added more irql checks

svn path=/trunk/; revision=13714
This commit is contained in:
Thomas Bluemel 2005-02-22 19:25:17 +00:00
parent fee36b29eb
commit f871df2c56
12 changed files with 115 additions and 16 deletions

View file

@ -116,7 +116,7 @@ ExReleaseRundownProtectionEx (
if (Current & EX_RUNDOWN_ACTIVE)
{
/* Get Pointer */
PRUNDOWN_DESCRIPTOR RundownDescriptor = (PRUNDOWN_DESCRIPTOR)((ULONG_PTR)RunRef->Ptr & ~EX_RUNDOWN_ACTIVE);
PRUNDOWN_DESCRIPTOR RundownDescriptor = (PRUNDOWN_DESCRIPTOR)(Current & ~EX_RUNDOWN_ACTIVE);
if (RundownDescriptor == NULL)
{

View file

@ -184,6 +184,8 @@ NtImpersonateThread(IN HANDLE ThreadHandle,
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
if(PreviousMode != KernelMode)
@ -499,6 +501,8 @@ PsCreateTeb(HANDLE ProcessHandle,
ULONG TebSize;
PVOID TebBase;
TEB Teb;
PAGED_CODE();
TebSize = PAGE_SIZE;
@ -672,6 +676,8 @@ NtCreateThread(OUT PHANDLE ThreadHandle,
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
if(ThreadContext == NULL)
{
return STATUS_INVALID_PARAMETER;
@ -852,6 +858,8 @@ PsCreateSystemThread(PHANDLE ThreadHandle,
NTSTATUS Status;
KIRQL oldIrql;
PAGED_CODE();
DPRINT("PsCreateSystemThread(ThreadHandle %x, ProcessHandle %x)\n",
ThreadHandle,ProcessHandle);

View file

@ -192,6 +192,8 @@ NtGetContextThread(IN HANDLE ThreadHandle,
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
if(PreviousMode != KernelMode)
@ -316,6 +318,8 @@ NtSetContextThread(IN HANDLE ThreadHandle,
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
if(PreviousMode != KernelMode)

View file

@ -113,6 +113,8 @@ NtAssignProcessToJobObject(HANDLE JobHandle,
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
/* make sure we're having a handle with enough rights, especially the to
@ -200,6 +202,8 @@ NtCreateJobObject(PHANDLE JobHandle,
KPROCESSOR_MODE PreviousMode;
PEPROCESS CurrentProcess;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
CurrentProcess = PsGetCurrentProcess();
@ -305,6 +309,8 @@ NtIsProcessInJob(IN HANDLE ProcessHandle,
PreviousMode = ExGetPreviousMode();
PAGED_CODE();
Status = ObReferenceObjectByHandle(ProcessHandle,
PROCESS_QUERY_INFORMATION,
PsProcessType,
@ -367,6 +373,8 @@ NtOpenJobObject(PHANDLE JobHandle,
KPROCESSOR_MODE PreviousMode;
HANDLE hJob;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
@ -462,6 +470,8 @@ NtTerminateJobObject(HANDLE JobHandle,
PEJOB Job;
NTSTATUS Status;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
Status = ObReferenceObjectByHandle(JobHandle,

View file

@ -337,6 +337,8 @@ NtTerminateProcess(IN HANDLE ProcessHandle OPTIONAL,
NTSTATUS Status;
PEPROCESS Process;
PAGED_CODE();
DPRINT("NtTerminateProcess(ProcessHandle %x, ExitStatus %x)\n",
ProcessHandle, ExitStatus);
@ -373,6 +375,8 @@ NtTerminateThread(IN HANDLE ThreadHandle,
PETHREAD Thread;
NTSTATUS Status;
PAGED_CODE();
Status = ObReferenceObjectByHandle(ThreadHandle,
THREAD_TERMINATE,
PsThreadType,
@ -425,6 +429,8 @@ NtCallTerminatePorts(PETHREAD Thread)
PLIST_ENTRY current_entry;
PEPORT_TERMINATION_REQUEST current;
PAGED_CODE();
KeAcquireSpinLock(&Thread->ActiveTimerListLock, &oldIrql);
while ((current_entry = RemoveHeadList(&Thread->TerminationPortList)) !=
&Thread->TerminationPortList);
@ -451,6 +457,8 @@ NtRegisterThreadTerminatePort(HANDLE PortHandle)
KIRQL oldIrql;
PETHREAD Thread;
PAGED_CODE();
Status = ObReferenceObjectByHandle(PortHandle,
PORT_ALL_ACCESS,
LpcPortObjectType,

