPRIORITY, KPRIORITY,
ULONG, ULONG,
ICIF_SET | ICIF_SET_SIZE_VARIABLE ICIF_SET
), ),
/* ProcessRaisePriority */ /* ProcessRaisePriority */
@ -67,7 +67,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
ULONG, ULONG,
ULONG, ULONG,
ICIF_SET | ICIF_SET_SIZE_VARIABLE ICIF_SET
), ),
/* ProcessDebugPort */ /* ProcessDebugPort */
@ -75,7 +75,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
HANDLE, HANDLE,
ULONG, ULONG,
ICIF_QUERY | ICIF_QUERY_SIZE_VARIABLE ICIF_QUERY
), ),
/* ProcessExceptionPort */ /* ProcessExceptionPort */
@ -83,7 +83,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
HANDLE, HANDLE,
ULONG, ULONG,
ICIF_SET | ICIF_SET_SIZE_VARIABLE ICIF_SET
), ),
/* ProcessAccessToken */ /* ProcessAccessToken */
@ -91,7 +91,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
PROCESS_ACCESS_TOKEN, PROCESS_ACCESS_TOKEN,
ULONG, ULONG,
ICIF_SET | ICIF_SET_SIZE_VARIABLE ICIF_SET
), ),
/* ProcessLdtInformation */ /* ProcessLdtInformation */
@ -99,7 +99,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
PROCESS_LDT_INFORMATION, PROCESS_LDT_INFORMATION,
ULONG, ULONG,
ICIF_QUERY | ICIF_SET | ICIF_SIZE_VARIABLE ICIF_QUERY | ICIF_SET
), ),
/* ProcessLdtSize */ /* ProcessLdtSize */
@ -107,7 +107,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
PROCESS_LDT_SIZE, PROCESS_LDT_SIZE,
ULONG, ULONG,
ICIF_SET | ICIF_SET_SIZE_VARIABLE ICIF_SET
), ),
/* ProcessDefaultHardErrorMode */ /* ProcessDefaultHardErrorMode */
@ -115,7 +115,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
ULONG, ULONG,
ULONG, ULONG,
ICIF_QUERY | ICIF_SET | ICIF_SIZE_VARIABLE ICIF_QUERY | ICIF_SET
), ),
/* ProcessIoPortHandlers */ /* ProcessIoPortHandlers */
@ -123,7 +123,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
UCHAR, UCHAR,
ULONG, ULONG,
ICIF_SET | ICIF_SET_SIZE_VARIABLE ICIF_SET
), ),
/* ProcessPooledUsageAndLimits */ /* ProcessPooledUsageAndLimits */
@ -131,7 +131,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
POOLED_USAGE_AND_LIMITS, POOLED_USAGE_AND_LIMITS,
ULONG, ULONG,
ICIF_QUERY | ICIF_QUERY_SIZE_VARIABLE ICIF_QUERY
), ),
/* ProcessWorkingSetWatch */ /* ProcessWorkingSetWatch */
@ -139,7 +139,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
PROCESS_WS_WATCH_INFORMATION, PROCESS_WS_WATCH_INFORMATION,
ULONG, ULONG,
ICIF_QUERY | ICIF_SET | ICIF_SIZE_VARIABLE ICIF_QUERY | ICIF_SET | ICIF_SET_SIZE_VARIABLE
), ),
/* ProcessUserModeIOPL */ /* ProcessUserModeIOPL */
@ -147,17 +147,17 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
UCHAR, UCHAR,
ULONG, ULONG,
ICIF_SET | ICIF_SET_SIZE_VARIABLE ICIF_SET
), ),
/* ProcessEnableAlignmentFaultFixup */ /* ProcessEnableAlignmentFaultFixup */
IQS IQS
( (
CHAR, BOOLEAN,
CHAR, CHAR,
BOOLEAN, BOOLEAN,
UCHAR, CHAR,
ICIF_SET | ICIF_SET_SIZE_VARIABLE ICIF_SET
), ),
/* ProcessPriorityClass */ /* ProcessPriorityClass */
@ -167,7 +167,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
ULONG, ULONG,
PROCESS_PRIORITY_CLASS, PROCESS_PRIORITY_CLASS,
CHAR, CHAR,
ICIF_QUERY | ICIF_SET | ICIF_SIZE_VARIABLE ICIF_QUERY | ICIF_SET
), ),
