Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-06-15 17:11:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

[0.4.9][NTOS:CC] Access SectionObjectPointers without lock in CcRosInitializ…

Browse source 
…eFileCache. CORE-14691

kmtest:NtCreateSection calls CcInitializeCacheMap with a
NULL value for SectionObjectPointers. This will cause an exception when
trying to access it, which in Windows can be handled gracefully.
However accessing it while holding ViewLock means the lock will not be
released, leading to an APC_INDEX_MISMATCH bugcheck.

This solves the problem by allocating SharedCacheMap outside the lock,
then freeing it again under lock if another thread has updated SharedCacheMap
in the mean time. This is also What Windows Does(TM).

The 100%-chance BSOD in kmtest:NtCreateSection was a regression
introduced by 0.4.10-dev-20-g
8a8cb4d890
which we once ported back into 0.4.9-RC-13-g
09f068086d
to support building ros on ros. That's why 0.4.9 is also in need of a fix.

The BSOD fix was cherry picked from 0.4.10-dev-191-g
1d398057a3
This commit is contained in:
Joachim Henze 2020-10-04 12:52:08 +02:00
parent d172937b63
commit f5c37a88d3
1 changed files with 21 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
ntoskrnl/cc/view.c
View file

@ -1394,7 +1394,6 @@ CcRosInitializeFileCache (
DPRINT("CcRosInitializeFileCache(FileObject 0x%p)\n", FileObject);
Allocated = FALSE;
KeAcquireGuardedMutex(&ViewLock);
SharedCacheMap = FileObject->SectionObjectPointer->SharedCacheMap;
if (SharedCacheMap == NULL)
{
@ -1402,14 +1401,9 @@ CcRosInitializeFileCache (
SharedCacheMap = ExAllocateFromNPagedLookasideList(&SharedCacheMapLookasideList);
if (SharedCacheMap == NULL)
{
KeReleaseGuardedMutex(&ViewLock);
return STATUS_INSUFFICIENT_RESOURCES;
}
RtlZeroMemory(SharedCacheMap, sizeof(*SharedCacheMap));
ObReferenceObjectByPointer(FileObject,
FILE_ALL_ACCESS,
NULL,
KernelMode);
SharedCacheMap->NodeTypeCode = NODE_TYPE_SHARED_MAP;
SharedCacheMap->NodeByteSize = sizeof(*SharedCacheMap);
SharedCacheMap->FileObject = FileObject;
@ -1423,11 +1417,28 @@ CcRosInitializeFileCache (
InitializeListHead(&SharedCacheMap->PrivateList);
KeInitializeSpinLock(&SharedCacheMap->CacheMapLock);
InitializeListHead(&SharedCacheMap->CacheMapVacbListHead);
FileObject->SectionObjectPointer->SharedCacheMap = SharedCacheMap;
}
OldIrql = KeAcquireQueuedSpinLock(LockQueueMasterLock);
InsertTailList(&CcCleanSharedCacheMapList, &SharedCacheMap->SharedCacheMapLinks);
KeReleaseQueuedSpinLock(LockQueueMasterLock, OldIrql);
KeAcquireGuardedMutex(&ViewLock);
if (Allocated)
{
if (FileObject->SectionObjectPointer->SharedCacheMap == NULL)
{
ObReferenceObjectByPointer(FileObject,
FILE_ALL_ACCESS,
NULL,
KernelMode);
FileObject->SectionObjectPointer->SharedCacheMap = SharedCacheMap;
OldIrql = KeAcquireQueuedSpinLock(LockQueueMasterLock);
InsertTailList(&CcCleanSharedCacheMapList, &SharedCacheMap->SharedCacheMapLinks);
KeReleaseQueuedSpinLock(LockQueueMasterLock, OldIrql);
}
else
{
ExFreeToNPagedLookasideList(&SharedCacheMapLookasideList, SharedCacheMap);
SharedCacheMap = FileObject->SectionObjectPointer->SharedCacheMap;
}
}
if (FileObject->PrivateCacheMap == NULL)
{