View file

@ -207,6 +207,8 @@ NTSTATUS STDCALL
NtQueryDefaultLocale(IN BOOLEAN UserProfile,
OUT PLCID DefaultLocaleId)
{
PAGED_CODE();
if (DefaultLocaleId == NULL)
return STATUS_UNSUCCESSFUL;
@ -252,6 +254,8 @@ NtSetDefaultLocale(IN BOOLEAN UserProfile,
WCHAR ValueBuffer[20];
HANDLE UserKey = NULL;
NTSTATUS Status;
PAGED_CODE();
if (UserProfile)
{
@ -358,6 +362,8 @@ NtQueryDefaultUILanguage(OUT PLANGID LanguageId)
HANDLE UserKey;
HANDLE KeyHandle;
NTSTATUS Status;
PAGED_CODE();
Status = RtlOpenCurrentUser(KEY_READ,
&UserKey);
@ -431,6 +437,8 @@ NtQueryDefaultUILanguage(OUT PLANGID LanguageId)
NTSTATUS STDCALL
NtQueryInstallUILanguage(OUT PLANGID LanguageId)
{
PAGED_CODE();
*LanguageId = PsInstallUILanguageId;
return STATUS_SUCCESS;
@ -451,6 +459,8 @@ NtSetDefaultUILanguage(IN LANGID LanguageId)
HANDLE UserHandle;
HANDLE KeyHandle;
NTSTATUS Status;
PAGED_CODE();
Status = RtlOpenCurrentUser(KEY_WRITE,
&UserHandle);

View file

@ -192,6 +192,8 @@ NtOpenProcessTokenEx(
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
if(PreviousMode == UserMode)
@ -505,6 +507,8 @@ PsCreatePeb(HANDLE ProcessHandle,
ULONG ViewSize;
PVOID TableBase;
NTSTATUS Status;
PAGED_CODE();
/* Allocate the Process Environment Block (PEB) */
Process->TebBlock = (PVOID) MM_ROUND_DOWN(PEB_BASE, MM_VIRTMEM_GRANULARITY);
@ -1163,6 +1167,8 @@ NtCreateProcess(OUT PHANDLE ProcessHandle,
{
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
@ -1219,7 +1225,8 @@ NtOpenProcess(OUT PHANDLE ProcessHandle,
"ObjectAttributes %x, ClientId %x { UniP %d, UniT %d })\n",
ProcessHandle, DesiredAccess, ObjectAttributes, ClientId,
ClientId->UniqueProcess, ClientId->UniqueThread);
PAGED_CODE();
/*
* Not sure of the exact semantics
@ -1315,6 +1322,8 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle,
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
DefaultQueryInfoBufferCheck(ProcessInformationClass,
@ -1787,6 +1796,8 @@ NtSetInformationProcess(IN HANDLE ProcessHandle,
ACCESS_MASK Access;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
DefaultSetInfoBufferCheck(ProcessInformationClass,
@ -2889,6 +2900,8 @@ PsLockProcess(PEPROCESS Process, BOOL Timeout)
PLARGE_INTEGER Delay = (Timeout ? &PsLockTimeout : NULL);
PKTHREAD CallingThread = KeGetCurrentThread();
PAGED_CODE();
KeEnterCriticalRegion();
for(;;)
@ -2946,6 +2959,8 @@ PsLockProcess(PEPROCESS Process, BOOL Timeout)
VOID
PsUnlockProcess(PEPROCESS Process)
{
PAGED_CODE();
ASSERT(Process->LockOwner == KeGetCurrentThread());
if(InterlockedDecrementUL(&Process->LockCount) == 0)