/* ProcessWx86Information */ /* ProcessWx86Information */
@ -175,7 +175,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
ULONG, ULONG,
ULONG, ULONG,
ICIF_QUERY | ICIF_SET | ICIF_SIZE_VARIABLE ICIF_QUERY | ICIF_SET
), ),
/* ProcessHandleCount */ /* ProcessHandleCount */
@ -183,7 +183,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
ULONG, ULONG,
ULONG, ULONG,
ICIF_QUERY | ICIF_QUERY_SIZE_VARIABLE ICIF_QUERY
), ),
/* ProcessAffinityMask */ /* ProcessAffinityMask */
@ -191,7 +191,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
KAFFINITY, KAFFINITY,
ULONG, ULONG,
ICIF_SET | ICIF_SET_SIZE_VARIABLE ICIF_SET
), ),
/* ProcessPriorityBoost */ /* ProcessPriorityBoost */
@ -199,7 +199,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
ULONG, ULONG,
ULONG, ULONG,
ICIF_QUERY | ICIF_SET | ICIF_SIZE_VARIABLE ICIF_QUERY | ICIF_SET
), ),
/* ProcessDeviceMap */ /* ProcessDeviceMap */
@ -209,7 +209,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
ULONG, ULONG,
RTL_FIELD_TYPE(PROCESS_DEVICEMAP_INFORMATION, Set), RTL_FIELD_TYPE(PROCESS_DEVICEMAP_INFORMATION, Set),
ULONG, ULONG,
ICIF_QUERY | ICIF_SET | ICIF_SIZE_VARIABLE ICIF_QUERY | ICIF_SET
), ),
/* ProcessSessionInformation */ /* ProcessSessionInformation */
@ -217,7 +217,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
PROCESS_SESSION_INFORMATION, PROCESS_SESSION_INFORMATION,
ULONG, ULONG,
ICIF_QUERY | ICIF_SET | ICIF_SIZE_VARIABLE ICIF_QUERY | ICIF_SET
), ),
/* ProcessForegroundInformation */ /* ProcessForegroundInformation */
@ -226,8 +226,8 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
CHAR, CHAR,
CHAR, CHAR,
BOOLEAN, BOOLEAN,
UCHAR, CHAR,
ICIF_SET | ICIF_SET_SIZE_VARIABLE ICIF_SET
), ),
/* ProcessWow64Information */ /* ProcessWow64Information */
@ -235,7 +235,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
ULONG, ULONG,
ULONG, ULONG,
ICIF_QUERY | ICIF_QUERY_SIZE_VARIABLE ICIF_QUERY
), ),
/* ProcessImageFileName */ /* ProcessImageFileName */
@ -251,7 +251,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
ULONG, ULONG,
ULONG, ULONG,
ICIF_QUERY | ICIF_QUERY_SIZE_VARIABLE ICIF_QUERY
), ),
/* ProcessBreakOnTermination */ /* ProcessBreakOnTermination */
@ -259,7 +259,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
ULONG, ULONG,
ULONG, ULONG,
ICIF_QUERY | ICIF_SET | ICIF_SIZE_VARIABLE ICIF_QUERY | ICIF_SET
), ),
/* ProcessDebugObjectHandle */ /* ProcessDebugObjectHandle */
@ -267,7 +267,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
HANDLE, HANDLE,
ULONG, ULONG,
ICIF_QUERY | ICIF_QUERY_SIZE_VARIABLE ICIF_QUERY
), ),
/* ProcessDebugFlags */ /* ProcessDebugFlags */
@ -275,17 +275,17 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
ULONG, ULONG,
ULONG, ULONG,
ICIF_QUERY | ICIF_SET | ICIF_SIZE_VARIABLE ICIF_QUERY | ICIF_SET
), ),
/* ProcessHandleTracing */ /* ProcessHandleTracing */
IQS IQS
( (
PROCESS_HANDLE_TRACING_QUERY, PROCESS_HANDLE_TRACING_QUERY,
CHAR,
ULONG, ULONG,
ULONG, ULONG,
ICIF_QUERY | ICIF_SET | ICIF_SIZE_VARIABLE ULONG,
ICIF_QUERY | ICIF_SET
), ),
/* ProcessIoPriority */ /* ProcessIoPriority */
