Make special pool usable:
- Invalidate PTEs on free to catch use-after-free situations (and not confuse Mm)
- Fix pattern check not to look for more than 8 bits in a byte
- Enable POOL_FLAG_SPECIAL_POOL if special pool has been initialized
- Implement MmExpandSpecialPool
- Issue the correct SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION bugcheck when problems are detected
- Magic values--
To enable special pool for a single tag, set a value for MmSpecialPoolTag in ntoskrnl/mm/ARM3/pool.c.
To enable it for more than one tag, set MmSpecialPoolTag and modify MmUseSpecialPool in ntoskrnl/mm/ARM3/special.c (e.g. to return TRUE independent of Tag).
CORE-8680 #resolve
svn path=/trunk/; revision=64886
- Generate PAGE_FAULT_IN_NONPAGED_AREA bugcheck for PTEs that have their protection set to zero. This gives a more useful error description than the infamous 'TempPte.u.Long != 0' assertion*.
CORE-8679 #resolve
* and is also What Windows Does(TM)
svn path=/trunk/; revision=64885
- Fix a few usages of UserSetCursor
- Defer the actual freeing of cursor resources to when the object is freed for real.
CORE-7575
svn path=/trunk/; revision=64879
- "Convert" new cursor & icons implementation to the new user object handle manager.
- Fix a few idiosyncracies in the way cursor handles are used (only with USE_NEW_CURSORICON_ENABLED)
[WIN32SS]
- Storm out the flowers out of how classes use icon and cursor objects, with proper refcounting and all those joyous things.
Handles are for the powerless, kernel mode use pointers.
Only with USE_NEW_CURSORICON enabled (soon!)
CORE-7575
svn path=/trunk/; revision=64877
- reference the current process info structure while we're leaving win32k.
The process can die anytime while we're not looking.
CORE-8663 #resolve
svn path=/trunk/; revision=64863
- Remove code that breaks wine release 1.7.29 user32 input tests. Code was there since r2505.
- So due to this commit, over compensating hacks can break.
svn path=/trunk/; revision=64860
- Control register 0 is CR0: use FAST486_REG_CR0 instead of 0, as it is done in the rest of the code.
- Improve a if/else if control.
- Don't halt the processor in the middle of prefixes processing.
svn path=/trunk/; revision=64851
* Use the x86 toolchain for host tools if the targeting platform is ARM. Brought to you by Yuntian Zhang.
CORE-7407 #resolve #comment Committed in r64849. Thanks!
svn path=/trunk/; revision=64849
- add a missing break and reshuffle the code a tiny bit to fix CIDs 514466 and 513487
- don't skip the terminating debug print for ft_glyph_format_bitmap
svn path=/trunk/; revision=64847
- Move FCB list removal to vfatDelFCBFromTable, since vfatAddFCBToTable does the insert. Fixes list corruption in vfatUpdateFCB.
svn path=/trunk/; revision=64843
- Correctly interpret SeCreateClientSecurity return value in NpInitializeSecurity
- Always charge quota when allocating client context
- Specify explicit 0 tag when freeing allocations with unknown pool tag
- Misc readability fixes
svn path=/trunk/; revision=64839
- Do not pass IO_STATUS_BLOCKs when creating IRPs for asynchronous use. Fixes a use-after-free where AfdCloseSocket would cancel IRPs without actually waiting for their completion, and proceed to free the FCB, which contained these IO_STATUS_BLOCKs.
Note that using TdiBuildInternalDeviceControlIrp for these requests is broken in the first place, since it is intended for synchronous requests and requires a guarantee about the calling thread's lifetime. These functions (and their completion routines) should use IoAllocateIrp/IoReuseIrp/IoFreeIrp instead. However this can be fixed later; the incredibly annoying nonpaged pool corruption due to this that has been around for 10 years should be fixed with this commit.
CORE-8640 #resolve
svn path=/trunk/; revision=64838