View file

@ -131,6 +131,8 @@ NtResumeThread(IN HANDLE ThreadHandle,
PETHREAD Thread;
NTSTATUS Status;
ULONG Count;
PAGED_CODE();
DPRINT("NtResumeThead(ThreadHandle %lx SuspendCount %p)\n",
ThreadHandle, SuspendCount);
@ -184,6 +186,8 @@ NtSuspendThread(IN HANDLE ThreadHandle,
PETHREAD Thread;
NTSTATUS Status;
ULONG Count;
PAGED_CODE();
Status = ObReferenceObjectByHandle(ThreadHandle,
THREAD_SUSPEND_RESUME,

View file

@ -992,6 +992,8 @@ NtOpenThread(OUT PHANDLE ThreadHandle,
IN PCLIENT_ID ClientId)
{
NTSTATUS Status = STATUS_INVALID_PARAMETER;
PAGED_CODE();
if((NULL != ThreadHandle)&&(NULL != ObjectAttributes))
{

View file

@ -98,6 +98,8 @@ NtSetInformationThread (IN HANDLE ThreadHandle,
HANDLE Handle;
PVOID Address;
}u;
PAGED_CODE();
if (ThreadInformationClass <= MaxThreadInfoClass &&
!SetInformationData[ThreadInformationClass].Implemented)
@ -206,21 +208,23 @@ NtQueryInformationThread (IN HANDLE ThreadHandle,
LARGE_INTEGER Count;
BOOLEAN Last;
}u;
PAGED_CODE();
if (ThreadInformationClass <= MaxThreadInfoClass &&
!QueryInformationData[ThreadInformationClass].Implemented)
{
return STATUS_NOT_IMPLEMENTED;
}
if (ThreadInformationClass > MaxThreadInfoClass ||
QueryInformationData[ThreadInformationClass].Size == 0)
{
return STATUS_INVALID_INFO_CLASS;
}
if (ThreadInformationLength != QueryInformationData[ThreadInformationClass].Size)
{
return STATUS_INFO_LENGTH_MISMATCH;
}
if (ThreadInformationClass <= MaxThreadInfoClass &&
!QueryInformationData[ThreadInformationClass].Implemented)
{
return STATUS_NOT_IMPLEMENTED;
}
if (ThreadInformationClass > MaxThreadInfoClass ||
QueryInformationData[ThreadInformationClass].Size == 0)
{
return STATUS_INVALID_INFO_CLASS;
}
if (ThreadInformationLength != QueryInformationData[ThreadInformationClass].Size)
{
return STATUS_INFO_LENGTH_MISMATCH;
}
Status = ObReferenceObjectByHandle(ThreadHandle,
THREAD_QUERY_INFORMATION,

View file

@ -82,6 +82,8 @@ NtCallbackReturn (PVOID Result,
PKTRAP_FRAME SavedTrapFrame;
PVOID SavedCallbackStack;
PVOID SavedExceptionStack;
PAGED_CODE();
Thread = PsGetCurrentThread();
if (Thread->Tcb.CallbackStack == NULL)
@ -259,6 +261,8 @@ NtW32Call (IN ULONG RoutineIndex,
NTSTATUS CallbackStatus;
NTW32CALL_SAVED_STATE SavedState;
PNTW32CALL_CALLBACK_STACK AssignedStack;
PAGED_CODE();
DPRINT("NtW32Call(RoutineIndex %d, Argument %X, ArgumentLength %d)\n",
RoutineIndex, Argument, ArgumentLength);