@ -301,7 +301,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
ULONG, ULONG,
ULONG, ULONG,
ICIF_QUERY | ICIF_SET | ICIF_SIZE_VARIABLE ICIF_QUERY | ICIF_SET
), ),
/* ProcessTlsInformation */ /* ProcessTlsInformation */
@ -317,7 +317,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
ULONG, ULONG,
ULONG, ULONG,
ICIF_QUERY | ICIF_QUERY_SIZE_VARIABLE ICIF_QUERY
), ),
/* ProcessImageInformation */ /* ProcessImageInformation */
@ -325,7 +325,7 @@ static const INFORMATION_CLASS_INFO PsProcessInfoClass[] =
( (
SECTION_IMAGE_INFORMATION, SECTION_IMAGE_INFORMATION,
ULONG, ULONG,
ICIF_QUERY | ICIF_QUERY_SIZE_VARIABLE ICIF_QUERY
), ),
/* ProcessCycleTime */ /* ProcessCycleTime */
@ -411,7 +411,7 @@ static const INFORMATION_CLASS_INFO PsThreadInfoClass[] =
( (
THREAD_BASIC_INFORMATION, THREAD_BASIC_INFORMATION,
ULONG, ULONG,
ICIF_QUERY | ICIF_QUERY_SIZE_VARIABLE ICIF_QUERY
), ),
/* ThreadTimes */ /* ThreadTimes */
@ -419,7 +419,7 @@ static const INFORMATION_CLASS_INFO PsThreadInfoClass[] =
( (
KERNEL_USER_TIMES, KERNEL_USER_TIMES,
ULONG, ULONG,
ICIF_QUERY | ICIF_QUERY_SIZE_VARIABLE ICIF_QUERY
), ),
/* ThreadPriority */ /* ThreadPriority */
@ -427,7 +427,7 @@ static const INFORMATION_CLASS_INFO PsThreadInfoClass[] =
( (
KPRIORITY, KPRIORITY,
ULONG, ULONG,
ICIF_SET | ICIF_SET_SIZE_VARIABLE ICIF_SET
), ),
/* ThreadBasePriority */ /* ThreadBasePriority */
@ -435,7 +435,7 @@ static const INFORMATION_CLASS_INFO PsThreadInfoClass[] =
( (
LONG, LONG,
ULONG, ULONG,
ICIF_SET | ICIF_SET_SIZE_VARIABLE ICIF_SET
), ),
/* ThreadAffinityMask */ /* ThreadAffinityMask */
@ -443,7 +443,7 @@ static const INFORMATION_CLASS_INFO PsThreadInfoClass[] =
( (
KAFFINITY, KAFFINITY,
ULONG, ULONG,
ICIF_SET | ICIF_SET_SIZE_VARIABLE ICIF_SET
), ),
/* ThreadImpersonationToken */ /* ThreadImpersonationToken */
@ -451,7 +451,7 @@ static const INFORMATION_CLASS_INFO PsThreadInfoClass[] =
( (
HANDLE, HANDLE,
ULONG, ULONG,
ICIF_SET | ICIF_SET_SIZE_VARIABLE ICIF_SET
), ),
/* ThreadDescriptorTableEntry is only implemented in x86 as well as the descriptor entry */ /* ThreadDescriptorTableEntry is only implemented in x86 as well as the descriptor entry */
@ -461,7 +461,7 @@ static const INFORMATION_CLASS_INFO PsThreadInfoClass[] =
( (
DESCRIPTOR_TABLE_ENTRY, DESCRIPTOR_TABLE_ENTRY,
ULONG, ULONG,
ICIF_QUERY | ICIF_QUERY_SIZE_VARIABLE ICIF_QUERY
), ),
#else #else
IQS_NONE, IQS_NONE,
@ -474,7 +474,7 @@ static const INFORMATION_CLASS_INFO PsThreadInfoClass[] =
CHAR, CHAR,
BOOLEAN, BOOLEAN,
UCHAR, UCHAR,
ICIF_SET | ICIF_SET_SIZE_VARIABLE ICIF_SET
), ),
/* ThreadEventPair_Reusable */ /* ThreadEventPair_Reusable */
@ -492,7 +492,7 @@ static const INFORMATION_CLASS_INFO PsThreadInfoClass[] =
ULONG, ULONG,
ULONG_PTR, ULONG_PTR,
ULONG, ULONG,
ICIF_QUERY | ICIF_SET | ICIF_SIZE_VARIABLE ICIF_QUERY | ICIF_SET
), ),
/* ThreadZeroTlsCell */ /* ThreadZeroTlsCell */
@ -500,7 +500,7 @@ static const INFORMATION_CLASS_INFO PsThreadInfoClass[] =
( (
ULONG_PTR, ULONG_PTR,
ULONG, ULONG,
ICIF_SET | ICIF_SIZE_VARIABLE ICIF_SET
), ),
/* ThreadPerformanceCount */ /* ThreadPerformanceCount */
@ -508,7 +508,7 @@ static const INFORMATION_CLASS_INFO PsThreadInfoClass[] =
( (
LARGE_INTEGER, LARGE_INTEGER,
ULONG, ULONG,
ICIF_QUERY | ICIF_QUERY_SIZE_VARIABLE ICIF_QUERY
), ),
/* ThreadAmILastThread */ /* ThreadAmILastThread */
@ -516,7 +516,7 @@ static const INFORMATION_CLASS_INFO PsThreadInfoClass[] =
( (
ULONG, ULONG,
ULONG, ULONG,
ICIF_QUERY | ICIF_QUERY_SIZE_VARIABLE ICIF_QUERY
), ),
/* ThreadIdealProcessor */ /* ThreadIdealProcessor */
@ -524,7 +524,7 @@ static const INFORMATION_CLASS_INFO PsThreadInfoClass[] =
( (
ULONG_PTR, ULONG_PTR,
ULONG, ULONG,
ICIF_SET | ICIF_SIZE_VARIABLE ICIF_SET
), ),
/* ThreadPriorityBoost */ /* ThreadPriorityBoost */
@ -534,7 +534,7 @@ static const INFORMATION_CLASS_INFO PsThreadInfoClass[] =
ULONG, ULONG,
ULONG_PTR, ULONG_PTR,
ULONG, ULONG,
ICIF_QUERY | ICIF_SET | ICIF_SIZE_VARIABLE ICIF_QUERY | ICIF_SET
), ),
/* ThreadSetTlsArrayAddress */ /* ThreadSetTlsArrayAddress */
@ -550,7 +550,7 @@ static const INFORMATION_CLASS_INFO PsThreadInfoClass[] =
( (
ULONG, ULONG,
ULONG, ULONG,
ICIF_QUERY | ICIF_QUERY_SIZE_VARIABLE ICIF_QUERY
), ),
/* ThreadHideFromDebugger */ /* ThreadHideFromDebugger */
@ -566,7 +566,7 @@ static const INFORMATION_CLASS_INFO PsThreadInfoClass[] =
( (
ULONG, ULONG,
ULONG, ULONG,
ICIF_QUERY | ICIF_SET | ICIF_SIZE_VARIABLE ICIF_QUERY | ICIF_SET
), ),
/* ThreadSwitchLegacyState */ /* ThreadSwitchLegacyState */
@ -574,7 +574,7 @@ static const INFORMATION_CLASS_INFO PsThreadInfoClass[] =
( (
ULONG, ULONG,
ULONG, ULONG,
ICIF_SET | ICIF_SET_SIZE_VARIABLE ICIF_SET
), ),
/* ThreadIsTerminated */ /* ThreadIsTerminated */
@ -582,7 +582,7 @@ static const INFORMATION_CLASS_INFO PsThreadInfoClass[] =
( (
ULONG, ULONG,
ULONG, ULONG,
ICIF_QUERY | ICIF_QUERY_SIZE_VARIABLE ICIF_QUERY
), ),
/* ThreadLastSystemCall */ /* ThreadLastSystemCall */

3
ntoskrnl/include/ntoskrnl.h
View file

@ -124,6 +124,9 @@ C_ASSERT(MAX_WIN32_PATH == MAX_PATH);
#include "internal/probe.h" #include "internal/probe.h"
#include "resource.h" #include "resource.h"
/* Internal Ps alignment probing header */
#include "internal/ps_i.h"
#ifdef _MSC_VER #ifdef _MSC_VER
# pragma section("INITDATA", read,write,discard) # pragma section("INITDATA", read,write,discard)
#endif #endif

3
ntoskrnl/io/iomgr/iocomp.c
View file

@ -399,7 +399,8 @@ NtQueryIoCompletion(IN HANDLE IoCompletionHandle,
IoCompletionInformationLength, IoCompletionInformationLength,
ResultLength, ResultLength,
NULL, NULL,
PreviousMode); PreviousMode,
TRUE);
if (!NT_SUCCESS(Status)) return Status; if (!NT_SUCCESS(Status)) return Status;
/* Get the Object */ /* Get the Object */

89
ntoskrnl/ps/query.c
View file

@ -86,26 +86,20 @@ NtQueryInformationProcess(
ULONG Flags; ULONG Flags;
PAGED_CODE(); PAGED_CODE();
/* Check for user-mode caller */ /* Verify Information Class validity */
if (PreviousMode != KernelMode) Status = DefaultQueryInfoBufferCheck(ProcessInformationClass,
PsProcessInfoClass,
RTL_NUMBER_OF(PsProcessInfoClass),
ProcessInformation,
ProcessInformationLength,