View file

@ -44,6 +44,8 @@ NTSTATUS SeExchangePrimaryToken(PEPROCESS Process,
PTOKEN OldToken;
PTOKEN NewToken = (PTOKEN)NewTokenP;
PAGED_CODE();
if (NewToken->TokenType != TokenPrimary)
{
return(STATUS_UNSUCCESSFUL);
@ -70,6 +72,8 @@ RtlLengthSidAndAttributes(ULONG Count,
{
ULONG i;
ULONG uLength;
PAGED_CODE();
uLength = Count * sizeof(SID_AND_ATTRIBUTES);
for (i = 0; i < Count; i++)
@ -306,6 +310,8 @@ SeCopyClientToken(PACCESS_TOKEN Token,
{
NTSTATUS Status;
OBJECT_ATTRIBUTES ObjectAttributes;
PAGED_CODE();
InitializeObjectAttributes(&ObjectAttributes,
NULL,
@ -340,6 +346,8 @@ SeCreateClientSecurity(IN struct _ETHREAD *Thread,
ULONG g;
PACCESS_TOKEN NewToken;
PAGED_CODE();
Token = PsReferenceEffectiveToken(Thread,
&TokenType,
&b,
@ -485,6 +493,8 @@ SeImpersonateClient(IN PSECURITY_CLIENT_CONTEXT ClientContext,
{
UCHAR b;
PAGED_CODE();
if (ClientContext->DirectlyAccessClientToken == FALSE)
{
b = ClientContext->SecurityQos.EffectiveOnly;
@ -569,6 +579,8 @@ NtQueryInformationToken(IN HANDLE TokenHandle,
PTOKEN_GROUPS PtrTokenGroups;
PTOKEN_DEFAULT_DACL PtrDefaultDacl;
PTOKEN_STATISTICS PtrTokenStatistics;
PAGED_CODE();
Status = ObReferenceObjectByHandle(TokenHandle,
(TokenInformationClass == TokenSource) ? TOKEN_QUERY_SOURCE : TOKEN_QUERY,
@ -906,6 +918,8 @@ NtSetInformationToken(IN HANDLE TokenHandle,
TOKEN_OWNER TokenOwnerSet = { 0 };
TOKEN_PRIMARY_GROUP TokenPrimaryGroupSet = { 0 };
DWORD NeededAccess = 0;
PAGED_CODE();
switch (TokenInformationClass)
{
@ -1042,6 +1056,8 @@ NtDuplicateToken(IN HANDLE ExistingTokenHandle,
PTOKEN Token;
PTOKEN NewToken;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = KeGetPreviousMode();
@ -1151,6 +1167,8 @@ NtAdjustGroupsToken(IN HANDLE TokenHandle,
ULONG b;
ULONG c;
PAGED_CODE();
Status = ObReferenceObjectByHandle(TokenHandle,
?,
SepTokenObjectType,
@ -1256,6 +1274,8 @@ NtAdjustPrivilegesToken (IN HANDLE TokenHandle,
ULONG c;
#endif
NTSTATUS Status;
PAGED_CODE();
DPRINT ("NtAdjustPrivilegesToken() called\n");
@ -1612,6 +1632,8 @@ NtCreateToken(OUT PHANDLE TokenHandle,
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
if(PreviousMode != KernelMode)
@ -1814,6 +1836,8 @@ NTSTATUS STDCALL
SeQueryAuthenticationIdToken(IN PACCESS_TOKEN Token,
OUT PLUID LogonId)
{
PAGED_CODE();
*LogonId = ((PTOKEN)Token)->AuthenticationId;
return STATUS_SUCCESS;
@ -1827,6 +1851,8 @@ SECURITY_IMPERSONATION_LEVEL
STDCALL
SeTokenImpersonationLevel(IN PACCESS_TOKEN Token)
{
PAGED_CODE();
return ((PTOKEN)Token)->ImpersonationLevel;
}
@ -1837,6 +1863,8 @@ SeTokenImpersonationLevel(IN PACCESS_TOKEN Token)
TOKEN_TYPE STDCALL
SeTokenType(IN PACCESS_TOKEN Token)
{
PAGED_CODE();
return ((PTOKEN)Token)->TokenType;
}
@ -1904,6 +1932,8 @@ NtOpenThreadTokenEx(IN HANDLE ThreadHandle,
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
if(PreviousMode != KernelMode)