ReturnLength,
NULL,
PreviousMode,
FALSE);
if (!NT_SUCCESS(Status))
{ {
/* Prepare to probe parameters */ DPRINT1("NtQueryInformationProcess(): Information verification class failed! (Status -> 0x%lx, ProcessInformationClass -> %lx)\n", Status, ProcessInformationClass);
_SEH2_TRY return Status;
{
/* Probe the buffer */
ProbeForRead(ProcessInformation,
ProcessInformationLength,
sizeof(ULONG));
/* Probe the return length if required */
if (ReturnLength) ProbeForWriteUlong(ReturnLength);
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{
/* Return the exception code */
_SEH2_YIELD(return _SEH2_GetExceptionCode());
}
_SEH2_END;
} }
if (((ProcessInformationClass == ProcessCookie) || if (((ProcessInformationClass == ProcessCookie) ||
@ -794,6 +788,13 @@ NtQueryInformationProcess(
/* Per-process security cookie */ /* Per-process security cookie */
case ProcessCookie: case ProcessCookie:
if (ProcessInformationLength != sizeof(ULONG))
{
/* Length size wrong, bail out */
Status = STATUS_INFO_LENGTH_MISMATCH;
break;
}
/* Get the current process and cookie */ /* Get the current process and cookie */
Process = PsGetCurrentProcess(); Process = PsGetCurrentProcess();
Cookie = Process->Cookie; Cookie = Process->Cookie;
@ -1131,15 +1132,17 @@ NtSetInformationProcess(IN HANDLE ProcessHandle,
PAGED_CODE(); PAGED_CODE();
/* Verify Information Class validity */ /* Verify Information Class validity */
#if 0
Status = DefaultSetInfoBufferCheck(ProcessInformationClass, Status = DefaultSetInfoBufferCheck(ProcessInformationClass,
PsProcessInfoClass, PsProcessInfoClass,
RTL_NUMBER_OF(PsProcessInfoClass), RTL_NUMBER_OF(PsProcessInfoClass),
ProcessInformation, ProcessInformation,
ProcessInformationLength, ProcessInformationLength,
PreviousMode); PreviousMode);
if (!NT_SUCCESS(Status)) return Status; if (!NT_SUCCESS(Status))
#endif {
DPRINT1("NtSetInformationProcess(): Information verification class failed! (Status -> 0x%lx, ProcessInformationClass -> %lx)\n", Status, ProcessInformationClass);
return Status;
}
/* Check what class this is */ /* Check what class this is */
Access = PROCESS_SET_INFORMATION; Access = PROCESS_SET_INFORMATION;
@ -1846,7 +1849,7 @@ NtSetInformationProcess(IN HANDLE ProcessHandle,
case ProcessEnableAlignmentFaultFixup: case ProcessEnableAlignmentFaultFixup:
/* Check buffer length */ /* Check buffer length */
if (ProcessInformationLength != sizeof(ULONG)) if (ProcessInformationLength != sizeof(BOOLEAN))
{ {
Status = STATUS_INFO_LENGTH_MISMATCH; Status = STATUS_INFO_LENGTH_MISMATCH;
break; break;
@ -2036,15 +2039,17 @@ NtSetInformationThread(IN HANDLE ThreadHandle,
PAGED_CODE(); PAGED_CODE();
/* Verify Information Class validity */ /* Verify Information Class validity */
#if 0
Status = DefaultSetInfoBufferCheck(ThreadInformationClass, Status = DefaultSetInfoBufferCheck(ThreadInformationClass,
PsThreadInfoClass, PsThreadInfoClass,
RTL_NUMBER_OF(PsThreadInfoClass), RTL_NUMBER_OF(PsThreadInfoClass),
ThreadInformation, ThreadInformation,
ThreadInformationLength, ThreadInformationLength,
PreviousMode); PreviousMode);
if (!NT_SUCCESS(Status)) return Status; if (!NT_SUCCESS(Status))
#endif {
DPRINT1("NtSetInformationThread(): Information verification class failed! (Status -> 0x%lx, ThreadInformationClass -> %lx)\n", Status, ThreadInformationClass);
return Status;
}
/* Check what kind of information class this is */ /* Check what kind of information class this is */
switch (ThreadInformationClass) switch (ThreadInformationClass)
@ -2634,26 +2639,20 @@ NtQueryInformationThread(IN HANDLE ThreadHandle,
ULONG ThreadTerminated; ULONG ThreadTerminated;
PAGED_CODE(); PAGED_CODE();
/* Check if we were called from user mode */ /* Verify Information Class validity */
if (PreviousMode != KernelMode) Status = DefaultQueryInfoBufferCheck(ThreadInformationClass,
PsThreadInfoClass,
RTL_NUMBER_OF(PsThreadInfoClass),
ThreadInformation,
ThreadInformationLength,
ReturnLength,
NULL,
PreviousMode,
FALSE);
if (!NT_SUCCESS(Status))
{ {
/* Enter SEH */ DPRINT1("NtQueryInformationThread(): Information verification class failed! (Status -> 0x%lx , ThreadInformationClass -> %lx)\n", Status, ThreadInformationClass);
_SEH2_TRY return Status;
{
/* Probe the buffer */
ProbeForWrite(ThreadInformation,
ThreadInformationLength,
sizeof(ULONG));
/* Probe the return length if required */
if (ReturnLength) ProbeForWriteUlong(ReturnLength);
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{
/* Return the exception code */
_SEH2_YIELD(return _SEH2_GetExceptionCode());
}
_SEH2_END;
} }
/* Check what class this is */ /* Check what class this is */

3
ntoskrnl/se/token.c
View file

@ -2400,7 +2400,8 @@ NtQueryInformationToken(
TokenInformationLength, TokenInformationLength,
ReturnLength, ReturnLength,
NULL, NULL,
PreviousMode); PreviousMode,
TRUE);
if (!NT_SUCCESS(Status)) if (!NT_SUCCESS(Status))
{ {
DPRINT("NtQueryInformationToken() failed, Status: 0x%x\n", Status); DPRINT("NtQueryInformationToken() failed, Status: 0x%x\n", Status);

24
sdk/include/ndk/pstypes.h
View file

@ -911,18 +911,6 @@ typedef struct _POOLED_USAGE_AND_LIMITS
SIZE_T PagefileLimit; SIZE_T PagefileLimit;
} POOLED_USAGE_AND_LIMITS, *PPOOLED_USAGE_AND_LIMITS; } POOLED_USAGE_AND_LIMITS, *PPOOLED_USAGE_AND_LIMITS;
typedef struct _PROCESS_LDT_INFORMATION
{
ULONG Start;
ULONG Length;
LDT_ENTRY LdtEntries[ANYSIZE_ARRAY];
} PROCESS_LDT_INFORMATION, *PPROCESS_LDT_INFORMATION;
typedef struct _PROCESS_LDT_SIZE
{
ULONG Length;
} PROCESS_LDT_SIZE, *PPROCESS_LDT_SIZE;
typedef struct _PROCESS_WS_WATCH_INFORMATION typedef struct _PROCESS_WS_WATCH_INFORMATION
{ {
PVOID FaultingPc; PVOID FaultingPc;
@ -951,6 +939,18 @@ typedef struct _PROCESS_HANDLE_TRACING_QUERY
#endif #endif
typedef struct _PROCESS_LDT_INFORMATION
{
ULONG Start;
ULONG Length;
LDT_ENTRY LdtEntries[ANYSIZE_ARRAY];
} PROCESS_LDT_INFORMATION, *PPROCESS_LDT_INFORMATION;
typedef struct _PROCESS_LDT_SIZE
{
ULONG Length;
} PROCESS_LDT_SIZE, *PPROCESS_LDT_SIZE;
typedef struct _PROCESS_PRIORITY_CLASS typedef struct _PROCESS_PRIORITY_CLASS
{ {
BOOLEAN Foreground; BOOLEAN Foreground;